The UK National Cyber Security Centre (NCSC) defines shadow IT as unknown assets used for business purposes that sit outside asset management and security policy. These unmanaged devices create operational risks ranging from data exfiltration to malware infection and lateral movement across networks.

Chinese EVs: Real Risk vs Proven Compromise

Chinese electric vehicles (EVs) are a high-profile example of this trend. Modern EVs are effectively networked computers equipped with cameras, microphones, GPS, telematics, smartphone pairing, and over-the-air update channels. These components create plausible risks around location tracking, cabin audio or camera collection, vehicle-state telemetry, and remote software updates.

The primary concern is not that every Chinese EV is actively compromised. Rather, it centers on opaque supply chains and update paths: vendors may control firmware, diagnostics, and cloud services, while telemetry data may be processed overseas. Chinese cellular IoT modules are especially relevant here because they are widely embedded across vehicles, routers, smart meters, EV chargers, and industrial equipment.

China has denied that its EVs pose a security threat, and reporting from the BBC indicates there is no public, credible evidence supporting claims that Chinese EVs threaten UK national security. A proportionate approach is to treat connected vehicles as high-assurance connected assets rather than automatically assuming they are hostile devices.

Lesser-Known Categories of Physical Shadow IT

Physical shadow IT extends far beyond vehicles. A wide range of connected hardware often bypasses corporate asset registers:

Why Households and Remote Workers Should Care

For households and remote staff, the practical dangers centre on privacy, account takeover, physical safety, and digital resilience. A compromised security camera, router, EV charger, or vehicle portal can expose daily routines, record conversations, or enable unauthorized remote controls.

Connected vehicles transmit location, diagnostics, and potentially cabin data. While this applies to connected cars generally, foreign vendor jurisdiction and data-handling practices can raise additional compliance and privacy concerns for organisations with hybrid working models.

Practical Controls for Businesses and Individuals

Managing physical shadow IT requires applying standard security hygiene to non-traditional hardware:

• Maintain an Inventory of Connected Assets: Log all connected hardware, including vehicles, chargers, solar equipment, routers, and embedded IoT modules.
• Segregate Network Traffic: Place IoT hardware, smart home kit, and vehicle systems on a segregated guest or dedicated IoT network, separate from core work computers and confidential servers.
• Restrict Device Permissions: Disable unnecessary permissions, focusing on microphone, camera, location sharing, remote control, and third-party app integrations.
• Secure Cloud Accounts: Implement unique passwords and multi-factor authentication (MFA) for vehicle portals, charger apps, inverter dashboards, and vendor management accounts.
• Review Data Policies and Updates: Check telemetry, data-export, and remote-update settings. Select vendors that publish clear security advisories, vulnerability disclosure processes, and data-residency policies.
• Update Acceptable-Use Policies: Include employee vehicles, home offices, and personal AI tools in corporate asset registers and acceptable-use policies. The NCSC specifically highlights that shadow AI can cause data breaches, intellectual-property loss, and regulatory non-compliance.
• Implement High-Assurance Protocols: For sensitive roles or environments, restrict confidential conversations inside vehicles, avoid pairing corporate mobile devices to unvetted vehicle systems, and assess vendor jurisdiction during procurement.

Reframing Physical Device Security

The effective takeaway is not to view every foreign connected product as an active spy device. Instead, any connected physical product with an opaque update path, overseas data processing, and privileged network access deserves the same rigorous technical scrutiny applied to an unmanaged laptop or external SaaS application.

Neil Campbell is owner and operator at SME Cyber Solutions Ltd and a member of the Crimes Against Biz Policy Group for the FSB. He writes about AI, automation and practical technology infrastructure for UK SMEs.