Dealerships are embracing artificial intelligence, but few have formal policies in place to oversee its use.
CDK’s State of Dealership Cybersecurity 2026 report found that while 87 per cent of surveyed dealership leaders reported using AI in some capacity, only six per cent said they had a fully defined AI governance framework.
The findings highlight a gap between technology adoption and oversight, with 61 per cent of respondents saying AI has increased their concerns about cybersecurity risks. Another 24 per cent reported having no AI governance or oversight in place, while 15 per cent were unsure whether a policy existed.
Beyond AI, email phishing remained the leading cybersecurity threat, cited by 78 per cent of respondents, followed by lack of employee awareness at 61 per cent and ransomware at 56 per cent. Other concerns included malware and theft of business data, both at 50 per cent, and stolen or weak passwords at 39 per cent.
The report also revealed uneven progress in dealership security practices. The percentage of respondents reporting secure endpoint devices fell to 53 per cent from 67 per cent last year, while real-time monitoring declined to 55 per cent from 61 per cent. Both measures reached their lowest levels in four years.
However, employee training increased to 76 per cent from 70 per cent, while email security rose to 89 per cent from 85 per cent.
Dealerships are also investing more in cybersecurity, with respondents reporting a 10 per cent increase in spending compared with last year. Looking ahead, 53 per cent plan to increase their budgets by one to 10 per cent over the next 12 months.
Employee training and awareness remained dealers’ top cybersecurity priority, followed by implementing new security technologies and improving active management and monitoring.
The sixth annual study surveyed 218 dealership executives and department heads.
