On the Dash:
- Email phishing now outranks ransomware as dealers’ top cyber threat, with 78% citing it as a concern.
- 87% of dealers use AI, but only 6% have a fully defined governance framework for it.
- Employee training rose to 76% of dealers, while endpoint protection and real-time monitoring fell to four-year lows.
Email phishing now outranks ransomware as dealers’ top cyber threat, according to a new CDK Global study. The sixth annual State of Dealership Cybersecurity study surveyed 218 dealership executives and department heads. Just 17% reported a cyberattack in the past year, down from 21% in 2025. Fewer dealers reported attacks, yet concern over artificial intelligence (AI) is rising.
Phishing messages look more convincing
Dealers ranked email phishing above every other threat in the study, with 78% citing it as a concern. The full ranking looked like this:
- Email phishing, 78%
- Lack of employee awareness, 61%
- Ransomware, 56%
- PC virus or malware, 50%
- Theft of business data, 50%
Every dealer group size ranked phishing first. Concern ran from 66% at one- and two-rooftop stores to 89% at groups with 11 or more rooftops.
Dealers say the scams arrive more often and are harder to spot than in past years. Multiple dealers said employees received convincing emails from a sender posing as the store owner. Others reported messages that appeared to come from the store’s bank.
AI use runs ahead of AI policy
87% of dealers use AI in some way, but few have a complete policy to guide it. CDK Global asked how dealers govern AI use, and the answers varied widely:
- 6% have a fully defined framework with clear oversight, approvals and accountability
- 28% have a formal policy with monitoring, but the processes aren’t fully defined
- 26% have decentralized, partial or inconsistent governance across departments
- 24% have no governance or oversight in place
- 15% aren’t sure
The largest dealer groups show the widest difference between AI use and AI policy. At groups with 11 or more rooftops, 44% say AI is widely used, yet only 7% have full governance. Just 3% of one- and two-rooftop dealers report wide use.
Overall, 61% of dealers say AI has raised their concern about cyberattack risk. AI-powered phishing tops their worries at 76%, followed by malicious AI agents at 49%.
Training rebounds while monitoring slips
Employee training is the one area where dealers gained real ground, with 76% now training staff on cybersecurity. That figure rose from 70% in 2025, which itself followed a drop from 80%. Only 12% provide no training, and improving it is the top priority for the next 12 months.
Other protections weakened. Securing endpoint devices fell to 53% from 67%, and real-time monitoring slipped to 55% from 61%. CDK Global reports both are at their lowest levels in four years. Just 47% of dealers have a formal response plan.
Spending is moving up, though it remains a small share of dealer budgets. Average monthly spending reached $1,491.20 at one- and two-rooftop stores and $2,042.00 at groups with 11 or more rooftops.
