The access attempt your site walkthrough expects anyway

TISAX is close to mandatory for suppliers in the German automotive industry. This flyer covers the part a questionnaire cannot show: whether your plant site and prototypes hold up against a real access attempt.

  • Focus: site walkthrough and prototype protection
  • Experience with OEM and Tier-1 requirements
  • Free initial consultation

The pressure comes from above, the attack from below

Requirement Attack path OEM Manufacturer Asks for the evidence before data and parts start moving. Tier 1 Direct supplier Development, prototypes and series parts in house. Tier 2/3 Upstream suppliers Smaller, assessed less often, same access.
Requirement

You are assessed by your customer, not by a regulator. At AL2 an audit provider usually checks by web conference; only AL3 brings an on-site audit.

Attack path

Smaller suppliers are increasingly targeted, precisely because they are seen as an easier way into the ecosystem of the large OEMs.

The full VDA ISA mapping and the details on AL1 to AL3 are on our TISAX page.

A realistic scenario

  1. 01

    The pretext

    A tester shows up at the plant gate posing as a delivery driver, with hi-vis vest, clipboard and a plausible delivery.

  2. 02

    The entry

    At a busy turnstile it is often enough to slip in right behind an employee with a badge.

  3. 03

    Proximity to the prototype

    In the R&D area it becomes clear whether access zones and cameras keep an unauthorised person away from the camouflaged prototype.

Every step is controlled and agreed in advance, with a designated contact who is notified immediately if anything unexpected happens.

These tests round out your TISAX assessment

  • Physical pentest

    Simulated access to plant sites and prototype areas.

  • OT/ICS pentest

    Control systems, without risk to ongoing operations.

  • Infrastructure pentest

    Segmentation between R&D, production and administration.

Where attackers go after suppliers

  • R&D and prototypes

    CAD data, test vehicles and concept documents sit close together, often with more internal foot traffic than is visible from outside.

  • Production networks

    Manufacturing lines and control systems frequently run alongside standard IT, over connections that grew out of earlier network designs.

  • The supply chain itself

    For attackers, Tier-2 and Tier-3 suppliers are the more convenient way into the ecosystem of the large OEMs.

What we deliver and what we do not

We deliver the test and the technical evidence, in other words a report you can present to your auditor. The TISAX label itself is not issued by us, and we do not provide legal advice. For the full VDA ISA mapping and the Assessment Levels AL1 to AL3, see our TISAX page.

What you get

  • A realistic access attempt instead of a checklist: we simulate how somebody would actually try to get to a prototype.

  • A report with exactly the evidence your TISAX auditor wants to see in the assessment.

  • Test timing and test depth agreed in advance so that production and R&D keep running.

Does a physical assessment disrupt ongoing production?

No, not if it is planned properly. We agree time windows, areas and emergency contacts in advance with plant security and plant management. The test follows the way a real intruder would go about it: attempts to get in at gates and side entrances, tailgating during shift change, the route from the visitor area to the prototype store. Production lines are not stopped in the process, machines are not touched, and occupational safety takes priority. If a tester runs into a situation that could disrupt operations, they break off. Most teams only realise in the debrief that the test has taken place.

Frequently asked questions

What exactly is prototype protection?

An assessment module of its own within TISAX for protecting test vehicles and test parts against unauthorised viewing: covers, camouflage, secure storage, transport, and access control to the areas concerned. The labels that go with it are explained on our TISAX page.

Do you also test Tier-2 and Tier-3 suppliers?

Yes. Smaller suppliers in particular are increasingly targeted, because they are often seen as an easier way into the supply chain of large OEMs. We adapt scope and depth to your company size and your Assessment Level.

Does a prototype protection assessment always happen on site?

The physical core, meaning the simulated access attempt, yes. That is not something that can be tested remotely. Preparation, scoping and evaluation run over video call, so that the effort on site remains limited to the actual test.

What does a physical assessment for an automotive site cost?

It depends on the number and size of your sites and on whether social engineering is added as preparation. A short initial call is enough to narrow that down, and afterwards you get a fixed quote.

How is this different from your TISAX page?

The TISAX page covers the topic as a whole: VDA ISA controls, Assessment Levels AL1 to AL3, TISAX labels and the comparison with ISO 27001. This flyer takes out one part of it, physical access to plant sites and prototype areas, because that is often the part that gets tested least.

Ready to put your plant site to the test?

In 30 minutes we go through your scope together and clarify what is relevant for prototype protection and the site walkthrough. This is free of charge and without obligation.

All about the service: access-granted.de/en/branchen/automotive

Book a consultation Get in touch

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

© AccessGranted X GmbH Last updated: September 18, 2026