BIS Rule: Protecting Automakers from Adversarial Code

Client Alert

February 17, 2026

Norma

Dowler

Director of Product Marketing, Cyber

Executive Summary

Why Is This a Problem for Automakers?

After years of outsourcing software modules to their suppliers, automakers are discovering they don’t know what’s inside their sprawling, multi-tier software supply chains. Over time, “software from suppliers” stopped meaning a few clearly labeled features and started looking like big, bundled packages with limited visibility into who wrote what. Even with contracts and documentation, code often pulls in third-party libraries and subcontracted work many layers down.

So when the government asks, “show us where it came from,” many companies are scrambling to map ownership, provenance, and update paths across thousands of components. Russian or Chinese-linked code can be buried deep in supplier packages, including embedded systems and middleware. Replacing it can mean expensive rewrites, fresh safety and reliability testing, supplier changes, and potential delays to vehicle launches. And demonstrating compliance needs to be done every year.

Exiger Makes It Easy

Exiger Cyber instantly finds FOCI (foreign ownership, control, or influence) signals deep inside software supply chains. It monitors and analyzes 500M+ repositories, 150M+ packages, and more than 68M verified supplies.

By continuously monitoring software, contributors, and supplier relationships across billions of records, Exiger Cyber surfaces risky contributors and FOCI-linked code even when it’s buried deep in your supply chain.

Interactive Demo

Take a Self-Guided Tour

Watch the platform analyze an SBOM, rank every dependency by predicted exposure and quality, and reveal the visual graph that links risky libraries to your products, no source code required.

Why This Matters

This new regulation highlights three critical questions for every automaker:

Do you have full visibility into your software supply chain including all dependencies?

→ It’s not enough to track the software from the “Tier-1” suppliers you know about. You need visibility into the full dependency trees, and not just for compliance reasons. Removing adversarial software reduces risk.

How quickly can you identify Chinese or Russian software components?

→ Manually researching all software, and all dependency trees is impractical, slow, and expensive.

Are you continuously monitoring all existing and new software for FOCI risk?

→ Software components aren’t static and new contributors to software libraries and components can change. Automatically monitoring compliance minimizes your risk and costs.