A modern GPS tracking system does far more than place a vehicle icon on a map. Depending on the solution, a fleet manager may be able to review routes, driver behaviour, fuel information, dashcam footage, geofences and vehicle alerts from a phone or computer. This connectivity creates enormous operational value, but it also means businesses need to think about another type of vehicle security that is easy to overlook: fleet telematics cybersecurity.

When most vehicle owners think about GPS security, they worry about somebody physically finding and removing the tracker. For a connected fleet, however, physical tampering is only one risk. The tracking account itself, employee passwords, mobile phones, APIs, cloud systems and connected devices all form part of the wider security environment. If an unauthorised person gains access to one of these systems, they may be able to view information that the company never intended them to see.

This issue is becoming increasingly relevant as connected devices expand across Kenya. Communications Authority statistics for the quarter ending March 2026 showed approximately 2 million machine-to-machine subscriptions, up 8.8 percent from December 2025. The regulator specifically identifies fleet management and vehicle telematics among the services using machine-to-machine SIM connections. As more vehicles become digitally connected, cybersecurity becomes an operational fleet-management issue rather than something that concerns only large technology companies.

The first risk is often surprisingly simple: weak account credentials. A business may invest thousands of shillings in vehicle security while several employees continue sharing one GPS-platform username and password through WhatsApp. When an employee leaves the company, nobody changes the password. Months later, that former employee may technically still have access to vehicle locations.

A tracking account should therefore be treated as a business system, not as a casual application. Each authorised employee should ideally have their own account where the platform supports multiple users. Access should reflect the person’s responsibilities. A dispatcher may need to see live vehicle locations, while another employee may only need reports. Giving every member of staff full administrator access creates unnecessary risk.

Passwords should also be unique. Using the same password for a GPS platform, email account, social-media profile and several other business systems means one compromised service can potentially create problems elsewhere. Businesses should use strong passwords and multi-factor authentication wherever the tracking platform supports it.

The employee’s mobile phone is another part of the security chain. A fleet manager may have the tracking application permanently logged in on a smartphone that also contains email, WhatsApp and company information. If the device is lost or stolen without proper screen security, an unauthorised person could potentially gain access to valuable operational information.

Fleet managers should therefore secure phones and laptops used for tracking just as carefully as they secure the vehicles themselves. Devices should have strong screen locks, current software and the ability to be remotely locked or wiped where appropriate. Employees should avoid saving passwords in insecure notes or sending administrator credentials through group chats.

The tracking platform contains information that can be commercially sensitive even if no remote vehicle commands are available. It may reveal where vehicles are parked overnight, which routes carry valuable cargo, when trucks leave warehouses and which customers are being served. For a logistics business, that data can expose a detailed picture of how the company operates.

Kenya’s Office of the Data Protection Commissioner has specifically recognised the growing use of GPS tracking, fleet management systems and digital transport platforms and says transport operators must protect personal information from unauthorised access, disclosure and loss. Its 2026 transport-sector guidance notes that increasing digitalisation creates both operational benefits and privacy risks.

Dashcams make this issue even more important. A video telematics platform may contain road footage, driver-facing footage and recordings associated with accidents or unusual events. This information should not be accessible to every employee simply because they work for the company. Access should be restricted to people who genuinely require it for safety, operations, investigations or another legitimate business purpose.

GPS systems that support remote commands require even stronger controls. Depending on the tracker and installation, some systems may support functions such as remote engine immobilisation or restoration. An unauthorised person obtaining access to a platform with command privileges creates a significantly different risk from somebody who can merely view a map.

Remote vehicle commands should therefore be restricted to a very small number of authorised users. Where the platform allows permission levels, ordinary tracking users should not automatically receive control privileges. Businesses should also establish internal procedures defining when remote immobilisation can be used and who is authorised to approve it.

International automotive cybersecurity guidance increasingly takes this layered approach. The U.S. National Highway Traffic Safety Administration defines vehicle cybersecurity as protecting vehicle electronic systems, communication networks, software, users and data from unauthorised access or manipulation. It recommends multiple layers of security rather than relying on a single defence.

This principle is particularly important because the connected vehicle ecosystem extends beyond the vehicle itself. NHTSA’s October 2026 automotive cybersecurity discussion highlighted cloud infrastructure, connected services and aftermarket devices as potential areas of exposure. The agency noted that connected vehicles increasingly depend on external software and backend systems, meaning security must cover much more than the electronics physically installed in the car.

For fleet operators, this means choosing the tracking hardware is only part of the decision. The business should also consider the security of the platform that receives and stores the data. Who operates the server? How is user access controlled? Can the administrator create separate accounts? Is multi-factor authentication available? How are password resets handled? Can former employees be removed immediately?

These questions become even more important when a tracking system connects to other applications through an API. A logistics company may connect GPS information to an ERP, dispatch platform or customer-delivery portal. This can improve efficiency, but every additional connection must be secured properly.

API credentials should never be exposed publicly in website code or shared casually among employees. If an integration only needs to read vehicle locations, it should ideally not receive permission to perform unrelated administrative functions. Giving software the minimum access necessary is a basic security principle that can reduce the consequences of a compromised account.

Businesses should also regularly review which integrations remain active. A company may develop a customer portal, testing application or temporary software integration and then forget about it. Months later, the API credential may still be active even though the original project is no longer being used. Removing unnecessary access reduces the number of possible entry points into the fleet environment.

Aftermarket hardware deserves similar attention. GPS trackers, dashcams, CAN bus interfaces and other connected equipment can interact with vehicle electrical and communication systems. NHTSA’s current cybersecurity guidance specifically warns that aftermarket products can introduce new attack pathways and says third-party connections should be authenticated and limited appropriately.

This does not mean aftermarket telematics equipment is inherently unsafe. It means businesses should avoid installing unknown devices simply because they are cheap. A professional fleet installation should use appropriate hardware from established manufacturers and should understand what the device is connected to inside the vehicle.

An ordinary GPS tracker that reads power and ignition information may create a different risk profile from a sophisticated device connected directly to CAN bus systems or capable of issuing vehicle commands. The more access a device has to vehicle electronics, the more carefully its security and installation should be considered.

Physical access remains important too. CISA’s connected-vehicle security guidance recommends monitoring vehicles for signs of unauthorised physical access or tampering, including unknown devices connected to diagnostic ports, altered wiring or evidence that dashboard components have been disturbed. Fleet managers should therefore investigate unfamiliar electronic devices rather than assuming everything connected inside the vehicle belongs there.

Workshops can create an overlooked security risk. Company vehicles regularly visit garages, electrical technicians, body shops and tyre centres. During repairs, employees outside the organisation may have extended physical access to the vehicle. Businesses operating sensitive fleets should inspect tracking and telematics equipment after major electrical or dashboard work.

A tracker that suddenly behaves differently after workshop repairs should not automatically be assumed to have been hacked. Wiring may simply have been disconnected accidentally. However, the fleet manager should confirm that the tracker, dashcam and any other connected equipment remain installed and functioning normally.

Cybersecurity also affects software updates. Connected devices and applications sometimes receive firmware or software updates to fix errors, improve compatibility or address security weaknesses. Ignoring updates permanently can leave older vulnerabilities in place. CISA recommends keeping connected vehicle software updated as part of broader cybersecurity risk management.

At the same time, businesses should obtain updates through authorised sources. Downloading unknown firmware from unofficial websites or allowing unqualified technicians to modify telematics equipment can create new problems. Fleet hardware should remain under a controlled maintenance process.

Another threat worth understanding is GPS spoofing. Jamming attempts to interfere with satellite reception, while spoofing involves transmitting deceptive signals that could cause a receiver to calculate an incorrect location. NHTSA’s cybersecurity best-practices guidance specifically recognises GPS spoofing and other forms of sensor manipulation as vehicle cybersecurity risks.

For ordinary fleet managers, the practical lesson is not to become experts in satellite attacks. It is to avoid treating every coordinate on a screen as infallible. If GPS information becomes dramatically inconsistent with other vehicle records, the fleet should investigate the complete situation, including trip history, mobile communication, power status and other available telematics information.

Jamming, spoofing and account compromise are different problems. A jammer interferes with communication or positioning signals. Spoofing attempts to mislead positioning. Account compromise happens when an unauthorised person gains access to the platform or credentials. They may all affect the way the fleet appears digitally, but the response to each situation is different.

This is another reason businesses should maintain layered security. A primary wired tracker may provide the normal vehicle-monitoring system. A wireless tracker or independent tracking tag can provide another layer for high-risk vehicles. An alarm system and hidden immobilisation measure can protect the physical vehicle, while strong platform credentials protect digital access.

The tracking platform audit trail can also be valuable. Where supported, administrators should review account activity periodically. If a user account is logging in at unusual times or an employee who no longer works for the organisation remains active, the account should be investigated and disabled.

Staff changes are one of the simplest times to improve security. When an employee leaves, the company should remove their fleet-platform account, revoke API credentials associated with their role and recover company phones or devices. Waiting several months to clean up old access creates unnecessary exposure.

The same principle applies when a contractor or external consultant finishes a project. Temporary access should actually be temporary. Businesses often create administrator accounts for installers, developers or consultants and then forget that those accounts remain active after the work ends.

Fleet managers should periodically conduct a user-access review. The question is simple: who can currently see the vehicles, and does each person still need that access? This can be done quarterly or whenever significant staff changes occur.

Customer access needs similar control. Some logistics companies provide customers with tracking links so they can follow deliveries. This can improve service, but the customer should only receive information relevant to their shipment. They should not be able to explore the location of every vehicle in the fleet.

Links should ideally expire after the delivery or remain limited to the specific vehicle and period required. Permanent unrestricted tracking links can gradually become a security weakness if they are forwarded or stored.

Fleet data should also be backed up and protected against loss where it is important to the business. Cybersecurity is not only about hackers stealing information. Hardware failures, accidental deletion or software problems can also destroy useful records. Critical incident footage, maintenance information and other important fleet records should be preserved according to the organisation’s retention and backup policies.

This must be balanced with data protection. Businesses should not respond to cybersecurity concerns by keeping every GPS point and video recording forever. Kenya’s data-protection framework expects organisations to control access, establish retention periods and dispose of information when it is no longer reasonably necessary. Security and privacy therefore work together rather than competing with each other.

A fleet cybersecurity policy does not need to be complicated. It can define who receives GPS accounts, who can view dashcam footage, who has remote-control privileges, how passwords are managed, what happens when staff leave and how suspected security incidents are reported.

Employees should know what to do if something looks unusual. A dispatcher who suddenly sees several vehicles disappear from the platform should know whom to contact. A driver who notices an unfamiliar device connected beneath the dashboard should report it. A manager who receives a suspicious password-reset email should not simply click the link.

Phishing remains one of the most practical account risks. An attacker does not necessarily need to discover a sophisticated vulnerability in the vehicle if they can convince an administrator to reveal a password. Employees with fleet-platform access should therefore be cautious about unexpected login links, password-reset messages and requests to share authentication codes.

The company’s email security is consequently part of fleet security. If tracking-account password resets are sent to an email address that has itself been compromised, the attacker may be able to reset access to other systems. Important administrator accounts should therefore be connected to well-secured business email addresses rather than informal shared inboxes.

Businesses should also avoid leaving fleet dashboards permanently logged in on publicly accessible office computers. A tracking screen in a reception area may reveal vehicle movements to visitors or employees who have no operational reason to see them. Automatic screen locks and restricted workstations provide simple additional protection.

Large organisations can go further by separating administrative functions from everyday monitoring. Dispatchers might use accounts that can view vehicles but cannot change configurations, delete units or send commands. Only a limited group of fleet administrators would receive higher privileges.

This is an example of least privilege, one of the most useful principles in cybersecurity. Every user and connected application receives only the access required to perform its job. If that account is later compromised, the damage is limited by what the account was allowed to do.

Businesses should also have an incident-response plan. If a fleet-platform account is suspected to be compromised, management should know how to change credentials, revoke active sessions, contact the service provider and preserve relevant logs. Waiting until an attack happens to decide what to do wastes valuable time.

Where remote vehicle-control features exist, the response becomes particularly urgent. The company should immediately restrict command access and confirm that vehicles remain safe. Safety should take priority over investigating who was responsible.

Automotive cybersecurity authorities increasingly recommend exactly this kind of defence-in-depth approach. NHTSA’s guidance encourages layered protection, continuous risk monitoring, secure system architecture and the ability to detect and respond to incidents rather than assuming any single control will prevent every attack.

The principle fits fleet management well. A strong password alone is not enough. Neither is a hidden tracker, dashcam, backup tracking tag or secure server by itself. Security comes from combining sensible controls so that failure of one layer does not automatically compromise the entire operation.

Finatrack Global Ltd provides GPS tracking, fleet-management, AI dashcam, fuel-monitoring and vehicle-security solutions for private motorists and commercial fleets in Kenya. Finatrack’s wired GPS tracker is available at KES 15,000, while businesses requiring stronger fleet visibility can combine GPS tracking with AI dashcams, wireless trackers and other layered security solutions depending on their operating risk.

For professional installation and enquiries, call or WhatsApp 0723 645 810 or visit www.finatrack.co.ke. Installing a tracking device helps protect a physical vehicle, but modern fleet security does not end under the dashboard. The tracking account, mobile phone, passwords, cloud platform, APIs, dashcams and employees who use them all form part of the security system. Protecting those digital layers helps ensure that valuable telematics data remains available to the people who need it and inaccessible to those who do not.