Skip to content

For Auto Dealerships

Every credit app in your F&I office is a full-freight identity and the FTC requires you to protect it.

Dealer SSNs on credit apps, driver license scans, bank statements, pay stubs — all flowing through email and your DMS. Since June 2023 the FTC Safeguards Rule has required dealerships to run continuous monitoring or regular penetration testing. Monitoring is the option that watches every day.

Ask about monitoring Run a free scan first
  • Month to month
  • No setup fees
  • Cancel anytime
$53,088

Maximum FTC civil penalty per violation (2025 level, still in force in 2026)

Source: 16 CFR 1.98, FTC civil penalty adjustments, 2025

Credentialed, insured, operational

  • RegisteredND LLC
  • IRS registeredEIN on file
  • E&O insured$1M per claim, $2M total
  • EncryptedYour data, at rest and in transit
  • Sign-inAlways a second step
  • Audit trail365-day retention

Threats we catch

Three attacks aimed at auto dealerships.

36 detection engines check your Microsoft 365, Google Workspace, AWS and Cloudflare accounts every five minutes. Critical threats surface instantly. Normal activity gets filed away.

F&I credit app exfiltration

A compromised F&I manager inbox exposes every credit application: SSN, DOB, driver license, employer, and bank account. One exfiltration event and you are reporting to every state AG where a customer lives.

DMS and CRM credential theft

Reynolds, CDK, DealerSocket — all integrated via OAuth apps and saved credentials. One hijacked service email with a malicious OAuth grant gives an attacker read access to every deal in the system.

Deal jacket fraud

An attacker sits in a dealer inbox, watches for a real loan-approval email, then spoofs funding instructions to the lender. Title funds go to the attacker while your dealership eats the chargeback.

36 detection engines Every five minutes
F&I credit app exfiltrationFlagged. You get a text with the steps to fix it.

Example alert for a made-up business.

Your blind spot

What a typical IT setup does not watch.

  1. Your F&I staff turn over and each new hire gets immediate access to credit bureau portals, lender portals, and customer PII — often with no sign-in monitoring.
  2. Service department email accounts are often the most-phished inboxes in the dealership because staff there get constant external attachments.
  3. When the FTC or your state AG asks for your Safeguards Rule monitoring records, a policy document is not evidence of actual monitoring.
  4. One rerouted funding wire can wipe out the profit on many deals.

The screen is an example for a made-up business, not real customer data.

Compliance alignment

The rules and frameworks we line up to.

SentinelSMB provides the continuous-monitoring, access-control, and incident-response controls these frameworks require. Pro subscribers get the audit-ready evidence package.

  1. FTC Safeguards Rule

    Amended rule effective June 2023

    Auto dealers are financial institutions under GLBA. The amended FTC Safeguards Rule requires a designated qualified individual, access control, encryption, incident response, and either continuous monitoring or periodic penetration testing — all mandatory as of June 9, 2023.

  2. GLBA Section 521 (15 U.S.C. 6821)

    Pretexting prohibitions

    GLBA makes it illegal to obtain customer financial information under false pretenses, such as an attacker posing as a customer or an employee. Those schemes usually show up as unusual sign-ins, which SentinelSMB flags along with impossible travel and credential stuffing attempts.

  3. State AG data breach laws

    Customer notification obligations

    Every state requires notification when personal information is accessed without authorization. Auto dealerships hold some of the most sensitive PII of any SMB category — SSNs, DLs, pay stubs, bank statements.

  4. OEM cybersecurity audits

    Franchise agreement requirements

    Major OEMs (Ford, GM, Stellantis, Toyota) have added cybersecurity requirements to franchise agreements and dealer standards audits. Ask your OEM for its current dealer cybersecurity standard; a monitoring record helps you answer it.

Questions

Questions auto dealerships ask.

Text Cole at (701) 391-5973
Does SentinelSMB integrate with our DMS?

SentinelSMB monitors the Microsoft 365 or Google Workspace accounts that connect to your DMS. Since most DMS logins pass through your email (via MFA prompts, password resets, OAuth consents), we see the activity there. We do not require a direct integration with Reynolds, CDK, or DealerSocket.

How does this fit with our existing IT vendor?

SentinelSMB sits alongside your IT vendor as the 24/7 cybersecurity monitoring layer. Your IT vendor handles network, workstations, and DMS issues. We watch the cloud accounts where account takeovers happen. Complementary, not redundant.

What about our service department kiosks and public Wi-Fi?

Those are network-layer concerns your IT vendor should handle. SentinelSMB focuses on account activity — logins, forwarding rules, OAuth grants, data exfiltration — across your business email and cloud infrastructure.

Will this help on an OEM cybersecurity audit?

Yes. Pro subscribers get the Cyber Insurance Evidence Report — a 7-page document generated from your real monitoring data. It maps directly to the controls OEM audits ask about and saves several consulting-hours of manual evidence gathering.

The Safeguards Rule asks for monitoring or testing. A policy document alone is neither.

Get actual monitoring live in under 10 minutes. Cancel in one click, Pro subscribers receive the OEM-audit-ready evidence package.

Ask about monitoring See pricing