The Cheapest GPS Is the Most Expensive Mistake a Dealership Can Make
- July 28, 2026
- Earl Brown
Every few years, the aftermarket vehicle security category learns the same lesson the hard way. A cost-driven challenger enters the market, wins shelf space on price, and quietly redefines what the word “protection” means at the dealership. Then something goes wrong. Firmware fails. A device meant to defend a vehicle turns into the tool that opens it. And the dealer who installed it, often on every unit that rolled through prep, finds out that the cheapest line item on the deal jacket has become the most expensive story in their market.
The category is having one of those moments right now.
Recent industry reporting has surfaced a serious security vulnerability in a widely deployed aftermarket GPS product used by both large and small dealer groups. According to those reports, because the device is hardwired into the vehicle’s ignition and CAN bus, a bad actor who understands the flaw can unlock, start, and manipulate vehicle functions. The exposure is not limited to customers who activated the service. It reportedly extends to any vehicle the dealership installed the hardware in, including customers who declined the subscription and may not even know a device is still riding in their car. The manufacturer has published a firmware update as the fix.
We are not going to name the product. We do not need to. Anyone in retail automotive who has been paying attention knows who is being described and where those units live. What matters for the rest of us is not the specific brand. It is the pattern.
The pattern is older than the technology
Cost-cutting in vehicle security is not a strategy. It is a wager. The wager is that nothing will ever happen. That the firmware will hold. That the supply chain will stay clean. That the install shortcuts a low-margin vendor takes to hit a low price point will never intersect with a customer, a plaintiff, a reporter, or a regulator.
That wager has a bad historical record.
When a device is hardwired into the ignition and the CAN bus of a modern vehicle, the device is no longer an accessory. It is part of the car. It inherits every legal, reputational, and safety responsibility the car carries. A dealer group that installs the same GPS unit on every vehicle in prep, whether the customer bought the service or not, is not saving money. It is quietly signing itself up as the last documented touchpoint on the vehicle’s security posture. And the person the customer will call is not the vendor whose logo is on the module. It is the dealership whose logo is on the store.
What “cheapest” actually costs
The cheap up-front sticker price is what everyone sees, but here is what a dealer principal actually pays for it when the pattern turns.
- Customer trust, uncompensated. A vehicle unlocked in the customer’s driveway by a device the dealership installed is not a product problem. It is a dealership problem. The customer does not distinguish between the two. Neither does their attorney, and neither does the local news.
- Recall and remediation exposure. A firmware update is not a recall in the regulatory sense, but the operational reality is close. Every vehicle carrying the affected hardware needs to be located, prioritized, and updated. The dealer group inherits that logistical bill. The dealer group also inherits the awkward conversation with the customer who declined the service in F&I and now learns the hardware was installed anyway.
- Insurance and F&I fallout. Reinsurance and F&I economics for a GPS product depend on the underlying device being credible. A device implicated in a security disclosure does not just lose the next sale. It puts pressure on the entire portfolio of active subscriptions and any bundled protection product it was ever attached to.
- Store-level reputational cost. In the age of local review sites, dealer-rater screenshots, and 30-second social clips, the security story attaches to the store, not to the vendor. That is asymmetric damage. The vendor moves on. The store cannot.
Every one of those costs is invisible on the day the dealer signs the low-price install agreement. Every one of them is the whole conversation eighteen months later.
What a real vehicle security posture looks like
Vehicle security is not the box in the trunk. It is the network the box is connected to. That distinction is the whole game.
For 47 years, LoJack has done one thing and done it in one specific way. We built and maintained direct integrations with more than 14,000 law enforcement agencies across the country. Sworn officers use LoJack tracking equipment inside their patrol vehicles. When a LoJack-equipped vehicle is reported stolen, the recovery process starts inside the police network itself, not inside a call center, and not inside a mobile app the thief can also see. With LoJack for Law Enforcement, LoJack is the only system integrated directly with law enforcement.
That sentence is short. The infrastructure behind it is not.
Building 14,000 law enforcement relationships takes decades of training, hardware placement, jurisdictional agreements, and ongoing maintenance. It cannot be replicated by pushing an update to a phone app. It cannot be undercut by a $49 hardwired module that ships without a recovery network behind it. It is not a feature. It is a category on its own, and it is the category dealers are supposed to be selling their customers when they use the words “stolen vehicle recovery.”
The rest of the LoJack story flows from that spine. LoJack Wireless installs at delivery in minutes and self-checks every day. Lot Management gives the dealership real-time visibility into its own inventory, cutting vehicle purchase time by 30 minutes and improving audit accuracy by up to 300%. The consumer app closes the loop for the customer. But none of that matters without the network underneath it, and that network is what a low-cost competitor cannot copy no matter how aggressively they discount.
The safer bet is the boring one
Dealers are asked to make a lot of interesting bets. Vehicle security should not be one of them. A stolen-vehicle recovery product is infrastructure. It should be evaluated the way a dealer evaluates a DMS, a shop management system, or a lender: on how long it has been running, how deeply it is integrated, and what happens on the worst day of the year, not the best.
That is the case for LoJack in a sentence. Forty-seven years in market. More than 14,000 direct law enforcement integrations. A recovery network sworn officers actually use. A brand a customer’s insurer, spouse, and attorney all already recognize. And a company, Solera, standing behind it with the scale to keep investing in the network for the next 47 years.
The cheapest GPS device on the lot will always look attractive on a spreadsheet. The spreadsheet does not price the downside. LoJack does, because we have spent almost half a century watching the downside happen to people who chose the other option.
If your group is reevaluating its vehicle security vendor in light of what the industry is reading this month, that is the right instinct. The next conversation is worth having with a partner whose network has already been proven, whose device does not sit inside the ignition harness of vehicles the customer did not ask to have protected, and whose price reflects the cost of running a real recovery infrastructure rather than the cost of skipping one.
That is the LoJack bet. It has been the same bet for 47 years. It is the safer one to make.
LoJack is part of the Solera Dealer OS, the connected operating layer for modern dealerships. On one record, on one engine, LoJack sits alongside Solera CRM, Service, Marketing, and DMS, so vehicle protection is not a bolt-on the store has to babysit. It is one more piece of the platform, connected on day one.
Dealers thrive here.™
SALES | SERVICE | MARKETING | OPERATIONS | CONNECTED CAR
This communication reflects Solera’s business perspective. It does not constitute legal advice. Dealers should consult their counsel.
