Disability-Adjusted Life Years

Disability-Adjusted Life Years (DALYs) is a composite measure of disease burden, combining years of life lost (YLL) and years lived with disability (YLD). It was developed by the World Health Organization (WHO) to provide a unified metric for comparing different health risks. In the context of automotive cybersecurity, DALYs are used to quantify the human impact of cyber-physical attacks, such as remote hijacking of steering or braking systems. This aligns with the ISO/SAE 21434 standard's requirement to assess the severity of security-related safety hazards. Unlike simple-count-based metrics, DALYs allow engineers to prioritize cybersecurity controls based on actual human harm potential, making it a critical component of the Threat Analysis and Risk Assessment (TARA) process.

In automotive cybersecurity risk management, DALYs are applied through a three-step methodology: First, threat-to-injury mapping—identifying how specific cyber threats (e.g., ransomware on ECUs) translate into physical injuries. Second, risk-adjusted prioritization—using DALYs values to rank threats according to their impact on human life, as required by ISO 26262 and ISO/SAE 21434. Third, control-optimization—allocating cybersecurity resources to mitigate the highest DALY-contributing risks first. For example, a vulnerability in the ADAS (Advanced Driver Assistance Systems) would be prioritized over infotainment-only vulnerabilities due to its higher DALY impact. This quantitative approach enables companies to justify cybersecurity investments to stakeholders and regulators by demonstrating a measurable reduction in potential harm-related liabilities.

Taiwanese automotive suppliers typically face three challenges: Data scarcity (lack of localized injury-per-cyber-attack statistics), technical-legal translation gaps (engineers may not be familiar with health-centric metrics), and regulatory uncertainty (local standards like the Taiwan Automotive Cyber Security Management Measures are still evolving). To overcome these, enterprises should: 1) Adopt WHO global datasets as a baseline for DALY calculations. 2) Integrate DALYs into existing TARA processes to ensure cross-functional understanding. 3. Invest in specialized training for cybersecurity engineers on the intersection of safety and health metrics. A phased approach—starting with a pilot project on a single ECU type—is recommended to demonstrate value before scaling across the entire product portfolio.

Winners Consulting Services Co., Ltd. specializes in Disability-Adjusted Life Years for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact