While global scrap prices vary by region, they are trending toward overall stabilization. Profitability in the resource sector is also stabilizing due to rising prices for recyclable materials (such as aluminum, copper, and catalytic converters).

Korea’s Automotive Recycling Industry

Korea News from the Republic of Korea and the Korea Automotive Recyclers Association (KARA)

By Johnny Jeong Howon

Automotive Recycling magazine: What news would you like the industry to know from your country and automotive recycling?

General Status of Korea’s End-of-Life Vehicle Recycling Industry

• Korea currently operates 570 officially registered end-of-life vehicle dismantling companies. (There are no unregistered illegal companies.
• While Korea generates approximately 800,000 end-of-life vehicles annually, the number of used vehicles exported is rapidly increasing (from 300,000 units in 2020 to 850,000 units in 2025).
• Domestic used parts sales are not increasing due to fewer car accidents, but used parts exports are rising in line with the volume of exported end-of-life vehicles.
• South Korea is institutionally striving to achieve a 95% recycling rate under its automotive recycling laws, which comply with ELV directives. The current recycling rate is reported at 92% (including thermal recovery).
• In recent years, electric vehicle recycling and automotive plastic recycling (ELVR) have become key topics within the industry.

Technologies and companies for electric vehicle recycling are rapidly expanding, and systems for remanufacturing, reuse, and recycling are either being implemented or are in preparation.

ARM: What are the current opportunities or challenges that your members are facing today?

Opportunities:

• Improved quality of Korean-made vehicles, increased preference in importing countries, and enhanced competitiveness in exporting scrap vehicles due to rising exchange rates.  

• Particularly, increased exports of used and scrap vehicles to emerging markets. 

• Expansion of the electric vehicle reuse industry. 

• Policy momentum toward carbon neutrality. 

Challenges:

• Increased scrap car acquisition costs due to competition among scrap yards. High acquisition costs for used electric and hybrid vehicles.
• Increased export volume of older vehicles driven by the vigorous activity of internet and auction-based used car exporters (without a corresponding increase in scrap car volume).
• The risks and complexity of handling electric vehicle batteries necessitate investment in safety facilities and performance-evaluation equipment.

ARM: What policies are affecting the right to sell recycled auto parts in your country?

South Korea broadly permits the sale of recycled automotive parts, but the following regulations exist:

• Braking and steering components cannot be reused (remanufactured or remanufactured parts are permissible).
• Remanufactured parts require quality certification.
• Airbags cannot be reused.
• To reuse end-of-life electric vehicle batteries (for other purposes, such as ESS or power banks), compliance with the ‘KC10031’ safety standard for reused batteries (Korean standard) is required.
• A policy requiring end-of-life electric vehicle high-voltage batteries to undergo remanufacturing or refurbishing before being sold for replacement in the same vehicle model is scheduled to take effect in 2027.

ARM: How is your association advocating for your members?

• Policy development and proposals to represent the interests of related industries and member companies (automobile manufacturers and importers, auto dismantlers, shredder companies, resource recycling companies, ASR incinerators, waste refrigerant treatment companies, etc.).
• Providing industry information and facilitating exchanges to promote resource circulation.
• Conducting research projects for the Ministry of Environment (industry status surveys, policy demand surveys, other R&D support, etc.).
• Supporting disassembly technology for electric vehicle batteries and drive motors, creating disassembly guidelines, etc.
• Supporting activities of other new associations related to electric vehicle recycling.

Furthermore, we strive to align with international best practices and cooperate with global automotive recycling associations, such as JARA, MAARA, AARA, MoARA, and CARIDC.

ARM: Are U.S. tariffs impacting your members and their opportunity to do business? How?

• Exports of used vehicles, parts, and recyclable resources to the United States are minimal, and the trade volume for recycled parts or resources is relatively small, so the direct impact of U.S. tariffs is limited.
• Furthermore, while global scrap prices vary by region, they are trending toward overall stabilization. Profitability in the resource sector is also stabilizing due to rising prices for recyclable materials (such as aluminum, copper, and catalytic converters). Therefore, the impact of U.S. import tariffs is judged to be negligible.

ARM: What is the marketplace for recycled Electric Vehicles, including hybrids, in your country?

• Battery remanufacturing and reuse for electric and hybrid vehicles is becoming a major topic in Korea, and while still in its early stages, it is expected to grow annually.
• However, the export value of used hybrid and electric vehicles is high, leading to most of them being exported, leaving insufficient volume for recycling within the industry.
• The number of scrapyards capable of handling used electric vehicles is increasing. (Approximately 5% of the total 570 scrapyard companies.)
• Battery remanufacturers, manufacturers of performance evaluation equipment, performance evaluation service providers, and discharge machine manufacturers are active in the market.
• Sales companies for safety devices, storage equipment, transport containers, and fire detection/suppression systems for battery handling are increasing.
• A specialized transport company for used batteries (including remanufactured batteries) has been established.

South Korea's electric vehicle recycling market is in its early stages but is expanding rapidly. Significant growth is anticipated over the next 5 to 10 years.

ARM: How are recyclers handling EVs in their facility?

Recycling companies are categorized as follows and adhere to their respective roles:

1. Dismantling companies

• Purchase of end-of-life electric vehicles (ELVs) (Dismantling companies unable to handle EVs resell them to those capable of EV dismantling).
• Compliance with high-voltage insulation protocols.
• Battery removal and secure storage procedures.
• Fire prevention measures (monitoring).
• Battery disassembly and replacement of defective modules (may require remanufacturing license starting second half of 2027).
• Sale of batteries for repair (to repair shops, battery remanufacturers). Starting second half of 2027, batteries may be sold for repair after remanufacturing.
• Export of used electric vehicles (vehicles themselves).

1. Remanufacturing Companies

• Purchase of used batteries (from insurance companies and dismantling companies).
• Compliance with high-voltage insulation protocols.
• Battery residual performance evaluation (Precise evaluation. SOH, SOC, SOB, ACIR, DCIR, EoL analysis, etc.) Precise evaluation at pack level and module level.
• Replacement of low-quality or faulty battery modules, balancing, repackaging.
• Battery removal and safe storage procedures.
• Fire prevention measures.
• Sale of remanufactured batteries.

1. Additionally, various battery performance evaluation equipment manufacturers are operating.

ARM: Is there any EV dismantling training available in your country?

Yes, training is available through the following institutions:

• A few associations related to electric vehicle recycling exist; and they operate their own training programs on handling electric vehicles and high-voltage batteries.
• Government-supported technical training institutions.
• Automotive-related universities and research institutes.
• Electric vehicle dismantling manuals and videos are provided by automobile manufacturers (for their own vehicles).

ARM: What is the overall economic outlook for recycled auto parts in your country?

The medium-to-long-term outlook is positive for the following reasons:

• The volume of exported parts is expected to increase due to a surge in the number of scrapped vehicles and used car exports.
• While domestic consumer perception of used parts is improving, domestic demand for used parts is not expected to increase due to declining automobile accident rates.
• Overall, used parts sales at scrapyards are expected to remain stable or increase.
• However, the rising cost of purchasing used vehicles and the increasing trend of overseas buyers acquiring and directly operating Korean scrapyards present challenges as market competition intensifies.

ARM: What else would you like ARA and the industry to know?

• The Ministry of Climate and Environment is preparing policies to increase the recycling rate of plastics from end-of-life vehicles in response to the EU’s ELVR policy, and the industry is making efforts to find ways to achieve this.
• We look forward to strengthening cooperation with ARA and sharing best practices. In particular, we, the Korea Automotive Recyclers Association and our member companies, would like to participate in IRT events going forward.

Johnny Jeong Howon is a part of the KARA Technical Committee, and a member of the Korean delegation for the Asia Automotive Environmental Forum (AAEF).

United Kingdom News  

News from the Vehicle Recyclers’ Association 

By Andy Latham 

Automotive Recycling magazine: What news would you like the industry to know from your country and automotive recycling?

• Recycled (“green”) parts are getting easier to buy and specify at scale via parts-platform integrations and larger graded inventories, which is helping repairers/insurers use recycled components more routinely. https://atfpro.co.uk/2026/01/15/new-partnership-unlocks-potential-of-recycled-parts/
• Access to modern vehicle security-related data is changing in the UK: SERMI has gone live/been approved for the UK, creating a formal route for independents to access certain secure RMI functions—important for programming/coding modules, keys, and some security-gated systems. https://atfpro.co.uk/2026/02/03/sermi-approval-secures-security-data-access-for-uk-independents/
• Battery recycling capability is a strategic focus, with UK-backed projects and reports highlighting the need to scale recycling/refining capacity as EV volumes grow. https://www.reuters.com/sustainability/climate-energy/

jaguar-land-rover-backed-battery-recycling-project-

gets-uk-government-funding-2025-07-17/

ARM: What are the current opportunities or challenges that your members are facing today?

Opportunities

• Rising insurer/repairer interest in lower-cost, lower-carbon repairs using recycled parts (“green parts”).
• Growing long-term opportunity around EV component harvesting (motors, inverters, onboard chargers) and battery logistics/triage as the parc matures.

Challenges

• EV battery fire risk management (storage, quarantine, damaged-pack handling, emergency planning) drives cost, space needs, and permitting scrutiny.
• Data and software lockouts: Even when a used part is physically sound, coding/authentication requirements can block fitment without authorized data access (SERMI helps, but it’s still a compliance burden).
• Quality assurance expectations (grading, traceability, documentation) are increasing as recycled parts move further into mainstream repair channels.
• Lack of Enforcement of rules and regulations is harming legitimate vehicle dismantlers and recyclers.

ARM: What policies are affecting the right to sell recycled auto parts in your country?

• End-of-life vehicle (ELV) rules: the UK requires authorized treatment, depollution, and producer/take-back arrangements; compliance underpins legitimate dismantling and parts resale.
• Insurer salvage categorization (ABI Code of Practice): it influences what happens to vehicles and what’s lawful/appropriate—e.g., Cat A is crush-only; Cat B is break for parts/scrap (not return to road).
• Environmental permitting and fire-prevention expectations, especially for lithium batteries and EV packs/modules, affect whether facilities can safely store/handle

EV-derived components.

• Security-related RMI access (SERMI) indirectly affects parts resale/value by determining whether some used electronic modules can be legitimately re-commissioned.

ARM: How is your association advocating for your members?

From the UK perspective, advocacy tends to focus on:

• Protecting access to repair/security-related data and workable accreditation routes (SERMI) so independents can keep repairing modern vehicles.
• Promoting standards, traceability, and professionalism in vehicle recycling representation (including governance/modernization efforts within UK recycling representation).
• Engaging internationally to share best practices and strengthen links with EGARA and ARA.

ARM: Are U.S. tariffs impacting your members and their opportunity to do business? How?

• The direct impact on UK recycled parts exports to the U.S. is usually niche, but metal tariffs can ripple into scrap/commodity pricing and volatility, which affects ELV economics and downstream values (steel/aluminum being core).
• If/where members export scrap metal or derivative metal products, tariff changes can alter buyer demand, margins, and routing of material flows.

ARM: What is the marketplace for recycled Electric Vehicles, including hybrids, in your country?

• Hybrids are already a steady stream of dismantling; full BEVs are rising but remain smaller as a share of ELVs (time-lag from new sales to end-of-life).
• Value is increasingly in high-ticket EV components and battery packs/modules—but battery value is tightly linked to condition, diagnostics, and compliant logistics. UK strategy and industry reports explicitly flag recycling/refining capacity as a coming bottleneck/opportunity.
• EU policy is also tightening circularity expectations (even though the UK is outside the EU, it can influence OEM design and supply chain norms that UK recyclers live with).

ARM: How are recyclers handling EVs in their facility?

Common UK-aligned practices include:

• Depower/“make safe” processes, isolation of HV systems, and controlled work areas.
• Battery quarantine/segregated storage (especially damaged batteries), with weatherproof/covered containers and separation from liquids/ignition sources.
• Fire prevention planning as part of environmental permitting expectations, plus documented emergency response plans for thermal runaway scenarios.

ARM: Is there any EV dismantling training available in your country?

Yes—there are multiple routes:

• Specialist recycler-focused training providers, including Salvage Wire’s ELV Technician and HV-related courses aimed at dismantling/recycling operations.
• Institute of the Motor Industry, or City and Guilds qualifications(e.g., Level 3 for EV/hybrid system repair & replacement; Level 4 for diagnosis/testing/repair on HV systems)—available through training providers including Charg-Ed.

ARM: What is the overall economic outlook for recycled auto parts in your country?

• Demand signals are positive where insurers/repairers push sustainable repair, especially as repair costs rise and total-loss dynamics create both supply and urgency to find cost-effective parts.
• The outlook is mixed by category: straightforward body/trim and mechanical parts remain strong; electronics/ADAS/HV components are higher value but more constrained by coding/security access, warranty expectations, and safety compliance.

ARM: What else would you like ARA and the industry to know?

• UK recyclers would benefit from shared best practice on EV battery triage, storage design, and incident response, because regulators and insurers are (rightly) sensitive to

fire risk.

• Data access and parts enablement (coding, secure gateways, authorized pathways like SERMI) is now a make-or-break factor for the circular economy—great parts are wasted if they can’t be re-commissioned legally and safely.
• There’s a big near-term opportunity in aligning grading/traceability standards so recycled parts are as “easy to specify” as new parts across estimating and procurement systems.

Andy Latham is the Chairman of the Vehicle Recyclers’ Association. He is also the Managing Director of Salvage Wire.

Taking CAREC in Canada

From Early Self-Regulation to a Mandatory National Standard

By Wally Dingman

The Canadian auto recycling industry was an early adopter of voluntary self-regulation, recognizing that credibility, environmental stewardship, and professionalism were essential to legitimizing the sector and strengthening confidence among regulators, insurers, and the public. These early efforts helped establish baseline practices and began shifting perceptions of an industry that had long been viewed through an outdated lens.

Over time, however, industry leaders recognized a key limitation: voluntary participation, while valuable, could not deliver the consistency or accountability needed to advance the industry as a whole.

That realization laid the foundation for what would eventually become the Canadian Auto Recyclers Environmental Code (CAREC).

In 2008, the National Code of Practice for Automotive Recyclers (CoP) was developed for recyclers participating in Canada’s federal National Vehicle Recycling Program—Your Ride. The Code provided a practical framework for responsibly managing end-of-life vehicles and introduced consistent environmental practices that could be implemented across operations of varying size and complexity.

When the Retire Your Ride program concluded in March 2011, the industry recognized that the Code of Practice had proven too valuable to retire along with the program. Participation levels were strong, implementation was achievable, and the framework had already begun influencing how recyclers operated—and how the industry was perceived externally. As a result, the Code was renamed the Canadian Auto Recyclers’ Environmental Code (CAREC) and expanded to apply to all end-of-life vehicles, not only those associated with a federal incentive initiative.

A defining feature of CAREC’s evolution has been its mandatory adoption within the organized Canadian recycling sector. To be a member of the Automotive Recyclers of Canada (ARC) through a provincial association, recyclers must be audited by CAREC. This requirement ensures that participation is not merely symbolic but measurable, verifiable, and consistent across jurisdictions.

Today, we have 330 businesses in all corners of Canada that are audited to the Code.

CAREC was intentionally designed as a practical, operational tool that provides recyclers with clear guidance to prevent hazardous materials contained in end-of-life vehicles from contaminating water, land, and air during dismantling, storage, and processing. The Code reflects real-world recycling environments, balancing environmental responsibility with operational practicality.

As the program matured and professional recyclers fully adopted the standard, audit performance steadily improved. CAREC scores increased year over year, demonstrating consistent compliance and continuous improvement across the industry. This sustained performance allowed the audit framework itself to evolve, with strong-performing facilities moving to longer audit intervals—a recognition of proven, repeatable compliance rather than a reduction in oversight.

While CAREC was originally developed to address environmental performance, its broader impact extended well beyond compliance. The presence of a nationally consistent, third-party-audited standard significantly improved insurers’ and other regulators’ views of the auto recycling industry. Recyclers operating under CAREC are increasingly recognized as professional businesses operating within a defined, transparent framework—rather than informal suppliers operating in isolation.

This shift in perception has enabled more constructive dialogue with insurance partners, increased confidence among regulators, and positioned Canadian auto recyclers as credible contributors to broader environmental and circular-economy objectives.

Perhaps most notably, CAREC has become a practical reference point for provincial governments developing or modernizing legislation governing auto recycling operations. Rather than starting from scratch, regulators can look to a proven, industry-led standard that reflects operational realities while delivering measurable environmental outcomes.

The evolution of CAREC demonstrates an important lesson for the broader auto recycling community: voluntary self-regulation establishes intent, but mandatory, audited standards deliver consistency, credibility, and long-term industry advancement.

Wally Dingman is Executive Director of Automotive Recyclers of Canada (ARC) and can be reached at 1-866-977-8868 or wally@autorecyclers.ca.

SAN DIEGO, Calif.—Enlyte, a leader in technology, networks and services for the property and casualty industry, announced today it has entered into an agreement to acquire PartsTrader, the industry's leading parts procurement marketplace.

The acquisition represents a strategic investment that brings together two complementary businesses within the Auto Physical Damage ecosystem. PartsTrader will become a wholly owned subsidiary of Enlyte and will continue to operate as an independent entity alongside Mitchell's Auto Physical Damage division. Both organizations will maintain their distinct identities and operations while benefiting from the collective strength of the Enlyte portfolio. Both Mitchell and PartsTrader will continue as open platforms—allowing the choice of other information providers, as well as suppliers and other partners within the ecosystem. 

“This acquisition reinforces Enlyte's commitment to the Auto Physical Damage industry and our focus on delivering comprehensive technology solutions that improve outcomes across the collision claims and repair sectors,” said Alex Sun, CEO of Enlyte. “By bringing together Mitchell's premier damage appraisal solution with PartsTrader's leadership in parts procurement, we're positioned to deliver even greater value to our insurer and repair customers and the market. We're excited about the natural synergies between our companies and look forward to the opportunities ahead.”

“Joining the Enlyte family represents an exciting new chapter for PartsTrader,” said Steve Messenger, CEO of PartsTrader. “As part of Enlyte, we'll have additional resources to accelerate our growth while continuing to serve our customers with the same commitment to excellence they've come to expect. Our companies share a vision for innovation and customer success, and I'm confident this partnership will create significant value for the auto physical damage claims and repair industry.”

The companies have signed an agreement and expect the deal to close in 2026, following regulatory approvals from both the United States and New Zealand. Raymond James & Associates and Goldman Sachs & Co. LLC served as financial advisors to Enlyte, and Kirkland & Ellis LLP and Quigg Partners served as legal counsel. The financial terms of the transaction will not be disclosed.

About Enlyte

Enlyte (enlyte.com) is a P&C industry leader providing claims technology innovations and connectivity solutions, specialty networks, case management, pharmacy benefit and disability management services. Serving over 2,000 entities, including a majority of Fortune 500 employers, Enlyte leverages its portfolio of solutions to simplify processes and improve outcomes for auto, workers’ compensation and disability claims.

About Mitchell

Mitchell International, Inc. is a leader in the development of innovative auto physical damage technology solutions. Combining decades of experience with an open platform, proprietary data and intelligent, cloud-first applications, we help insurance carriers, collision repairers and vehicle manufacturers protect dreams and restore lives. Each day, more than 20,000 organizations turn to Mitchell to support efficiently managing claims and safely returning consumers to the road. For more information, follow Mitchell on Facebook or LinkedIn.

About PartsTrader

As the world’s leading parts procurement marketplace, PartsTrader brings together repair shops, parts suppliers, and insurance carriers on one efficient, market-driven platform. PartsTrader helps repair shops make more accurate decisions regarding part-type, price, and availability. Suppliers can quickly grow their market presence and instantly reach thousands of new shops while improving the way they serve their current customers. Insurance carriers gain transparency into the parts procurement process and access to valuable market data, allowing them to increase accuracy and efficiency on every claim. PartsTrader LLC, based in Chicago, is privately held. For more information, visit partstrader.com.

Media Contacts

Mindset Agency for Enlyte
Jeff Miller
jmiller@mindsetagency.com
541.207.6413

Enlyte Public Relations
Tom Kerr
tom.kerr@enlyte.com
610.451.4996

Source

Terms were not disclosed. The ownership group, led by people with deep roots in auto recycling, including the family offices of Tom D. Klauer Jr. and Kendig K. Kneen, is committing an additional $3 million to reengineer the platform, add new capabilities and return buying power to independent yards.  Between the two they have operated over 70 yards during the last three decades.  “We have learned by operating our own yards that we can use the CRUSH software to teach our buyers to buy inventory that will yield far better results and thereby far more profits” Klauer said. 

S3 has supported self-service auto recyclers for more than 15 years with Crush across the United States and Canada. With the acquisition, Crush Software Solutions will accelerate the roadmap for Crush 2.0. The company’s goal is to double the footprint to 400 plus yards by delivering a modern, cloud-hosted, enterprise-ready system that improves vehicle sourcing, pricing and sales. 

“Independent operators deserve technology that works for them. We are building Crush 2.0 to give yards more control over buying, inventory and margin,” said Klauer. “This investment will modernize the platform and remove friction from daily operations so teams can focus on throughput and customer experience.” 

“For current customers, nothing changes immediately. No disruption. Same highly secure platform. More investment,” said Gerontis. “This is an exciting time for the Crush community. The new funding lets us move faster on features, strengthen security and boost performance.” 

What improvements to expect with Crush 2.0 

• Complete re-engineering of the software with a modern cloud architecture  

• Data-driven vehicle acquisition 

• Integrated marketplace connections  

• Enterprise-grade analytics and security 

The company’s near-term focus includes customer listening sessions, a transparent roadmap and early-access pilots in select markets. 

Leadership background

 Dimitri Gerontis founded S3 Software Solutions and built the Crush platform used by more than 200 self-service yards across the U.S. and Canada. He will serve as Chief Operating Officer of Crush Software Solutions, overseeing product, customer success and day-to-day operations 

Tom D. Klauer is a long-time auto-recycling executive. As a founding partner and former President/CEO of Pick-n-Pull Auto Dismantlers, he led the team to triple the store count and grow annual revenue to ~$500M before departing in 2015. He later spearheaded iPull-u-Pull Auto Dismantlers, where he now serves as Managing Partner. 

Kendig K. Kneen is a veteran manufacturing and operations executive in scrap-recycling equipment and U-Pull-It operations. He has led Al-jon, a maker of car crushers, balers and landfill compactors. He has also held leadership roles with iPull-uPull, bringing hands-on yard experience in pricing, throughput and safety to the team. 

Ryan Paterson is a technology leader with more than 20 years in federal and commercial markets, will serve as chief executive officer. He founded IST Research in 2008 and led it to an acquisition in September 2020 after deploying advanced information systems in hard-to-reach regions. He has served at the Defense Advanced Research Projects Agency twice. 

Kay Schaefer is a tech entrepreneur known for launching and scaling digital businesses that turn attention into outcomes, will serve as chief product officer. Schaefer built Gamers.Online for the gaming community, helped grow KaFe Rocks as a performance media/affiliate leader and drives operational innovation at iPull-uPull.  

# # # 

ABOUT CRUSH SOFTWARE SOLUTIONS 

Crush Software Solutions LLC builds software for auto recycling operators. The company is headquartered in Salt Lake City, Utah. In September 2025 Crush Software Solutions acquired S3 Software Solutions, developer of the Crush yard management system. For more than 15 years Crush has supported self-service yards at more than 200 active installations across the U.S. and Canada. Crush 2.0 modernizes how auto recyclers source, price and sell vehicles and parts. 

Media Contact 
Jo Trizila, TrizCom PR for Crush Software Solutions 
Email: jo@trizcom.com 

Cell/Text: 214-232-0078 

Get your team on the same secure page, ticking one cybersecurity box at a time. 

By Jeremy Heidemann

We love a good “to-do” list. At work, we use to-do lists to break down complex technology projects into manageable tasks that keep us on track – even when unexpected challenges arise.  Cybersecurity has become one of those overwhelmingly complex projects for business owners. Many analyze the risks, fear the consequences, and then freeze – leading to “analysis paralysis.”  

But cybersecurity is not an all-or-nothing endeavor. Small, steady steps can strengthen your defense against cyber threats. That’s why we created this checklist – to break cybersecurity into actionable decisions that protect your business. The stakes are high: cyber threats can lead to financial loss, reputational damage, and legal consequences. However, rather than another article explaining why cybersecurity is important, this playbook focuses on practical steps you can take today. Let’s dive in! 

How to Use This Checklist 

Each section outlines key areas of cybersecurity – email security, device protection, employee training, and incident response. Along the way, you’ll find real-world scenarios and a progress tracker so you can assess where you stand and what to prioritize next. 

We receive regular updates on how different businesses have suffered cyberattacks and come to Forbin or VGM seeking recommendations on how to secure their businesses after realizing these threats are very real. In most cases, a simple checklist or process could have prevented the breach. Let’s walk through your cybersecurity journey step by step. 

Prevention: Locking the Doors Before Hackers Knock 

Prevention is just one part of cybersecurity, but it is vital to blocking easy attempts to gain access to your data. Cybercriminals “check the locks” on doors and windows to your data. Those doors and windows are email security, computer/device security, password security on the platforms you use, your website security, and finally, your employee education on catching a criminal trying to access your data through your employee directly.   

Email Security 

All employees use a secure email platform on company devices and access it using multi-factor authentication (MFA). 

∗ Complete 

∗ Working On It 

∗ Not Started, But on My List 

∗ I Need More Information  

Why This Matters 

∗ Secure email platform. This isn’t just a free Gmail or Outlook account. Free email services lack advanced protection for your company against phishing, spoofing, and unauthorized access. You need an Enterprise-level email platform like Microsoft 365 or Google Workspace, which includes built-in encryption, advanced anti-phishing tools, and security settings. These settings block suspicious senders, but they don’t catch everything. You can add another layer of security with services like Barracuda ESS, Mimecast, or Microsoft Defender, which filter harmful emails, block spoofed domains, and detect malware.  

∗ Company devices only. Many employees 
may be tempted to check personal emails or sign into personal accounts on their work-issued laptops or shared company computers.  

Clicking the wrong link in a personal Gmail account can open a window for a cybercriminal to jump through and access your company platforms and secure data. Another common risk is when employees take their work laptops home and log into a company email platform from their personal computers.  

This is a major security concern because home networks and personal devices lack enterprise-level security protections, making them easy targets for hackers. Because of this, it’s best to require employees to only access work email on company-issued devices that are secured, monitored, and controlled by IT.  

Your IT team can even block access to personal email sites like Gmail on company networks to prevent this activity. 

∗ Multi-Factor Authentication (MFA). This is the latest must-have in cybersecurity for email. Your employees should have a second layer of authentication besides their password to access company email – especially for first-time logins, password resets, or when accessing email from a new company device. Typically, this second authentication step happens through a mobile app like Microsoft Authenticator or Duo. 

Why is this important? Phishing emails are getting very convincing. A common scenario is when an employee receives an email that looks like it’s from you, prompting them to click a link and sign in to what they believe is their Microsoft or Google Workspace account – but they’ve just handed their login credentials to a hacker.  

If MFA is enabled, even if a cybercriminal has your employee’s password, they still can’t access the email account because they would need the second authentication factor. Since the hacker is attempting to log in from an unrecognized device, the authentication request would fail. Without MFA, the hacker could successfully log in and send malicious emails from your company account, targeting your clients, vendors, and employees. 

Microsoft 365 now requires MFA by default, and it’s included in its enterprise platform. If you or one of your leaders disabled this setting for convenience, turn it back on ASAP to prevent security breaches. 

Computer & Device Security 

All company computers and devices have updated operating systems, secure logins, are using secure/updated browsers only, and are locked when not 
in use. 

∗ Complete 

∗ Working On It 

∗ Not Started, But on My List 

∗ I Need More Information  

Why This Matters 

∗ Updated operating systems. Windows and macOS update patch security vulnerabilities that hackers can exploit. If you don’t keep your systems updated, these vulnerabilities remain open, making them easy targets. Forbin’s team is making rounds this year to update all customer computers from Windows 10, as Microsoft has announced it will stop providing security updates to Windows 10 starting in October 2025.  

This means any device still running on Windows 10 will become a security risk. Cybercriminals will be looking for these open windows. 

∗ Unique logins for employees. Most businesses are moving to a unique, secure login for employees by using vendors such as Active Directory (AD) or Entra ID (formerly Azure Active Directory). Active Directory acts like a digital organizer for your company’s network, managing all employees, computers, and resources in a single location. With AD, each employee gets a unique login, ensuring that only authorized people can access sensitive information. It keeps your data secure and makes it easy to update or remove access if someone changes roles or leaves the company. AD also simplifies IT tasks like software updates and password resets, saving time and reducing errors. Entra ID offers similar benefits but is cloud-based, providing additional flexibility and scalability. It also allows secure logins from anywhere, making it ideal for remote or hybrid work environments.  

It’s still vital to require your employees to lock their computers when not in use and to require each employee to log in to any shared computers using their unique login credentials. 

∗ Updated browsers. Browsers like Internet Explorer, Microsoft Edge, Google Chrome, and Mozilla Firefox can become outdated and a security liability. For example, the latest version of Microsoft Edge has enhanced privacy features, including tracking prevention and Microsoft Defender SmartScreen, which detects and blocks malicious websites and downloads.  

These are just some of the benefits of keeping your computers locked to one browser, and keeping that browser updated on all of your devices. 

Password Security 

All employees keep their unique passwords to work-related platforms/websites stored in a secure password vault and not saved and automatically deployed on any browsers.  

∗ Complete 

∗ Working On It 

∗ Not Started, But on My List 

∗ I Need More Information  

Why This Matters 

∗ Unique passwords. Employees should never reuse the same password across multiple accounts or share login credentials with others. For example, if a cybercriminal figures out a user’s password for one login, they will attempt to use it across thousands of other sites to see if they can gain access with those credentials – a tactic known as credential stuffing.  

Once they gain access, they’ll sell those credentials on the dark web, where other cybercriminals can exploit them to gain access to your data. Instead, use a password generator to keep the passwords extremely complex and different for each website or platform. We’ve seen this scenario played out in real life when a company called us for help after their employee logged into their personal Gmail account on a company computer, clicked on a bad link, and unknowingly gave a hacker remote access to their device.  

Hours later, the employee noticed their mouse moving on its own as the attacker navigated their browser, opened up PayPal’s website, and used stored password credentials to access their data. These are very real occurrences that some employees don’t even notice are happening until it’s too late.  

∗ Password vaults. The next step to ensuring your employees generate unique passwords each time and keep those credentials secure is to provide them with a password vault like MyGlue, LastPass or Bitwarden. Requiring the use of a password vault will keep your employees’ credentials secure while allowing you to oversee password usage, such as shared passwords. You can also control access so termed or past employees can’t continue to access your company’s websites AND you don’t have to change all passwords when an employee is terminated. Password vaults are beautifully automated to generate strong passwords, save updated passwords, and provide your credentials to you when you need them by remembering just one password with MFA as a second layer of security. 

∗ Avoiding saving passwords to browsers. The final step in securing your employees’ passwords is to remove saved passwords from web browsers, such as Google Chrome, Internet Explorer, Mozilla Firefox, Microsoft Edge, or Apple Safari. Browsers like these are often targets of malware and hackers. A common scenario is if someone accesses your employee’s computer who should not have access, they can easily open a browser and start automatically logging into your frequently visited websites and software to access your data.  

Employee Education on Cybersecurity 

All employees are required to receive regular training on cybersecurity threats and understand 
the importance of fast self-reporting.  

∗ Complete 

∗ Working On It 

∗ Not Started, But on My List 

∗ I Need More Information  

An uninformed employee is often the weakest link in your company’s cybersecurity defense. Employees are also the first line of defense against cyberattacks, which means cybersecurity must be a priority for everyone – yet many employees have little education on how to protect company data. 

Why This Matters 

∗ Regular training. Cybersecurity education should not be optional for ANY employee. We have seen employees at every level of leadership fall for phishing emails or engage in unsafe password practices. Setting up a training program – such as the Cyber Security Training add-on from VGM Education – keeps employees’ cybersecurity training evolving as cyber threats evolve. VGM Forbin also offers a cybersecurity training platform for those that aren’t subscribers of VGM Education. 

∗ Required training. We can’t tell you how many times a business owner has said that their staff has completed cybersecurity training, but it is not required or managed. These employees are your first line of defense. If they can’t pass their cybersecurity training or fail your regular phishing tests, you may need to initiate a coaching and counseling process to ensure this issue is taken seriously. 

∗ Self-reporting. Transitioning from coaching to self-reporting might seem counterintuitive, but it’s essential. No matter how well-trained your employees are, mistakes happen—and one wrong click on a phishing email can put your company at risk. The speed at which an employee recognizes and reports a security mistake can make a huge difference in containing the damage. You need to create a security culture that leads with trust, not fear, where employees understand the importance of cybersecurity and feel safe reporting an issue as soon as it is detected. This is also part of the training VGM can support your business in because our entire company receives these same trainings and works hard to foster that positive cybersecurity culture.  

Testing & Security Patching 

My company employs a third-party ethical hacker team to complete a penetration test (pen test) on our environment to uncover weaknesses that we then patch with our in-house IT team or contracted IT provider. 

∗ Complete 

∗ Working On It 

∗ Not Started, But on My List 

∗ I Need More Information  

Why This Matters 

∗ Penetration testing. Some business owners believe that if they have an in-house IT team, pen tests aren’t necessary – but that’s like grading your own test. 
To truly identify weaknesses, you must undergo real-world attack simulations by ethical hackers. Pen tests go beyond standard vulnerability scans. This process uses
both automated tools and manual attack strategies to test your system’s ability to withstand real cyber threats. A great starting point for understanding pen tests and their benefits is reaching out to Procircular – a company we’ve regularly worked with on remediation assistance after pen tests run by Procircular reveal vulnerabilities. 

∗ Patching and remediation. Patching and remediation close security gaps. Once a pen test is complete, ethical hackers provide a detailed report with prioritized vulnerabilities and step-by-step remediation plans. IT teams must immediately address high-risk vulnerabilities to prevent exploitation. Regular validation and re-testing ensure that all security gaps are fully patched. Even though VGM stays very current with our cybersecurity practices and has pen tests completed regularly, there is always opportunity for strengthening our environment thanks to these pen tests. 

Detection: Catching Cyber Threats Early  

Prevention is your first line of defense, but the next 
critical component of cybersecurity is early detection. 
The ability to identify and respond to threats before they escalate can mean the difference between a minor 
incident and a full-scale data breach.  

Consider this real-world scenario:  

Many smaller cyber incidents serve as warning signs of a larger cyber attack brewing. Far too many businesses detect what appears to be an isolated security event, take minimal action, and assume the issue is resolved.  

But cybercriminals don’t always attack in one strike – they often test your defenses first. If you don’t fully remove a threat from your network and reset security controls, the attacker can maintain access and strike again when your defenses are down. Don’t fall for this. The second you uncover an incident, even a small one, act as if you expect the cybercriminal to be lurking on your network. 

Monitoring 

My company monitors for unusual activity, 
unauthorized access, and takes action to secure 
any threats.  

∗ Complete 

∗ Working On It 

∗ Not Started, But on My List 

∗ I Need More Information  

Why This Matters 

∗ Continuous monitoring. Cybercriminals don’t wait for business hours to attack – they often strike late at night, over weekends, or during holidays when fewer people are actively monitoring networks.  

To counter this, businesses must have 24/7 security monitoring in place through EDR and MDR solutions backed by a Security Operations Center (SOC) team. EDR (Endpoint Detection and Response) monitors every device (laptops, desktops, servers, and mobile devices) for unusual activity and anomalies. MDR (Managed Detection and Response) provides real-time threat detection and response, leveraging a dedicated SOC team that investigates and resolves security threats before they escalate. 

Together, EDR and MDR form a proactive defense system that detects, analyzes, and neutralizes cyber threats before they can cause harm. Confirm with your IT provider or in-house team that your company has EDR and MDR solutions in place, and that your MDR service is backed by a 24/7 SOC team. 

∗ Secure threats. Like we said, cybercriminals could be lurking at your door, waiting for you to forget to lock it. Even with strong security measures, incidents will happen. What matters most is how quickly you respond to minimize damage. Every security event – big or small – should be treated as a potential gateway for a larger attack. Follow this five-step threat response process: 

1. Contain the threat – Immediately disconnect affected systems from the network to prevent further spread. 

2. Investigate – Determine how the breach occurred, what data was accessed, and if the attacker still has access. 

3. Eliminate the threat – Remove malicious files, apply security patches, and ensure the attacker’s access is fully revoked. 

4. Recover securely – Restore affected systems from clean backups and confirm they are fully operational before bringing them back online. 

5. Review and improve – Conduct a post-incident review to update security policies, reinforce your training, and improve future threat detection. 

Ensure your IT team has a documented incident response plan that follows this structured approach to containment, elimination, and recovery. 

Response: Preparing for Cyber Incidents 

The final stage of your cybersecurity journey is response. Accepting that a cyber incident isn’t a matter of if, but when allows your organization to be proactive rather than reactive. While your preventative measures reduce risk, they don’t eliminate it completely. Cyber threats continue to evolve, and even the best security measures can be breached.  

The real question is: How well is your team prepared to respond? 

Incident Response Planning 

My company has an incident response that we have tested in a tabletop exercise and review quarterly. 

∗ Complete 

∗ Working On It 

∗ Not Started, But on My List 

∗ I Need More Information  

Why This Matters 

∗ Incident response plan. An incident response plan ensures a fast, coordinated response. Every organization needs a formalized plan that outlines key roles and responsibilities before, during, and after an incident, clear action steps to contain and mitigate cyber threats, and communication protocols for both internal teams and external stakeholders. Lack of an incident response plan will inevitably lead to confusion, delays, and more downtime than needed for your business. 

∗ Tabletop exercise. A tabletop exercise will test your team’s readiness. Having an incident response plan isn’t enough – you need to ensure employees understand their roles and can execute the plan effectively. Running a simulated cyber attack (a tabletop exercise) allows your team to work through real-world attack scenarios and uncover any weaknesses in your response plan. 

∗ Quarterly review. Reviewing the incident response plan quarterly is often overlooked, but very important. Many companies set and forget their response plan, but cyber threats evolve, and so does your workforce! Reviewing the plan quarterly ensures that all roles are assigned to active employees, response protocols align with the latest cyber threats, and any organizational or technology changes are addressed. 

∗ Disaster recovery. In the event of a cyber incident, you really need to methodically work through your incident response plan. If you don’t have an incident response plan yet, you must first call your cyber liability insurance provider, your IT provider, and your lawyer. Don’t have cyber liability insurance? You need it – immediately.  

∗ Appropriate cyber liability insurance. This brings us to our next need in cybersecurity – appropriate cyber liability insurance. We have noticed some businesses don’t have enough or the right cyber liability coverage unique to their business. You need to dig in to understand if there are gaps in your coverage, exclusions for negligence, and coverage appropriate to the true potential financial impact. Reach out to your insurance provider or VGM Insurance to get a full understanding of your coverage and if you need to make any adjustments.  

When a Critical Vendor is Attacked 

My company is prepared if a critical vendor 
experiences a cyber incident and is unavailable 
for my company. 

∗ Complete 

∗ Working On It 

∗ Not Started, But on My List 

∗ I Need More Information 

Why This Matters 

∗  Vendor incidents. When you think of a vendor experiencing a cyber incident that affected businesses like yours, you might be thinking of Change Healthcare. This is the type of scenario you also must prepare for with these steps: 

1. Assess the Impact – Determine how the vendor’s incident affects your operations, what data may have been compromised, and the overall risk to your organization. 

2. Communicate Internally – Inform your IT team, leadership, and key staff members so everyone is aware of the potential impact. 

3. Activate Your Incident Response Plan – This is where your Incident Response Plan guides your next steps to mitigate risk. 

4. Contact the Vendor – Reach out to the affected vendor to understand the nature of the attack and what actions they are taking to mitigate risk. 

5. Implement Risk Mitigation Measures – You may need to isolate affected systems, change passwords, and increase security monitoring for unusual activity. 

6. Review Your SLA or Contract – Review the contract with this vendor to understand your rights and the vendor’s obligations in a cyber incident. 

7. Document Everything – Keep detailed records of all communications and actions taken during the incident. 

8. Maintain Business Continuity – If the vendor’s services are unavailable for an extended time, create a plan for alternative solutions to keep operations going. 

9. Conduct a Post-Incident Review – As always, debrief your team, identify lessons learned, and adjust policies to strengthen your security moving forward. 

In Summary: 
Cybersecurity is a Continuous Journey 

As we’ve navigated through this comprehensive cybersecurity checklist, it’s clear that securing your business is not a one-time task but an ongoing journey. Each step, from email security and device protection to employee education and incident response planning, plays a crucial role in safeguarding your business against cyber threats. 

Remember, cybersecurity is a shared responsibility. Encourage your team to: 

• 
Stay vigilant – recognizing and responding to threats before they escalate. 

• 
Continuously educate themselves – because cyber threats evolve every day. 

• 
Report suspicious activities immediately – early detection minimizes damage. 

By following this cybersecurity checklist and implementing the recommended measures, you’re taking proactive steps to protect your business, your employees, and your customers. 

Take Action Now – Don’t Wait for a Cyber Incident 

Cyber threats don’t wait for you to be ready – so start today. 

• Assess where your business stands on this checklist. 

• Identify any gaps in your security measures. 

• Work with your IT team or cybersecurity provider to close those vulnerable windows and lock those doors. 

Cybersecurity isn’t just a compliance requirement – it’s an investment in the future of your business. Every small step you take today can prevent costly breaches and downtime tomorrow. Thank you for taking the time to read through this guide. 

Together, we can build a more secure, resilient industry.  Need assistance? If you have any questions or want expert guidance, reach out to us at VGM Forbin.  

Jeremy Heidemann, IT Account Executive at VGM Forbin, brings 14 years of hands-on management experience from the auto salvage industry. He specializes in using technology to streamline operations, reduce costs, and boost efficiency. Jeremy helps auto recyclers modernize their IT infrastructure with solutions like cybersecurity, cloud services, and managed support. Reach me at 877-659-5241, email jeremyh@forbin.com or visit www.forbin.com. 

By: Brian Bachand

“We find ourselves in a season of uncertainty and secular upheaval. A moment in time where long standing beliefs, structures, and institutions of a prior era give way to a new organizing system.”

Being an effective leader is determined by how you act and react given the challenges of those you lead and that of the goal to be met.

In November, we the people of the United States will vote for the next leader of our free nation. Many argue that neither choice for America’s succeeding president is the best candidate. Given that information, as we reflect upon the past, and ponder the potential prosperous or perilous predicaments we might soon find ourselves in, it is imperative that we define what leadership is and what makes an effective leader.

We may not all feel that the hopeful presidential nominees are the greatest choices but we do have the right to vote however we wish. As auto recyclers, we have the freedom to choose and create our own leaders within our industry and businesses. Instead of looking to the president elects to lead us, we must elect ourselves to continue to lead the way and to make things happen. Bi-partisan efforts and working with legislators will continue, yet we must translate leadership on our own level to efficiently move forward towards achieving shared goals and creating a successful future.

Psychologist and author of Understanding Leadership, W.C.H. Prentice, defines leadership as, “the accomplishment of a goal through the direction of human assistants. A successful leader is one who can understand people’s motivation and enlist employee participation in a way that marries individual needs and interests to the group’s purpose.” Notice that this definition lists nothing of power or popularity. Prentice published this piece in 1961 yet its principles continue to prevail. Leaders can be anyone. Not just bosses, managers or foremen. Being a leader is a choice. Certain people are born to lead, whereas others learn to make that choice to herd others to shared outcomes or destinations. Being an effective leader is determined by how you act and react given the challenges of those you lead and that of the goal to be met. Given Prentice’s definition, how does leadership translate in the auto recycling arena? What are the intangibles of an effective leader in our industry or in your business? And how do we choose to lead the way instead of following or being misled?

Leadership is a goal we all strive to ascertain. To empower those we need in our business to get the job done right. In order to create leadership we must make the choice to become a leader ourselves. Regardless of one’s job title, we must buy into the goal we are trying to achieve and figure how to make believers of everyone else. A manager can manage and a foreman can supervise, but what makes a person a leader is not how they manage or supervise but through how they motivate.

Besides money and time off there are other means of incentivizing. Figuring out what motivates each person correlates directly with the “why” and “what” that they are buying into. How you get your employees, co-workers and peers to buy into the cause is just as important as keeping them motivated throughout the process. Our effective leaders show and even personify why and how we are to inventory an agreed amount of vehicles a day, dismantle a set amount of cars a month, sell a predetermined amount of parts a quarter, or make an aspired total of sales each year. The business makes money, you make money. Reach the goal and be rewarded, however without consequences motivation can become a challenge. Our leaders should know how to constructively and conservatively incentivize each member of the team. Knowing how the staff responds to challenges and how each member of the staff is motivated to perform at an optimal level, are the fundamental factors that put leaders on a ballot of their own.

A leader in your business should be able to read the room. To know who is the fastest dismantler, and who is most thorough in their de-pollution jobs. To understand who is likely to cut corners, and who needs the most supervision. Who you can lean on when people call out and who will be calling out. A leader analyzes the strengths and weaknesses of each member of the team, and figures out how to direct each member to achieve the most efficient and productive outcome. Their essential qualities include honesty, integrity, accountability, visionary, reliability, trustworthiness and problem solving. Leadership is living in the complicated, finding creative yet conservative solutions to the cogs within the operations, all while continuing to progress. One who effectively leads understands intrinsically both the goal and their team.

These crucial aspects give us the tools we need to overcome different challenges and navigate unforeseen variables that arise in the day to day. Our leaders know how to approach each member of the team and know that each employee is unlike another and should be addressed and motivated in that way. Positive reinforcement may work well with one coworker but can be seen as just empty words to another. Constructive criticism to one employee may get great results where another employee may take it the wrong way and become less productive or even feel alienated. It is all about perception. Our leaders must be able to align themselves with the team and exemplify that the playing field is level, respect is earned and given, and through unity and clearly expressed expectations and motivating incentives, we can all succeed.

Leadership in our industry is paramount to getting us to where it is we aim to go. The goals of our business and the recyclers associations may differ on certain levels of operations but the overall shared vision is what we all buy into. For that we look to the members who are leading the way through profitable and innovative processes and procedures. Earned and learned experiences of individuals within the associations allow them the opportunity to make the choice to take on a greater leadership role. We are so fortunate that our industry has a national association, the ARA, that is in step with all that we do. An organization that consistently lobbies for us, the recyclers, and our shared vision of compliance, Gold Seal standards, and fair regulations and trade, in which to sell our parts within. ARA does all of this while continuing to educate, and lead its members with seeking constant member feedback and input. With the leaders within our state associations, we garner and groom leadership that have different experiences and expertise. Through these shared and different styles and skills, we lead the way through bringing along any and every of our fellow recyclers. We give each other the tools needed to reach our individual outcomes, while working together to move forward in a direction of success and progress as an association.  

Election day is just months away but the time is and will always be now, to make the choice. To decide whether to lead or to be led. Take control of your business, realize your potential and empower yourself and all those around you to make that same decision. Do not bank on the promises of any presidential candidate. We mustn’t allow ourselves to be misled, for the success of our future resides in our calloused and oil stained hands.

To quote ARA Past President Mike Swift, “If not you, then who?” Elect yourself and encourage fellow leaders in your business and in our industry to continue to rise up. Vote to marry your interests and needs with those of your team, and begin to motivate each unique individual along the path to these shared goals that we will create. Through our hard work, solemn resolve and persistence, we will weather this November and move through this perceived Fourth Turning. To reach this high, as always the auto recycler will need to stay relevant, resilient and relentless in our pursuit of perpetual prosperity. May our parts and practices propel us into tomorrow while our
leadership leverages our lasting
longevity. 

Brian Bachand is a second generation auto recycler, who helps own and operate Westover Auto Salvage in Belchertown, MA. He is on the Board of Directors for the Auto Recyclers Association of MA and a proud ARA Member. Brian has a Bachelor’s Degree in Accounting and paired with almost 25 years of auto recycling experience, will continue to implement ARA Advocacy for being a leader in the auto industry.