When a Chinese AGV fleet is connected to a warehouse WMS, ERP, industrial network, or remote diagnostic platform, cybersecurity becomes part of the equipment procurement decision—not just an IT configuration issue.

For an enterprise deploying autonomous forklifts in the United States, the important question is not simply whether the AGV software is "cloud connected." The real questions are: Where is the fleet-management server located? What information leaves the warehouse network? Which external systems can communicate with the AGVs? Can the fleet operate without Internet access? How is remote maintenance authenticated? And can the customer's IT team independently audit the software and network traffic?

These questions should be answered before the purchase order is signed, because changing the network architecture after AGVs are deployed can be considerably more difficult.

Can Chinese AGV Fleet Management Software Run on a Local, Air-Gapped Internal Network?

Yes, a Chinese AGV fleet management system can be designed for local deployment, but this should never be assumed simply because the equipment is installed inside the customer's warehouse.

A typical architecture may include the AGVs, wireless network, fleet-management server, WCS/RCS software, WMS or ERP interface, database, engineering workstation, and optional remote-support services. These components can be deployed entirely inside the customer's network if the supplier's software supports an on-premise architecture.

An enterprise IT team should ask the supplier to provide a complete network architecture diagram before approving the system. The diagram should identify every server, gateway, AGV communication channel, database, external service, and remote-access connection.

An air-gapped or highly restricted network does not necessarily mean the AGV system cannot function. The supplier may instead provide local fleet management, local databases, local map storage, and local WMS integration. However, some optional functions—such as cloud monitoring, automatic software downloads, license verification, or remote engineering support—may require controlled external connectivity.

The important distinction is between Internet access for normal AGV operation and Internet access for optional support or cloud services. These should be documented separately.

What Data Should an Enterprise Know About Before Connecting Chinese AGVs?

Before approving a cloud-connected AGV system, the IT department should identify exactly what information is generated and where it goes.

AGV telemetry may include vehicle position, battery status, task information, fault codes, operating hours, travel routes, lift status, sensor information, diagnostic logs, and production-related activity. Depending on the system architecture, additional information may be collected by cameras or other sensors.

The presence of telemetry does not automatically mean that sensitive data is being transmitted externally. The issue is whether the information is stored locally, transmitted to an external server, retained by the supplier, or made available to remote personnel.

A useful procurement requirement is to request a data-flow diagram showing:

• What data is generated by each AGV.

• Where the data is processed.

• Where the data is stored.

• Which data is transmitted outside the customer's network.

• Which external domains, IP addresses, ports, and protocols are required.

• How long operational data and diagnostic logs are retained.

• Who can access the information.

• Whether the customer can export and delete its own data.

This is much more useful than simply asking a supplier whether its software is "secure."

How Do Chinese AGV Vendors Encrypt Telemetric Data During Remote Diagnostics?

Remote diagnostics should be treated as a separate security channel from normal AGV operation.

A supplier may use a VPN, TLS-encrypted connection, secure remote desktop gateway, SSH-based service, certificate-based authentication, or another controlled remote-access mechanism. The exact technology varies by vendor and software architecture.

The more important procurement question is whether remote access is always available or only activated when the customer authorizes a support session.

For a high-security warehouse, the preferred architecture is generally a controlled remote-support process in which the customer's IT team can approve, monitor, and terminate the connection.

A particularly important question is whether the supplier can perform remote maintenance through a temporary connection rather than maintaining a permanent inbound connection to the customer's OT network.

The IT team should also test what happens when the remote-support connection is unavailable. Normal vehicle safety functions and essential warehouse operations should not depend on a remote engineer being connected.

What Network Protocols Are Used Between AGVs and Local WMS/ERP Systems?

There is no single network protocol that all Chinese AGV manufacturers use.

Depending on the system, communication may involve TCP/IP, HTTPS/TLS, REST APIs, WebSocket connections, MQTT, industrial Ethernet, Modbus TCP, PROFINET, EtherNet/IP, database interfaces, or supplier-specific application protocols.

The correct protocol depends on what is being connected. AGV-to-fleet communication is not necessarily the same as fleet-manager-to-WMS communication or AGV-to-PLC communication.

The IT department should not accept "TCP/IP compatible" as a complete cybersecurity specification. TCP/IP only describes a communication foundation. The actual security review should identify the application protocol, port, encryption method, authentication method, source and destination, and required network direction.

For example, a WMS interface may be permitted to communicate with a local fleet server over a restricted application port, while the AGV subnet is prevented from directly communicating with the corporate user network.

Network segmentation is therefore often more important than simply asking whether the AGV uses a particular protocol.

How Should Enterprise IT Segment a Chinese AGV Network?

A practical architecture is to separate the AGV operational network from ordinary corporate devices wherever the site architecture allows it.

The AGV fleet may operate inside an OT or automation VLAN, while the fleet-management server communicates with WMS/ERP through a controlled interface or firewall zone.

This architecture reduces the consequences of a compromised workstation or unrelated corporate endpoint attempting to reach the AGV fleet.

The network design should define at least:

• AGV VLAN or wireless network.

• Fleet-management server subnet.

• WMS/ERP integration zone.

• Engineering workstation access.

• Remote-support access path.

• Firewall rules between zones.

• Allowed outbound connections.

• Allowed inbound connections.

• DNS, NTP, certificate and update requirements.

• Logging and monitoring requirements.

An enterprise should also test whether the AGV fleet continues to operate safely if Internet access is removed. If cloud connectivity is only required for remote support, normal warehouse operation should ideally remain independent of that connection.

How Can Enterprise IT Teams Audit Chinese AGV Software for Security Vulnerabilities?

A proper cybersecurity review should go beyond a supplier questionnaire.

The first stage is an architecture review. IT should identify operating systems, databases, application servers, network services, APIs, user accounts, remote-access mechanisms, third-party libraries, and external connections.

The second stage is a configuration review. Default passwords, unused services, unnecessary open ports, excessive user privileges, insecure protocols, weak authentication, and unrestricted administrative access should be examined.

The third stage is vulnerability assessment. Depending on the customer's security program, this may include authenticated vulnerability scanning, network-service discovery, software-component analysis, penetration testing, configuration review, and monitoring of network traffic.

For enterprise procurement, the supplier should also be asked whether it can provide a Software Bill of Materials (SBOM) or equivalent component inventory for the fleet-management software. This can help the customer's security team understand which open-source and third-party components are included and how security updates are managed.

Should the AGV Software Be Included in the Company's Vulnerability Scanning Program?

Yes, but the scanning method should be coordinated with the AGV supplier and the customer's operational technology team.

An aggressive vulnerability scan can create unexpected load on industrial devices or services. A production fleet should therefore be assessed under an agreed test plan rather than treated exactly like an ordinary office server.

A staged process is more appropriate:

1. Review the supplier's architecture and security documentation.

2. Build an isolated test environment where possible.

3. Identify hosts, services and communication paths.

4. Perform controlled vulnerability scanning.

5. Review authentication and privilege configuration.

6. Test remote-access controls.

7. Monitor external network connections.

8. Document identified vulnerabilities and remediation responsibilities.

9. Retest after security fixes are installed.

10. Establish a process for future vulnerability notifications and software updates.

For a large enterprise, the objective should not be to prove that the software has "zero vulnerabilities." No complex software system can realistically make that claim. The objective is to establish visibility, control, patchability, monitoring, and a defined response process.

What Should Be Included in the AGV Cybersecurity Requirements of an RFQ?

Cybersecurity requirements should be included in the technical specification and contract rather than discussed only after the AGVs arrive.

A buyer can request the following documentation before final approval:

• Complete network architecture diagram.

• Data-flow diagram.

• List of communication protocols and ports.

• List of external domains or IP destinations.

• Cloud services used by the system.

• Local deployment and offline-operation requirements.

• Remote-access architecture.

• Authentication and authorization model.

• Encryption methods used for data in transit.

• Encryption or protection methods for stored sensitive data where applicable.

• Operating-system and software version inventory.

• Third-party software and component inventory or SBOM where available.

• Vulnerability-management and security-patch process.

• Backup and disaster-recovery procedure.

• User-role and permission model.

• Security-event and administrative logging capabilities.

• Data retention and deletion policy.

• Data ownership and export capability.

• Remote-support activation and approval procedure.

Can a Chinese AGV Fleet Be Operated Without Cloud Connectivity?

In many projects, yes, if the fleet-management architecture is designed for local operation. But this must be verified through a technical test rather than assumed from the supplier's marketing materials.

The buyer should perform an offline-operation test during FAT or SAT. Disconnect the external Internet connection while keeping the internal AGV network available and verify whether the following functions continue to work:

• AGV localization and navigation.

• Fleet task assignment.

• Traffic management.

• Automatic charging functions.

• WMS task exchange.

• Alarm and fault reporting.

• Map and route operation.

• Emergency and safety functions.

• Operator login and local administration.

Then separately test what stops working without external connectivity. This can reveal whether cloud access is genuinely optional or whether an undocumented dependency exists.

A Practical Cybersecurity Acceptance Checklist for Imported Chinese AGVs

Before accepting a cloud-connected Chinese AGV system, the enterprise IT and automation teams should be able to answer the following questions:

• Can the fleet-management system be deployed locally?

• Can normal AGV operation continue without Internet access?

• What data leaves the warehouse network?

• Where is cloud data physically hosted?

• Which external destinations are required?

• Which protocols and ports are used?

• Is remote access disabled by default or controlled by the customer?

• How are remote sessions authenticated and encrypted?

• Are administrator actions logged?

• Can user permissions be separated by role?

• Can the customer export operational and diagnostic data?

• Can the supplier provide a software component inventory or SBOM?

• How are vulnerabilities reported and patched?

• Can the customer conduct vulnerability scanning and penetration testing?

• What happens if the fleet server loses Internet connectivity?

• What happens if the fleet server loses communication with an AGV?

• Can the customer restore the system from a local backup?

• Can remote maintenance be disabled after commissioning?

For a high-value AGV project, these questions should be resolved before shipment, not after the fleet is connected to the corporate network.

The strongest cybersecurity architecture is not necessarily the one with the most security terminology in the quotation. It is the architecture where the enterprise can clearly identify the data flows, restrict network access, control remote maintenance, operate critical functions locally, audit the software, and verify the supplier's security process over the life of the fleet.