Software-defined vehicles decouple functions from ECUs, and software-defined networking decouples communication from wiring. Zonal architectures with Ethernet, TSN and SDN bring in-vehicle networks closer to industrial networks, with shared requirements: hard real-time behavior, safety, immediate start-up, updateability and security. Attacks such as CAN injection show why a zero-trust approach is needed at the link layer. This talk presents MACsec as a foundational security layer, the OPEN Alliance TC17 automotive MACsec profile and its challenges (cost, start-up times, hop-to-hop deployment), key agreement for shared-medium networks such as 10BASE-T1S, and how the same security layer extends beyond Ethernet: CANsec for CAN XL and, via the CAN FD Adaptation Layer (FDAL), for CAN FD. Combined with authenticated SDN management via CORECONF and DTLS, this yields a unified stack for strong foundational security and zero trust — from car to factory.