A system for providing security to an in-vehicle communication network, the system comprising: a data monitoring and processing hub external to the in-vehicle network, the in-vehicle network having a bus (61, 71) and at least one node (62-66, 72-79) connected to the bus; and at least one module (40A, 40B, 40C, 40D) configured to monitor messages in communication traffic propagating in a vehicle's in-vehicle network, the module comprising: a communication interface configured to support communication with the hub; a memory (45, 46) having software comprising data characterizing messages that the at least one node transmits and receives during normal operation of the node; at least one communication port (42, 52) via which the module receives and transmits messages configured to be connected to a portion of the in-vehicle network; a processor that processes messages received via the port from the portion of the in-vehicle network responsive to the software in the memory to: determine an operating context for the vehicle; identify a message in the received messages that is propagating in the in-vehicle network as an anomalous message indicative of exposure of the in-vehicle network to damage from a cyber attack based on the determined operating context of the vehicle; determine an action to be taken by the module that affects the anomalous message; and transmit data responsive to the anomalous message to the hub for processing by the hub via the communication interface; wherein the hub is configured to process the data it receives to determine if the in-vehicle network is under threat of an imminent cyber attack, is under a cyber attack, or has vulnerability to a cyber attack, and transmit information to configure the module in the vehicle to engage the cyber attack responsive to the determination. a data monitoring and processing hub external to the in-vehicle network, the in-vehicle network having a bus (61, 71) and at least one node (62-66, 72-79) connected to the bus; and at least one module (40A, 40B, 40C, 40D) configured to monitor messages in communication traffic propagating in a vehicle's in-vehicle network, the module comprising: a communication interface configured to support communication with the hub; a memory (45, 46) having software comprising data characterizing messages that the at least one node transmits and receives during normal operation of the node; at least one communication port (42, 52) via which the module receives and transmits messages configured to be connected to a portion of the in-vehicle network; a processor that processes messages received via the port from the portion of the in-vehicle network responsive to the software in the memory to: determine an operating context for the vehicle; identify a message in the received messages that is propagating in the in-vehicle network as an anomalous message indicative of exposure of the in-vehicle network to damage from a cyber attack based on the determined operating context of the vehicle; determine an action to be taken by the module that affects the anomalous message; and transmit data responsive to the anomalous message to the hub for processing by the hub via the communication interface; wherein the hub is configured to process the data it receives to determine if the in-vehicle network is under threat of an imminent cyber attack, is under a cyber attack, or has vulnerability to a cyber attack, and transmit information to configure the module in the vehicle to engage the cyber attack responsive to the determination. a communication interface configured to support communication with the hub; a memory (45, 46) having software comprising data characterizing messages that the at least one node transmits and receives during normal operation of the node; at least one communication port (42, 52) via which the module receives and transmits messages configured to be connected to a portion of the in-vehicle network; a processor that processes messages received via the port from the portion of the in-vehicle network responsive to the software in the memory to: determine an operating context for the vehicle; identify a message in the received messages that is propagating in the in-vehicle network as an anomalous message indicative of exposure of the in-vehicle network to damage from a cyber attack based on the determined operating context of the vehicle; determine an action to be taken by the module that affects the anomalous message; and transmit data responsive to the anomalous message to the hub for processing by the hub via the communication interface; wherein determine an operating context for the vehicle; identify a message in the received messages that is propagating in the in-vehicle network as an anomalous message indicative of exposure of the in-vehicle network to damage from a cyber attack based on the determined operating context of the vehicle; determine an action to be taken by the module that affects the anomalous message; and transmit data responsive to the anomalous message to the hub for processing by the hub via the communication interface; wherein the hub is configured to process the data it receives to determine if the in-vehicle network is under threat of an imminent cyber attack, is under a cyber attack, or has vulnerability to a cyber attack, and transmit information to configure the module in the vehicle to engage the cyber attack responsive to the determination.