Dealership Management Systems
A 50%-share incumbent took 15,000 dealers offline for three weeks at a measured cost of $1.02B, then got sued for refusing to hand back customer data. The trust rupture is documented, priced, and still open.
The buyer population — New car dealers
Base industry report for 441110 →- Establishments · CanadaA
- 3,748
- Under 10 employeesA
- 10%
- Establishments · USA
- 21,835
- Employment · USA
- 1,110,728
- Payroll · USA
- $91.3B
Of 3,748 Canadian establishments with employees, 10% have fewer than ten — weighted toward mid-sized establishments. Each of those is one potential account, before any filter for size or fit.
Entry signal — what decides who wins here
Execution decidesThe hurdles here are ones a better operator clears. That is not a promise of success — it is the absence of a structural reason you cannot win.
Measured, not forecast: the share of US establishments opening in one year that were still active later. It counts good operators and bad ones together, which is exactly why it is the honest answer to “what are the odds”. It is for the whole sector rather than this market, and the ten-year figure comes from an older cohort because no younger one has reached ten years.
This is not a probability of success, and it is not a verdict on you. No survival probability is published per market, and inventing one would be worse than saying so. What the bar reads is how much of the outcome sits inside an operator's control: green means the hurdles are ones a better operator clears, red means the binding constraint is capital, an asset or a permission rather than execution. Someone arriving with an advantage this screen did not assume can win a market shown in red.
Companies named in this market · 4
The proposition being tested
Entering new car dealers with Dealer-owned continuity and data-escrow layer — a continuously refreshed read-only replica of the dealership's own DMS data that survives a vendor outage and makes switching possible for Dealer groups of 3–50 rooftops.
Pass — ≥3 dealer groups agree to a paid $7,500 continuity assessment AND ≥2 name a specific dollar figure for their own June 2024 losses
Fail — <1 paid assessment, OR groups report their DMS contract already guarantees export and recovery
A dealership sells inside a metro, but its marketing spend is bought from national platforms — and those platforms publish per-dealer economics the dealer body itself never discloses.
Handle — CarGurus and Cars.com. Two listed marketplaces bill the same rooftops every month and report both the customer count and the revenue per customer, which turns an opaque, fragmented industry into an arithmetic problem. Cars.com carried 19,544 dealer customers on $723.2M of revenue; CarGurus reported quarterly revenue per subscribing dealer of $6,616 and added 1,357 paying US dealers in a record year of network expansion.
CarGurus: $6,616 quarterly revenue per subscribing dealer × 4. Cars.com: $723.2M ÷ 19,544 dealer customers. Both are derived from reported figures; a dealer typically pays several platforms at once, so these do not substitute for one another — they add.
Screen score
7.45Analyst judgment calibrated to the cited evidence, not measurement. Method
The incumbent
Who owns this market, how they are defended, and the specific gap their defence leaves open.
Operational continuity and data portability — the one thing the incumbent has a positive incentive never to build
The field
Every vendor named on this record, and what each one discloses. Most disclose nothing, which is why the market is not sized.
Competitor set · 4 named · 0 disclose revenue
| Name | Revenue | Share | Note |
|---|---|---|---|
| CDK GlobalC | not disclosed | — | Private (Brookfield) since 2022; no longer discloses |
| Reynolds and ReynoldsC | not disclosed | — | Private |
| TekionC | not disclosed | — | Private, venture-funded |
| DealertrackC | not disclosed | — | Inside Cox Automotive; not broken out |
Nobody here publishes revenue. The market is not sized for that reason — an estimate built on nothing would only look like knowledge.
Demand landscape
Addressable market, competitor positions, and where buyer preference is shifting.
No clean published DMS software revenue figure was found. Sizing here is built from dealer counts and disclosed incident economics rather than a vendor forecast.
~1,400 dealer groups at 3–50 rooftops x $30k average continuity subscription. Excludes single-rooftop dealers (cannot justify the spend) and the largest public groups (build in-house).
5–15% over five years.
Demand indicators
Competitor positions
Dominant. Enterprise mission-critical DMS defended by OEM certification lock-in.
The other half of the historical duopoly.
Cloud-native challenger, single-tenant architecture. The most significant long-term competitive threat — and the plaintiff in the data-portability suit.
UK-based, entered the US Feb 2026. Cloud-native, AI-enabled.
Only CDK's ~50% figure is published. The remainder is characterised qualitatively rather than split into invented percentages.
Shifting buyer preferences
- Continuity is now a board-level question at dealer groups in a way it was not before June 2024.
- Data portability moved from a contract footnote to active litigation between vendors.
- Cloud-native and single-tenant architecture is the stated preference of every challenger, and increasingly of buyers.
- OEM certification remains the hardest barrier — it constrains which systems a franchised dealer may run at all.
Revenue model
Pricing that a real buyer would clear, the volume that follows, and what else the same customer will pay for.
Pricing
What breaks, and for how long, if the DMS goes dark tomorrow.
$750/mo. Below the threshold most single dealers will clear.
Anchors against a measured $1.02B loss spread over ~15,000 locations — roughly $68,000 per location for a single three-week event. At that anchor the subscription is cheap; the risk is that memory of the event fades faster than the sales cycle closes.
Volume projection
UNVERIFIED. Year 5 sits near 9% of an unverified SAM.
Ancillary revenue
The escrow replica is exactly the asset a migration needs. Converts a defensive product into the switching toolchain.
Underwriters increasingly ask dealers to demonstrate continuity capability. A third party attesting to it has value beyond the dealer.
Acquisitive groups run CDK, Reynolds and Tekion simultaneously. The replica already spans them.
Cost structure
What it costs to stand this up and keep it running — and where the supply chain can end the business.
Fixed costs, annual
Higher than most SaaS — the product IS a durable data copy, and storage is the COGS.
Non-negotiable. Selling continuity after a ransomware event means the buyer will audit you hard.
You are holding a copy of the data whose loss cost the industry $1.02B.
Variable costs
CDK, Reynolds and Tekion each require separate extraction paths, and at least one vendor is actively litigating over exactly this access.
20–60 h. Mixed DMS estates raise it.
This buyer is reached through dealer associations and 20-groups, not search.
Supply chain
The single dependency is extraction access to the incumbent DMS — and the incumbent is already in court accused of denying exactly that to a competitor. This is the sharpest supply-chain risk in the portfolio, and it is also the market's central grievance. Positioning matters: a tool that helps a dealer exercise rights over its own data is defensible in a way that a scraper is not. Get counsel on this before writing a line of code.
Labour — Canadian and US medians
| Role | CA median | US median |
|---|---|---|
| Automotive Service Technicians and Mechanics The workforce idled during the outage — the labour cost of downtime. | $62,171 | — |
| Supervisors, motor vehicle assembling | $72,010 | — |
| Software Developers | $100,006 | $135,980 |
| Computer Network Architects Replication and failover design is the core technical hire, not application development. | — | $134,050 |
This is an infrastructure product, not an app. The decisive hire understands replication, retention and recovery testing.
Execution & risk factors
Regulatory hurdles, whether anything defends the position once it works, and the macro trends acting on it.
Macro trends
The driver, and it is not reversing. Concentration of dealers onto two systems makes the sector a standing target.
Whichever way it resolves, it keeps dealer data ownership in front of the buyer. A ruling for Tekion would be a decisive tailwind.
The single biggest commercial risk. Fear-driven purchases decay; every quarter without an incident makes the sale harder.
They validate the discontent and create switching events to sell into — but a modern DMS may bundle continuity itself.
Kill criteria
The findings that should end this today. Written on the assumption that the reader is too invested to see them unaided.
CDK or Reynolds ships dealer-controlled data export and continuity as a standard contract term. Both have every incentive to do so once a court or an OEM forces it, and it eliminates the product.
Extraction access is closed off contractually or technically, and counsel advises the workaround carries litigation risk. The Tekion suit exists precisely because this is contested.
Willingness to pay decays with the memory of the outage. If a 30-day test in 2026 cannot close on a 2024 event, it will not close in 2027 either.
Where the industry talks
The associations, forums and events where people in this trade actually talk shop — where to listen before entering, and where the first customers are found. Each link was opened on the date shown.
The national association of franchised dealers; no member count on its site
franchised new-car and -truck dealers, per the 'By the Numbers' section of its homepage
NADA's annual convention and expo in Las Vegas, where DMS vendors (CDK, Reynolds, Tekion) exhibit
Dealer technology and marketing conference; 2026 edition Sept 22-23 in Detroit
Canadian trade magazine for dealer principals and managers; articles current to Sept 2026
Blocked automated access (403); search results show current dealer coverage in Sept 2026
Dealer principals talk in associations and at the NADA Show; there is no busy public forum for dealer operators or DMS buyers. Reddit's r/askcarsales is mostly front-line sales staff and shoppers.
Full study
The complete written report.
Market-Entry Study — Dealership Management Systems
NAICS 441110 · New car dealers
Verdict: ENTER — the strongest vertical opening in this research, on a decaying clock.
Prepared 2026-09-08 · Evidence tiers per ../_method/screening-model.md
The proposition being tested
Entering dealership management systems with a dealer-owned continuity and data-escrow layer — a continuously refreshed read-only replica of the dealership's own DMS data that survives a vendor outage and makes switching possible for dealer groups of 3–50 rooftops.
1. MARKET SIZE
Most markets in this research are sized by forecast. This one is sized by an invoice.
On 18 June 2024 the BlackSuit ransomware group took CDK Global offline. Approximately 15,000 dealer locations across North America lost their core operating system for roughly three weeks. The Anderson Economic Group put the total damage to dealers at $1.02 billion [B].
That figure is the market. Divided across the affected locations it is roughly $68,000 per rooftop for a single event — a number a dealer principal can check against their own 2024 books, which is a far better foundation for a price than any analyst's CAGR.
| Metric | Value | Tier |
|---|---|---|
| CDK share of US dealers | ~50% | [B] |
| Locations affected, June 2024 | ~15,000 | [B] |
| Outage duration | ~3 weeks | [B] |
| Measured economic damage | $1.02B | [B] |
| Tekion lawsuit against CDK | Dec 2024 — alleges CDK holds switching dealers' data hostage | [B] |
| New entrant | Pinewood.AI launched in the US Feb 2026 | [B] |
No clean published figure for DMS software revenue was found, and none is invented here. Sizing is bottom-up from dealer counts and the disclosed incident economics: roughly 1,400 dealer groups at 3–50 rooftops, a $42M SAM [UNVERIFIED], and a realistic five-year capture of $2.1M–$6.3M.
Growing or shrinking? Neither, and this is the study's most important qualification. The US dealer count is flat to declining. What grew was willingness to pay for continuity, and that is event-driven rather than secular. This is a market with a decaying clock on it — see kill criterion 3.
Demand signals
- Incident data: STRONG, tier [B], and unusually specific. A named date, a named threat actor, a counted victim population, and an independently estimated dollar figure. Very few markets offer this.
- Litigation: STRONG. Tekion's December 2024 suit alleges CDK systematically refuses to release data belonging to dealers who want to leave [B]. A competitor is spending legal money to establish exactly the premise this product sells on.
- Competitive entry: STRONG. Pinewood.AI launched in the US in February 2026 and signed its first rooftop at launch [B]. New entrants confirm the discontent is real.
- Search volume: NOT MEASURED. Run:
CDK alternative,DMS switching,dealership data backup,CDK outage. The last one is the useful diagnostic — if volume has collapsed since 2024, kill criterion 3 is already firing. - Reddit / Amazon: NOT APPLICABLE. This buyer is reached through NADA and 20-groups.
2. THE CUSTOMER
What they want that nobody is giving them
A dealer group principal who lived through June 2024 wants one thing that does not currently exist: the ability to keep operating, and to leave, without their vendor's permission.
Both halves matter. Continuity is the emotional sale; portability is the strategic one. They are the same technical artefact — a current, complete, readable copy of the dealership's own data, held somewhere the vendor does not control.
What they pay for right now to solve it badly
| Current spend | Typical cost |
|---|---|
| Downtime, absorbed | ~$68,000 per rooftop for the 2024 event [derived from B] |
| Manual paper fallback during outage | Idle technicians at a $62,171 Canadian median [A, ../../occupation] |
| Cyber insurance premiums | Rising, and increasingly conditional on demonstrated continuity capability |
| DMS vendor's own backup | Controlled by the vendor whose outage is the risk |
| Nothing | The most common answer, and the reason the 2024 loss was $1.02B |
How much would they pay
[UNVERIFIED] $24k–$60k ACV for a 3–15 rooftop group. Against $68,000 per rooftop of demonstrated single-event exposure, the arithmetic is trivially favourable. The risk is not the price — it is whether the fear survives long enough to close the sale.
3. THE COMPETITION
Who owns this today
CDK Global at ~50% of US dealers [B], with Reynolds & Reynolds holding much of the remainder — a duopoly defended by OEM certification requirements, which constrain which systems a franchised dealer may run at all. That barrier is the reason the duopoly survived an event that would have destroyed a vendor in a freely switchable market.
Tekion is the credible cloud-native challenger, and Pinewood.AI entered the US in February 2026 [B].
Where they are weak
The incumbents' weakness here is not product quality or price. It is that their commercial interest is directly opposed to the customer's interest on exactly this question. A DMS vendor that makes data trivially portable has weakened its own retention. Tekion's lawsuit alleges CDK acts on that incentive [B].
This is the cleanest structural gap in this research: a need the incumbent is not merely slow to serve but actively disinclined to serve, in a market where the cost of not serving it has been publicly priced at $1.02 billion.
The gap
Dealer-owned continuity and portability, sold by someone with no DMS to protect.
Why it stays open ~24 months: closing it means a vendor voluntarily lowering its own switching costs. That happens when a court or an OEM forces it — which is also kill criterion 1.
4. ENTRY STRATEGY
#1 — Continuity assessment, then subscription. Cost: <$6k. Odds: highest. Sell a $7,500 assessment answering "what breaks, and for how long, if your DMS goes dark tomorrow." It requires no integration, generates revenue immediately, and every assessment is a scoped specification for the replica product.
#2 — Migration tooling for groups already switching. Cost: $80k–$200k. Odds: medium-high. Pinewood.AI and Tekion are actively winning rooftops. Every switch needs a data extraction the incumbent may resist. Same asset, sold offensively rather than defensively — and it converts the product from insurance into a growth tool.
#3 — A competing DMS. Cost: $10M+. Odds: near zero. OEM certification alone rules this out for a new entrant. Listed to be excluded.
Recommended: #1 for 90 days, then #2 as the natural expansion.
What would have to be true
- Extraction access to CDK and Reynolds data is technically achievable and legally defensible. Get counsel before writing code — this is the subject of active litigation.
- Enough groups sit in the 3–50 rooftop band to support a $42M SAM.
- The June 2024 memory is still commercially live in 2026.
- Dealers accept a third party holding a copy of consumer financial data.
The smallest test that proves or kills this in 30 days
| Week | Action |
|---|---|
| 1 | Counsel review of DMS contract terms on data access, in light of Tekion v. CDK. A clear legal no ends this before any spend. |
| 2 | Approach 30 dealer groups through 20-group and NADA channels. Ask one question: "What did June 2024 cost you?" A specific number means the memory is live. |
| 3 | Offer a paid $7,500 continuity assessment. |
| 4 | Count, and record how many could quote their own loss figure unprompted. |
Pass: ≥3 paid assessments AND ≥2 groups name a specific dollar loss. Fail: 0 paid assessments, OR groups report their contract already guarantees export and recovery.
5. KILL CRITERIA
1. CDK or Reynolds ships dealer-controlled export and continuity as a standard contract term. They have every incentive to resist — and every incentive to concede the moment a court or an OEM requires it. A concession eliminates the product overnight.
2. Extraction access is closed off, or counsel advises the workaround carries litigation risk. The Tekion suit exists precisely because this is contested. A business built on data access that a $1B-plus incumbent is litigating to restrict is a business with a single point of failure.
3. Willingness to pay decays with the memory of the outage. The highest-probability kill, and the one most easily rationalised away. Fear-driven purchases have short half-lives. If a 2026 sales conversation cannot close on a 2024 event, 2027 will be worse, and every quarter without a new incident makes it harder.
The honest bias check: this study has the most vivid narrative in this research — a named ransomware group, a three-week blackout, a billion-dollar invoice, and a competitor suing over hostage data. Vividness is not durability. The single question that decides this market is not whether the pain was real. It was. It is whether a dealer principal in month 30 still feels it enough to sign. Everything else in this study is favourable; that one thing is not measurable from a desk.
THE CALL: ENTER
Enter, and move quickly, because the asset depreciating here is urgency rather than opportunity.
The evidence: a ~50%-share incumbent [B]; 15,000 locations offline for three weeks; $1.02B of independently estimated damage [B]; an active lawsuit alleging the incumbent withholds customer data on exit [B]; and new entrants validating the discontent [B]. The gap is one the incumbent is structurally disinclined to close, and entry costs under $6,000 through path #1.
Enter to build a $3–6M ARR continuity and migration business, and expect the defensive framing to weaken over time — which is why path #2, selling the same asset to groups that are switching anyway, matters more than it first appears.
Reverse the call if counsel advises extraction carries material litigation risk, or the 30-day test finds groups can no longer quote their own 2024 loss.
STRUCTURED ANALYSIS
Four dimensions — demand landscape, revenue model, cost structure, and
execution & risk factors — are held as structured data in
profile.json rather than repeated as prose here, so there is
exactly one source of truth for every figure. The Market Research app renders
all four as panels above this report.
Sources
- TechTarget — The CDK Global outage: Explaining how it happened
- BlackFog — CDK Global Ransomware: What Happened and How It Impacted Businesses
- Mercer Capital — The Latest on CDK Global Cybersecurity
- BusinessWire — Tekion Files Lawsuit Against CDK Global's Anticompetitive Practices
- Dealership Guy — Tekion sues CDK Global, accuses firm of holding data 'hostage'
- Vertical GTM Guild — CDK Global: Enterprise Mission-Critical DMS Through OEM Certification Lock-In
- Wage data:
../../occupation/data/build/site-data.json