Modern vehicles have evolved into intelligent and autonomous transportation systems, yet such computer-driven developments also create opportunities for unforeseen cyber-security attacks on self-driving cars. These threats may pose critical risks to human lives but there is a considerable lack of understanding in designing vehicle systems to support driver response during rare and hazardous security events. We conducted an interview with autonomous vehicle drivers to understand their perception of automotive threats and design needs for effective response during security events. Results show that drivers expect information relating to malfunction detection, trouble-shooting instructions, and log data from the vehicle. Moreover, drivers were more likely to act based on instincts the more the driver perceives the threat to be urgent, rather than process the situation during the initial stages of an attack. We thus propose a ‘Driver Response Phase’ and corresponding design implications for future vehicles that support user response to security risks.