Systems, methods, and other embodiments described herein relate to validating programs of a computing system in a vehicle by tracking a boot sequence. In one embodiment, a method includes, responsive to detecting initiation of a boot sequence in a computing system, tracking characteristics of programs executing as part of the boot sequence. The method includes determining whether the programs correspond with a program execution graph (PEG) by comparing the characteristics of the programs as the programs boot with the PEG. The method includes providing a response to thwart a malicious program when the boot sequence does not match the PEG.