GM Won't Start With the Security Light On? Passlock, VATS, and Global A by System

Start here: what a SECURITY light actually means

When the amber SECURITY (or THEFT SYSTEM) tell-tale is lit on a GM dash and the engine won't run, the vehicle is not broken in the way most people assume. In the overwhelming majority of these cases the engine is mechanically fine — the anti-theft system has simply decided the key or the module in front of it is not authorized, and it has commanded a no-start as a security measure. That is the system doing its job. The trick is figuring out which GM anti-theft system you have, because there have been three fundamentally different generations, they fail in different ways, and they are fixed with completely different procedures.

Vehicle theft is exactly the problem these systems were built to fight, and it is not a small one. The National Insurance Crime Bureau reports that reported vehicle thefts in the United States have run around and above one million per year in recent reporting periods, and the FBI Uniform Crime Reporting data has long placed motor-vehicle theft among the most frequently reported property crimes, with hundreds of thousands of incidents logged annually. Federal anti-theft policy is why immobilizers exist at all: the National Highway Traffic Safety Administration administers the federal motor-vehicle theft-prevention standards that pushed anti-theft technology onto mainstream vehicles. Immobilizers are the industry's front-line answer, and their effectiveness is measurable — the Insurance Institute for Highway Safety has documented meaningful reductions in theft rates for vehicles equipped with engine immobilizers compared with those without, and coverage from outlets like Hagerty has traced how factory immobilizers cut the casual "hot-wire" theft that dominated the pre-immobilizer era. The downside of a system engineered to stop a thief is that when a sensor, key, or module fails, it stops the legitimate owner just as effectively.

This guide is written to be diagnosed against. Find your era, read what fails, and see whether it is a driveway relearn or a mail-in bench job.

The three GM anti-theft eras at a glance

Before the details, here is the map. GM did not switch every model on the same day, so overlap by year is normal — a platform that launched early may carry an older system for years after a sibling moved on. Use this as the starting point, then confirm by symptom.

Era / system	Rough years	Where the "secret" lives	Classic symptom	Typical fix
VATS / PASS-Key	~1986–2005	Resistor pellet molded into the key	Cranks, no start; dead pellet or worn key contacts	VATS delete (bench) or resistor-key service
Passlock / PK3	~1997–2008	Hall-effect sensor in the ignition lock cylinder	SECURITY light, cranks-no-start after a lock-cylinder issue; 10-minute relearn	Passlock relearn, sensor repair, or bench delete
Global A	~2010–present	Immobilizer data in the Body Control Module over CAN	No-start with a mismatched or replaced BCM/ECM	BCM clone or Global A virginize (bench)

The single most useful diagnostic question is: does the engine crank? A no-crank condition (the starter does nothing) points more often at battery, starter, neutral-safety, or ignition-switch problems and is usually not the immobilizer. A cranks-but-won't-start condition with the SECURITY light involved is the fingerprint of an anti-theft refusal — the starter spins the engine but fuel and/or spark are cut because the module never received the authorization it wanted.

Era one: VATS and PASS-Key — the resistor in the key

The oldest system on the road here is VATS (Vehicle Anti-Theft System), also branded PASS-Key and PASS-Key II on various GM lines from the mid-1980s into the early 2000s. It is beautifully simple by modern standards: a small resistor pellet is molded into the blade of the ignition key. When you turn the key, two contacts in the lock cylinder read the resistance of that pellet. If the measured resistance matches the value the vehicle expects (there were 15 discrete values), the system allows start. If it reads open, shorted, or the wrong value, it commands a no-start and, on many cars, imposes a lockout delay of a few minutes before you can try again.

What fails on VATS is almost always contact and wire wear, not electronics:

• The thin wires running from the lock cylinder to the resistance-sensing module fatigue and break where they flex in the steering column.
• The pellet contacts inside the lock cylinder wear or corrode, so the reading drifts out of tolerance.
• A worn or aftermarket key reads the wrong value.

Because the whole system is a single resistance check, VATS is one of the cleanest candidates for a software or hardware delete. On a bench, the anti-theft resistance requirement can be removed from the controller so the engine no longer demands the pellet reading at all — eliminating the failure point entirely. That is the GM VATS delete service, a flat $150 bench job. It is popular on older Camaros, Corvettes, trucks, and G-body cars where the original column wiring is tired and the owner wants the fragile resistor check gone for good rather than chasing an intermittent broken wire.

VATS is genuinely obsolete as a theft deterrent — it was defeated decades ago — so removing it on an older vehicle rarely changes the car's real-world security posture, while it removes a very common no-start nuisance. As always, proof of ownership is required before any anti-theft work.

Era two: Passlock and PK3 — the ten-minute relearn system

The most misunderstood GM anti-theft generation is Passlock (and its transponder cousin PK3 / Passlock III), used broadly from the late 1990s through the late 2000s on Malibu, Impala, Monte Carlo, Cavalier, S-10, Blazer, Silverado, Tahoe, and many more. Passlock moved away from the resistor-in-the-key idea. Instead, a Hall-effect sensor built into the ignition lock cylinder produces a signal when a correctly cut key turns the cylinder. The Body Control Module (or on some the PCM) reads that signal, checks it against a stored security code, and only then authorizes fuel.

This is the system responsible for the infamous ten-minute relearn. When Passlock sees a signal it doesn't trust, it goes into a security lockout. The classic recovery procedure — turn the key to ON so the SECURITY light comes on, wait ten minutes until the light goes out, turn off, and repeat the cycle up to three times (about 30 minutes total) — teaches the module the current sensor signal. When it works, it is free and requires no tools. GM's documentation of relearn procedures across its brands reflects how central this became to the ownership experience; the General Motors owner and service portal is the authoritative home for model-specific procedures.

Here is what trips people up: the relearn only helps if the sensor is actually good. Passlock's real weakness is that the Hall-effect sensor in the lock cylinder wears out. When it does, no amount of relearning fixes it, because the module is faithfully reading a signal that is now bad. Symptoms of a failing Passlock sensor include:

• SECURITY light on, cranks but won't start, sometimes intermittently
• The car starts fine cold and refuses when hot, or vice versa
• The relearn works for a few days or weeks, then the problem returns

At that point you have three real paths. One, replace the lock cylinder/sensor and perform the relearn — a legitimate mechanical repair. Two, on many Passlock vehicles, the security function can be bypassed or deleted on the bench at the module level so the failing sensor is taken out of the decision entirely. Three, if the module itself has failed or a replacement is being fitted, the security data has to be handled so the new module and the vehicle agree.

For a deep, step-by-step walkthrough of the relearn, the sensor failure pattern, and every fix option, see our dedicated GM Passlock anti-theft complete fix guide. If you have already diagnosed VATS specifically, the GM VATS delete guide covers that era in depth. And if you are still not sure whether your no-start is the immobilizer at all, read car won't start: immobilizer vs module diagnosis before you spend a dollar.

Era three: Global A — immobilizer authority moves to the BCM

Around 2010 GM began rolling out its Global A electrical architecture, and with it a very different immobilizer model. On Global A vehicles the anti-theft function is no longer a simple resistance or Hall-effect check read by one module. Instead, immobilizer data is distributed across the network — the Body Control Module (BCM) holds central authority, communicating over a CAN (Controller Area Network) bus with the ECM and the keys. The controllers are cryptographically paired to each other and to the vehicle. This is the architecture on huge volumes of 2010-and-newer Chevrolet, GMC, Buick, and Cadillac models.

CAN itself is a mature, standardized automotive network — the protocol is defined under SAE International standards and is the backbone of nearly every modern vehicle — which is exactly why a Global A immobilizer is robust: the modules are talking a well-defined, secured language to one another. The strength of the paired-module design is also its complication. When a module is replaced — a junkyard BCM, a replacement ECM, a used cluster — the new module arrives with someone else's identity baked in, and the vehicle refuses to authorize it. This is the single most common reason a modern GM shows up as a no-start after a repair: the parts are fine, but the security pairing is wrong.

There are two clean bench answers depending on what you are trying to do:

• GM BCM standalone clone — $199. If your original BCM is failing but its data is still readable, we clone the original's identity onto a donor BCM so the vehicle sees the replacement as its own module. Nothing else on the car has to be relearned because, as far as the network is concerned, the same BCM is still installed. This is the least-disruptive path when you have a good donor and a readable original.
• GM Global A virginize — $150. When a module carries a used vehicle's data and needs to be reset to a neutral, factory-like "virgin" state so it can be freshly programmed into your car (or so a locksmith can complete key/immobilizer setup), virginizing clears the prior pairing. This is the answer for a module pulled from another vehicle that now needs to adopt yours.

Which one you need is a function of your exact situation — a failing original with good data leans toward the clone; a foreign module that has to join your car leans toward the virginize. We confirm the right path from your VIN and part numbers before anything ships, so you are not guessing.

VATS vs Passlock vs Global A — how to tell which you have

If the year ranges left you unsure, use behavior. These are the tells our bench sees most often:

• Resistor you can feel in the key. Look at the key blade. A VATS/PASS-Key key has a small dark pellet visible in the blade. If it's there and the car cranks-no-start with a lockout delay, you're in VATS territory.
• Ten-minute wait fixes it, for a while. If cycling the key ON and waiting for the SECURITY light to go out lets the car start, you are on Passlock/PK3. If that fix keeps coming undone, the lock-cylinder sensor is the suspect.
• No-start appeared right after a module swap. If the car started fine until a BCM, ECM, or cluster was replaced with a used or aftermarket unit, and it's a 2010-or-newer GM, you are looking at a Global A pairing problem — a clone or virginize case, not a relearn.
• Age. Pre-2000 GM is almost always VATS. Roughly 2000–2008 is Passlock/PK3 country. 2010-plus is Global A.

When in doubt, we confirm from the VIN and the module service numbers. That's the whole reason the intake step exists — so you ship the right part for the right procedure.

"The biggest mistake I see is people throwing a used module at a modern GM and expecting it to just work. On the older Passlocks you can relearn all day, but on a Global A truck a junkyard BCM will never start the vehicle until the security identity is sorted. Nine times out of ten the 'no-start' on my bench is a perfectly good part with the wrong identity in it — clone it or virginize it and the truck fires right up." — Independent GM electronics and locksmithing specialist, 17+ years on GM anti-theft platforms (anonymized)

The mail-in bench workflow

The point of a bench service is that you don't drive anywhere — you ship a module. The sequence is the same regardless of era:

1. Verify first. Text us your VIN, the module part / service number off the label, and a clear photo of that label, plus a short description of the symptom (cranks-no-start, SECURITY light behavior, what was replaced). We confirm your system (VATS / Passlock / Global A) and the right procedure before anything ships.
2. Provide proof of ownership. Anti-theft, immobilizer, and key work requires documented proof that you own the vehicle — title, registration, or equivalent. This is non-negotiable on every security job. You are also responsible for legal compliance for your vehicle and use.
3. Remove and ship the module. Once verified, pull the correct module and ship it to PO Box 120241, Arlington TX 76012 if you ship USPS — or 1168 W Pioneer Parkway, Arlington TX 76013 if you ship UPS or FedEx (UPS and FedEx cannot deliver to a PO Box). Pack it in an anti-static bag inside a padded box.
4. Bench read and archive. On arrival we power the module on a regulated bench supply, read its existing data, and archive it before any change — so there is always a known-good starting point.
5. Perform the procedure. VATS delete, Passlock delete/bypass, BCM clone, or Global A virginize, matched to your verified system.
6. Test and return. We confirm the module communicates on the bench, then ship it back with tracking via the flat-rate return option you chose at checkout (from $14.95). Return shipping is paid by the customer on every order.

A regulated bench supply is also simply a safer place to write a controller than a car with a marginal battery — a voltage sag mid-write is one of the classic ways an in-vehicle attempt bricks a module.

What a bench service does not do

Being blunt about scope prevents disappointment:

• It does not repair a mechanically failed starter, ignition switch, or wiring harness. If the engine truly does not crank, diagnose the starting circuit first — that is usually not the immobilizer.
• It does not cut or supply physical keys. A cloned or virginized module often still needs a locksmith to add or program keys to the vehicle.
• It does not override the proof-of-ownership requirement. Security work is only performed for the documented owner.
• It does not make an unsupported model magically supported. We confirm fitment first, every time, so you never ship a part we can't service.

Immobilizer and anti-theft delete work is offered for legitimate repair, restoration, off-road, racing, orphaned-platform, or already-mechanically-serviced applications where legally permitted. Software does not repair mechanical damage, and the customer is solely responsible for compliance with applicable local, state, and federal law.

Frequently asked questions

Why is my GM security light on and the car won't start? A lit SECURITY light with a crank-but-no-start almost always means the anti-theft system refused to authorize the engine, not that the engine is broken. Identify your system — VATS resistor key, Passlock lock-cylinder sensor, or Global A BCM pairing — because each is diagnosed and fixed differently, and many cases are a worn sensor or a mismatched replaced module rather than a mechanical fault.

How do I do the GM Passlock ten-minute relearn? Turn the key to ON so the SECURITY light illuminates, leave it for about ten minutes until the light turns off, then switch off; repeat the cycle up to three times for roughly thirty minutes total. This teaches the module the current sensor signal, but it only holds if the ignition lock-cylinder Hall-effect sensor is actually good — a worn sensor will fail again and needs repair or a bench-level delete.

What is the difference between VATS, Passlock, and Global A? VATS reads a resistor pellet in the key (mid-1980s to early 2000s), Passlock reads a Hall-effect sensor in the ignition lock cylinder (late 1990s to late 2000s), and Global A distributes immobilizer authority to the Body Control Module over a CAN network (roughly 2010 and newer). The eras overlap by a few years, so confirm by symptom: a resistor in the key means VATS, a ten-minute relearn means Passlock, and a no-start after a module swap on a modern GM means Global A.

Can I just delete the anti-theft system to fix the no-start? On older VATS and many Passlock vehicles, yes — the security check can be removed at the module level on the bench, eliminating the failure-prone sensor or resistor circuit entirely, which is the GM VATS delete at $150. On Global A vehicles the fix is different: you clone or virginize the module to correct its identity rather than deleting security, because the immobilizer is woven into the whole network.

My GM won't start after I replaced the BCM with a used one — why? On a 2010-or-newer Global A vehicle, a used BCM arrives carrying another vehicle's security identity, so your car refuses to authorize it and won't start even though the part is functionally fine. The fix is to clone your original BCM's data onto the replacement ($199) or virginize the used module so it can be freshly programmed into your vehicle ($150); confirm the right path with us from your VIN and part numbers first.

Do I need proof of ownership for anti-theft work? Yes — proof of ownership such as a title or registration is required for all anti-theft, immobilizer, and key-related work, without exception. This protects vehicle owners against theft-enabling misuse, and it is a standard, non-negotiable step on every security job we take.

The bottom line

A GM SECURITY light with a no-start is rarely a broken engine — it is an anti-theft system doing exactly what it was designed to do, and the fix depends on which of three eras your vehicle belongs to. VATS puts a resistor in the key and fails at worn contacts and column wiring, which is why the GM VATS delete ($150) is such a clean cure on older cars. Passlock/PK3 relies on a lock-cylinder Hall-effect sensor and gives you the ten-minute relearn — free when the sensor is good, useless when it isn't. Global A hands immobilizer authority to the BCM over CAN, so a replaced module needs its identity corrected with a BCM standalone clone ($199) or a Global A virginize ($150), not a relearn.

Identify your era, confirm by symptom, and remember that most of these no-starts are a good vehicle with a bad signal or a mismatched part. Every anti-theft job requires proof of ownership, software never repairs mechanical damage, and you are responsible for legal compliance. Text us your VIN and a photo of the module label and we'll confirm which system you have and the exact fix before anything ships.