When did you last
really know?
What is happening on that vessel.
The most vulnerable system on your vessel isn't connected to the internet. It's connected to someone who is.
The engineer who commissioned your engine management system retired two years ago. The manufacturer's support team still has remote access credentials issued during installation. The crewing agency that supplied your last chief officer used a shared portal to coordinate the handover. The previous chief officer's device cached the network credentials before he signed off. None of these are incidents. None of them appear in any audit report. All of them are unlocked doors.
This is not a story about negligence. It is a story about accumulation. Commercial maritime has spent three years building compliance frameworks and achieving cyber notation. What it has built, largely, is a documented account of its security posture at specific points in time. The vessels kept moving. The threat surface kept growing. The documentation stayed where it was.
What the industry got right, and what it missed
IMO 2021 was a genuine step forward. Requiring shipping companies to incorporate cyber risk management into their safety management systems created accountability where none existed. BIMCO guidelines gave operators a practical framework. Class society notation schemes gave owners and charterers a signal to point to.
The problem is structural, not intentional. Compliance frameworks are designed to be auditable. Auditable means measurable at a point in time against defined criteria. Cyber risk is not a point-in-time problem. It is a continuous, dynamic condition that changes every time a vendor connects remotely, every time a crew rotates, every time a vessel integrates with a new port system, and every time a software update is applied or not applied somewhere in the stack.
The gap between what compliance measures and what security requires is where commercial maritime cyber risk actually lives.
What we actually find
Engine management, cargo handling, ballast control, dynamic positioning. These systems are often proprietary, updated on manufacturer schedules, and accessed remotely by vendor engineers under service agreements that predate any meaningful cyber governance framework. When we ask for a current register of active vendor remote access sessions, it rarely exists.
Every port call creates bilateral system connections such as cargo management, customs, bunkering coordination, pilot systems. The vessel's team assumes port-side systems are the port's responsibility. The port assumes vessel-side systems are the operator's responsibility. The integration point itself, where data and instructions move between them, is governed by neither. Port and terminal environments are among the most actively targeted in maritime, precisely because this governance gap is so consistent.
Each rotation is, from a security standpoint, a partial access revocation and re-provisioning event that most operators do not treat as such. Accounts persist. Cached credentials remain on personal devices. Shared passwords survive the individuals who created them. The enterprise IT world addressed this problem systematically over a decade. Commercial maritime, with its multi-flag crews and multiple crewing agencies, has largely not.
Cyber risk assessments, network diagrams, and security procedures are produced at a point in time and filed. Vessels change continuously. The documentation rarely keeps pace. When we map the actual architecture of a vessel against its filed security documentation, the divergence is almost always significant. A crew attempting to contain a cyber incident using a network diagram that no longer reflects reality is working blind.
Most operators now have documented cyber incident response procedures. Very few have tested those procedures under conditions that reflect how incidents actually unfold: across multiple systems simultaneously, with communications potentially degraded, and with crew who have not rehearsed their roles recently. A plan that has never been tested is a hypothesis, not a capability.
Why the risk stays invisible
Regulatory reporting thresholds mean many incidents never require formal disclosure. Multi-party ownership and management structures (owner, technical manager, commercial operator, charterer) mean that no single party has complete visibility of the vessel's security posture, and no single party bears unambiguous responsibility for surfacing the full picture.
The designated person ashore carries personal accountability for the safety management system under the ISM Code. Cyber risk sits within that accountability whether the DPA is comfortable with it or not. In most cases they are managing that accountability with incomplete information, inherited documentation, and no independent means of verifying what they are being told about the vessels in their fleet. That is not a sustainable position.
Four questions for your fleet security team
You do not need a full assessment to establish whether the gap is real. Ask four questions and listen carefully for hesitation in the answers.
- When was the OT network on each vessel last independently mapped against its current configuration and not its original installation documentation?
- Who has active remote access to your vessels right now, across all vendors and service providers, and how is that access monitored in real time?
- When did you last run a cyber incident response exercise that tested vessel crew, shore-side teams, and communications simultaneously under realistic degraded conditions?
- If a cyber incident were declared on one of your vessels tonight, who is the first call, what do they do in the first hour, and when did they last rehearse it?
If any answer requires more than a few seconds of thought, that hesitation is worth taking seriously.
At CyberPlus, we work with fleet operators, technical managers, DPAs, and shore-side security teams who want to understand the real distance between their documented posture and their actual one, and close that distance without operational disruption.
Where remote expertise and on-vessel eyes need to connect in real time, we deploy Vision+, our secure collaboration platform, without introducing new risk to do it.
If you'd like to talk, you know where we are.
The fleet that runs on schedule and reports no incidents is not necessarily well-protected. It may simply not yet have encountered the consequences of what it doesn't know.