You've assessed the systems. Nobody assessed what they could be used to do.
Most superyacht cyber risk assessments are thorough, professionally conducted, and focused on entirely the wrong question. They ask which systems could be compromised. They rarely ask what a determined attacker could actually do once they were.
That distinction is not a technicality. It is the difference between an assessment that maps your exposure and one that simply maps your systems.
The standard assessment process works something like this. A specialist is engaged. They review the network architecture, test for common vulnerabilities, examine patch levels and access controls, and produce a report graded by severity. Critical findings are remediated. Medium findings are scheduled. The report is filed. The owner is informed that the assessment is complete.
What the report rarely contains is a section that begins with the attacker rather than the system. That asks not "what could fail?" but "what could someone with patience, capability, and a clear objective actually achieve on this vessel?" The answer to that question is almost always more disturbing than the vulnerability list. And it is almost always absent.
Technology is the method. Consequence is the risk. An assessment that ends at the method has not finished the job.
What your assessment didn't look for
A superyacht is not a data centre. It is a vessel at sea carrying people, governed by systems that can be manipulated. Thrusters, stabilisers, navigation, fuel management, watertight door controls. The question is not whether these systems have vulnerabilities. Many do. The question is what a person who understood those vulnerabilities and had a reason to use them could cause to happen. A serious safety incident. A vessel behaving unexpectedly in difficult conditions. Harm to crew or guests that looks, initially, like mechanical failure. An assessment that does not model this outcome has not assessed the most serious risk on board.
The owner is on a call in the main saloon. It is early morning, the anchorage is quiet, and the conversation is about something that matters. The entertainment system is on standby. A personal device is connected to the vessel network. None of this feels like exposure. None of it registers as risk. Access was established eleven days ago. It has been logging ever since. Nobody needed to be watching.
The owner's movements, routines, health, relationships, and financial affairs are all, to varying degrees, legible from the systems on board. An attacker who is not trying to damage the vessel but to understand the owner has everything they need. The consequence is not a cyber incident in any conventional sense. It is surveillance. It is leverage. It is information in the wrong hands with no obvious moment at which it was taken.
This is the category most assessments do not name directly, and it is the one that carries the most serious legal and personal consequences. A superyacht regularly carries minors. Their presence, routines, physical descriptions, and movements are captured across multiple systems: security cameras, access logs, communications. The exposure of that data is not simply a privacy violation. In several jurisdictions it triggers mandatory notification obligations, regulatory investigation, and liability that no standard policy is designed to absorb. The assessment that does not identify this category of data, map where it sits, and model the consequences of its exposure is not complete.
For owners who are publicly known, the reputational dimension of a breach is often the most consequential and the least recoverable. Private communications, personal photographs, medical information, the details of relationships and business dealings conducted on board in the expectation of privacy. Once that material exists outside the vessel, its trajectory cannot be controlled. The incident response team can contain the technical breach. Nobody can contain the information. An assessment that does not model the specific reputational exposure of the owner, given who they are and what passes through this vessel, has not assessed the risk that will matter most.
For owners with active commercial lives, the yacht is where significant conversations happen. Not because they are careless, but because it is their home and they live in it. Board discussions, deal negotiations, sensitive commercial intelligence. The consequence of that information being exfiltrated is not a maritime incident. It is a business event with potentially serious financial and legal dimensions, and it will arrive without warning, often long after the vessel has moved on and the access that enabled it has been forgotten.
An attacker who understands your vessel is not planning to compromise your systems. They are planning to use your systems to achieve something else entirely.
Why the framing has not changed
The system-focused assessment exists because it is what the market has standardised around. It is auditable, deliverable, and comparable. It produces a report with findings, severities, and remediation timelines. It satisfies the insurance requirement, the flag state requirement, and the management company's due diligence process. It is, in other words, designed to be filed rather than to protect.
The consequence-led assessment is harder to produce. It requires genuine understanding of the owner's life, profile, and exposure, not just the vessel's architecture. It requires someone who can think like an attacker who has done their research, not just an auditor who has followed a checklist. And it requires a willingness to name uncomfortable things directly, including the specific personal consequences for specific people, rather than describing risk in the abstract language of vulnerability scores.
Most assessment processes are not designed to do that. They are designed to produce a document. The distinction matters because a document that makes you feel protected without having asked the hardest questions is not a neutral object. It is a source of false confidence, and false confidence is its own category of risk.
The assessment that makes you feel protected without asking the hardest questions is the most dangerous document on board.
The questions a complete assessment must answer
You do not need to commission a new assessment to know whether your current one has asked the right questions. Read it and look for the answers to these.
- Does the assessment model specific consequences for specific people on board, or does it describe vulnerability categories in the abstract?
- Does it identify where data about children and other vulnerable individuals on board is held, and what the legal and personal consequences of its exposure would be?
- Does it consider the owner's public profile and the specific reputational consequences of a breach, given who they are and what passes through this vessel?
- Does it begin with what an attacker could achieve, or with what systems could fail?
If the assessment you have does not contain answers to those questions, it has mapped your systems. It has not assessed your risk.
What a different kind of conversation looks like
Owners who have had this done properly describe a different kind of engagement from the outset. Less time spent on network diagrams and patch schedules, more time understanding the owner's life, their profile, the nature of what the vessel carries and who travels on it. The technical work still happens. But it happens in service of a prior question, which is: what is the worst thing that could occur here, for these people, given everything we know about this vessel and this owner?
That question changes what you look for. It changes which systems matter most. It changes the remediation priorities. And it produces a very different document at the end: one that is harder to read, more specific in its discomforts, and considerably more useful in the event that something goes wrong.
The standard assessment tells you what is broken. The consequence-led assessment tells you what is at stake. Both are necessary. Only one of them is currently being delivered.
At CyberPlus, we work with owners, captains, and close protection teams who want to understand where cyber and physical risk actually intersects on their vessel, and remove it without disruption or noise.
Our assessments begin with consequence, not systems. We work outward from the specific exposure of specific people, and we name what we find directly.
If you'd like to talk, you know where we are.
A risk assessment that stops at the systems has not yet asked the question that matters.