A vessel can meet every cybersecurity requirement and still be unprepared for a real attack.

Maritime cybersecurity has long focused on prevention and compliance. But as vessels become more connected, the question is what happens when those defences fail?

Cyber resilience goes beyond technology. Owners and managers need to understand who is responsible, which systems are critical and whether their response plans will hold up during an incident.

The real test is whether a fleet can continue operating safely when the systems it depends on are compromised.

A vessel can hold every certificate and still lose navigation or cargo systems in a cyber incident. That gap is the heart of Zenon Oratis’s argument, and it reaches well beyond the IT department.

Oratis, Senior IT Director at InterMaritime Ship Management, says the industry has put its effort into prevention. “Resilience is the ability to function throughout a cyber incident, and this is still less mature than prevention,” he says. IMO requirements have pushed owners to spend more, and IACS UR E26 and E27 have introduced cyber resilience requirements for newbuilds from July 2024. He is clear that this is not enough: “Passing a TMSA or class review doesn’t mean you’d withstand a real incident.”

Connectivity raises the stakes. With Starlink and other always-on links, “a vessel is no longer intermittently connected, it’s effectively an always-on branch office”. Shore-side threats now reach the ship in real time. Vendor access, service engineers, USB updates and crew devices all create routes in, and systems never designed to be networked are now reachable. An incident touching navigation or cargo becomes “a safety issue, not just an IT issue”.

For shipowners the sharper point is accountability. Oratis says much of it should sit with the manager, while the owner keeps commercial responsibility. His warning is blunt: “Too often the owner assumes the manager has it covered without ever confirming what that actually means.” The same applies to vendors. A firewall or a SOC can be outsourced but the risk decision cannot.

Map what is on board and who can reach it. Separate crew, business and OT networks. Time-bound and log vendor access. Then rehearse a fleet-level response plan, including the loss of systems mid-voyage, because “Resilience is proven in the drill, not the policy document.”

He expects cyber requirements to feature more in newbuild specifications, insurance and chartering decisions. Owners who have not confirmed what their managers actually do may find out at the worst moment.

When the weather changes, who makes the final call?

How should operators respond when forecasts are uncertain, every route carries risk and the safest option means arriving late or burning more fuel?

In our latest See Further webinar with OneOcean, Capt. Harpreet Singh of Suisse Atlantique and Peter Turner of OneOcean explored how weather risk affects decisions across the voyage.

The discussion covered master authority, commercial pressure, crew fatigue, weather-routing technology, voyage optimisation and the limits of forecasting.

It also examined a recurring challenge: giving masters the information and organisational support to make the safest decision when operational and commercial priorities do not align.

» Watch the webinar on-demand «

ABS urges shipowners to model crew workload before automating vessels
Can shipowners reduce bridge crews without increasing risk? ABS examines how human performance modelling can test staffing, workload and automation decisions before new systems enter service.

Klaveness marks 80 years with digital services and lower-carbon shipping
How can digital tools improve shipping beyond the vessel itself? Klaveness has built a software business around supply chain coordination and freight decisions while pursuing fleet efficiency.

TMS Cardiff Gas secures digital engine monitoring for LNG carriers
TMS Cardiff Gas has signed a service agreement covering six dual-fuel engines across three LNG carriers, with WinGD providing remote monitoring, troubleshooting and engine optimisation.

Eastern Pacific Shipping joins India-EU green corridor coalition
Can India and Europe align green fuel supply, port infrastructure and shipping demand? Eastern Pacific Shipping has joined a coalition assessing the feasibility of a green shipping corridor, bringing expertise in ammonia transportation and fuel use.

Wagenborg launches EasyMax vessel with alternative-fuel flexibility
Wagenborg has launched Abelina Wagenborg, the first EasyMax 2.0 vessel, designed for low fuel consumption and compatibility with methanol, ammonia and LNG.

ENPASA upgrades tanker connectivity to support digital operations and crew welfare
ENPASA reports more stable ship-to-shore communications and faster ECDIS updates after installing Inmarsat NexusWave on two tankers, while giving crews unlimited data access.

» Secure your Delegate Pass «

» Register your Interest «

Leading a Publicly Traded Shipping Company Through Turbulent Times with Tom Lister

In one of our most popular recent episodes, Tom Lister, CEO of NYSE-listed Global Ship Lease, explains how mid-size container ships underpin global trade through flexibility and optionality. The conversation explores shipping cycles, capital discipline, geopolitical disruption, and decarbonisation uncertainty, showing how leasing models and operational pragmatism help navigate volatility in an increasingly complex logistics environment.

Singapore’s proposed MPA Act amendments would expand regulatory powers over maritime cybersecurity, AI and autonomous vessels.