12 August 2026
The vessel is a plant that leaves its experts behind
A merchant or naval vessel runs on operational technology that would be recognisable in any refinery: propulsion and steering control, power management, ballast and cargo handling, navigation, and the integrated bridge that ties them together. The difference is geography. When something goes wrong at a fixed plant, a specialist can be on site within hours. When it goes wrong six hundred miles from the nearest port, the ship's company is the entire response team, and satellite connectivity to shore may be the very thing an attacker has degraded. Design for that isolation first, because it is the condition that makes maritime OT genuinely different, not the equipment.
Where the systems actually connect
Most owners underestimate how connected their ships already are. Navigation and machinery systems that were once islands now share networks, exchange data with shore for performance monitoring, and accept vendor updates over satellite links. The recurring exposures are familiar: flat networks where the ECDIS and the engine control share a segment with crew Wi-Fi, standing remote-access accounts left open by an integrator after sea trials, and USB media carrying chart and software updates between the bridge, the engine room and personal laptops. A ship's real attack surface is rarely the one on the network diagram, because the diagram was drawn at handover and the wiring changed on the first voyage.
Segmentation that survives a rotating crew
The defensive core is architectural and has to work without a resident security engineer. Separate the safety and propulsion networks from everything a crew member might plug a phone into, with controlled conduits and no default trust between zones. Broker vendor remote access so it is time-limited, logged and switched off by default rather than always listening. Discipline removable media through defined, scanned transfer points. Then build monitoring that runs on the ship and does not assume a live link home, so an anomaly in the machinery network is noticed by the crew on watch rather than by an analyst ashore who cannot see the vessel at all.
Procedures for the moment the screens lie
The decisive capability is human and rehearsed. A ship's company that can revert to manual steering, run the plant from local panels, navigate without a trusted electronic chart, and recognise that instruments are being manipulated has removed most of an attacker's leverage at sea. That means drills, not binders: crews who have practised operating through a suspected compromise, and standing orders that say what to isolate and who to call when the connection to shore is exactly what cannot be trusted. Cyber resilience on a ship is a seamanship problem as much as an IT one.
What this means for shipowners and naval operators
Securing a ship's OT is really about designing for isolation, because the vessel carries its problems to sea while its experts stay ashore. The advantage goes to owners who segment safety and propulsion networks from anything a crew member can plug into, broker vendor access so it is off by default, discipline removable media, and run monitoring that does not depend on a satellite link staying up. None of that matters without crews rehearsed to operate through a compromise: manual steering, local control, navigation without a trusted chart, and clear standing orders for the moment the screens can no longer be believed. Write these requirements into newbuild and refit contracts rather than retrofitting them under audit pressure later. Sourced through one accountable channel, with localisation and crew training scoped per programme, subject to export controls and end-use approvals, the result is a vessel that keeps its mission when it is alone with the problem.
