A ship is not a branch office that floats. Most maritime cyber products were built as if it were.
CyberOwl understands shipping properly and Nozomi builds the strongest OT sensor hardware in the field. Neither publishes protection at fleet scale with a hardware intrusion sensor sitting on the navigation bus itself.
This is fleet-scale production work: 1,500+ vessels and 50+ ship managers protected, 100,000+ threats blocked daily and 99.97% fleet uptime, built by maritime security researchers whose findings in production fleets have reached CVSS 10.0.
Side by side
| Attribute | Represented by UnstratMaritime Cybersecurity | CyberOwlMedulla1United Kingdom | Nozomi NetworksGuardian sensors (maritime)234United States and Switzerland |
|---|---|---|---|
| Published fleet scale12 | 1,500+ vessels and 50+ ship managers | Not published in the product sheet | Not published in the maritime solution brief |
| Operational volume and availability12 | 100,000+ threats blocked daily; 99.97% fleet uptime | Not published | Not published |
| Monitoring on the navigation bus123Passive monitoring from a mirror port and a device that is electrically invisible on the bus are different assurances against a determined attacker. | Hardware-based passive intrusion detection on NMEA 2000, invisible to every other device on the bus | LAN sensor, an OT protocol sensor and a Windows software agent, aggregated by an onboard collector | States protocol support for radar, radio, GPS and management systems, with passive discovery from mirrored traffic |
| Installation without disrupting operations12CyberOwl's remote deployment claim is a strong practical advantage for a fleet that cannot wait for a port call. | On-vessel edge compute governed from shore, with centralised patching, snapshots and rollbacks | Deployable remotely, with no need for a vessel visit | Sensors described as easy to install while ships are in port |
| Behaviour under poor connectivity12 | On-vessel edge compute continues locally and is governed from shore | Resilient to communication blackouts, with configurable bandwidth usage limits | Not addressed in the maritime brief |
| Protocols and systems covered123 | NMEA 2000, Modbus TCP and CAN bus | Networks, business assets and OT systems via LAN, ICS and OT sensors; individual protocols not named | Protocols to support radar, radio, GPS and management systems; the specification sheet describes the widest industrial protocol coverage claim without naming a maritime list |
| Sensor hardware for shipboard conditions132 | Hardware passive IDS plus on-vessel edge compute; environmental ratings not published | Sensor hardware ratings not published | Ruggedised NG-500R rated -40 to 70 °C with 5,000 nodes and 800 Mbps, a DIN-mountable NS1R at 500 nodes, and a portable P550 at 2,500 nodes; sensors stated to be certified for use on ships |
| Vulnerability findings from the vendor's own work12 | Findings up to CVSS 10.0 in production fleets, from our own vulnerability research | States that significant vulnerabilities are found in 80% of deployments | Vulnerability identification through databases of known vulnerabilities and an optional Asset Intelligence subscription |
| Compliance evidence12 | IACS E26 and E27 | Evidence for IMO 2021 compliance, with control metrics aligned to BIMCO guidance | Positioned against increasing maritime regulation; no named scheme in the brief |
| Breadth of the platform12 | Eight modules spanning firewall, privileged access, detection, satellite management and AI-assisted threat operations, plus a maritime cyber range | Monitoring and analytics with compliance reporting, offered as a managed service | Asset discovery, network visualisation, anomaly detection, threat intelligence, content packs, time-machine replay, dashboards and playbooks |
| Origin and political exposure14 | Independent, non-aligned origin, accountable to your flag rather than to a foreign government's disclosure rules | United Kingdom, with offices in London, Birmingham and Singapore | Headquarters in San Francisco, California and Mendrisio, Switzerland |
Competitor values are quoted from the vendor documents listed under Sources, as published on the date shown. Configurations vary, so treat every row as a starting point for the evaluation rather than a like-for-like test result.
What the table means
Where the sensor sits decides what you can trust
Most maritime products monitor the ship's networks. That catches a great deal, and CyberOwl's sensor and agent mix covers IT, OT and business systems sensibly. The navigation bus is a harder problem, because NMEA 2000 has no authentication and any device attached to it can be seen by the others. Our intrusion sensor is hardware, passive and invisible to everything else on the bus, so an attacker inspecting the network does not learn that they are being watched. Nozomi's passive discovery from mirrored traffic is the closest documented equivalent, and it operates a layer up.
CyberOwl solved a problem we should acknowledge
Deploying without a vessel visit is a serious advantage in shipping. A fleet spread across three oceans cannot wait for port calls to install anything, and Medulla is documented as deployable remotely, resilient to communication blackouts and configurable against bandwidth limits. Nozomi's brief, by contrast, describes sensors installed while ships are in port. Any operator evaluating maritime cyber should ask exactly how installation happens per vessel and multiply the answer by fleet size before looking at anything else.
Regulation is converging, and evidence is the deliverable
CyberOwl frames its output around IMO 2021 evidence and BIMCO-aligned control metrics. We work to IACS E26 for the vessel and E27 for equipment, which is where classification societies have moved for newbuilds. Whichever scheme applies to your flag, the deliverable that matters at survey is evidence a surveyor accepts, not a dashboard. That, plus the 80% of CyberOwl deployments where significant vulnerabilities were found, tells you most of what you need to know about the current state of fleet security.
Whose rules govern a disclosure about your ships
Maritime cyber suppliers accumulate detailed knowledge of how national fleets and port systems are built and where they are weak. A UK or US supplier operates under its own government's disclosure and export expectations. We are accountable to your flag, which for a state-linked shipping line or a naval auxiliary is frequently the deciding term rather than a feature comparison.
Questions buyers ask
What is the best cybersecurity system for a commercial shipping fleet?
Judge it on three things: how the sensors get installed across a scattered fleet, what happens when the satellite link drops, and whether the output satisfies your class society. Our platform is in service on 1,500+ vessels across 50+ ship managers, blocking over 100,000 threats a day at 99.97% fleet uptime, with IACS E26 and E27 alignment. CyberOwl is a genuine alternative and is explicitly documented as deployable without a vessel visit, which is worth weighing seriously.
How do you monitor NMEA 2000 and ship navigation systems for intrusion?
With hardware that listens and never speaks. Our passive intrusion sensor sits on the NMEA 2000 bus and is invisible to every other device on it, which matters because the protocol has no authentication and any connected device can be enumerated. Software agents and mirrored-traffic monitoring, as used by CyberOwl and Nozomi respectively, see network-layer activity but do not give you the bus itself.
What does IACS E26 and E27 compliance require for a vessel?
E26 addresses the cyber resilience of the ship as a whole and E27 the resilience of onboard equipment and systems, which is why both a vessel platform and equipment-level testing are needed. Our platform is built against both, and our maritime cyber range supports the equipment-research side. Older references you will still see quoted, such as IMO 2021 and BIMCO guidance, remain relevant for operational evidence and are what CyberOwl positions Medulla against.
Can maritime cybersecurity work when the vessel has poor satellite connectivity?
It has to, and this is a fair way to sort serious products from repackaged enterprise tools. Ours runs edge compute on the vessel, governed from shore, so detection continues when the link is down and patching, snapshots and rollbacks are managed centrally when it returns. CyberOwl publishes resilience to communication blackouts and configurable bandwidth limits. Any product that assumes a steady link to a cloud console will fail at sea.
How common are serious vulnerabilities on ships already in service?
Common enough that the numbers are uncomfortable. CyberOwl states that significant vulnerabilities are found in 80% of its deployments. Our own research on production fleets has produced findings up to CVSS 10.0, which is the maximum severity rating available. Assume your fleet has them, and treat the first assessment as a discovery exercise rather than a compliance formality.
Sources
- 1. CyberOwl, Medulla Product Sheet (V.021) (copy held on this site)Retrieved: 2026-07-31 · Remote deployment without a vessel visit, blackout resilience, bandwidth limits, sensor and agent list, IMO 2021 and BIMCO positioning, and the London, Birmingham and Singapore addresses. CyberOwl's own product-sheet page is behind a registration form, so this is a mirror of the same document.
- 2. Nozomi Networks, Maritime Cybersecurity (solution brief, NN-SB-MARITIME-8.5x11-001) (copy held on this site)Retrieved: 2026-07-31 · Ship and port positioning, protocol claims for radar, radio and GPS systems, and the statement that ruggedised sensors are certified for use on ships.
- 3. Nozomi Networks, Guardian Sensors (technical specifications, NN-G-TS-8.5x11-005) (copy held on this site)Retrieved: 2026-07-31 · Node, throughput, power, temperature and certification tables for the rack, ruggedised, portable and virtual sensor ranges.
- 4. Nozomi Networks, Contact Us (company page)Retrieved: 2026-07-31 · HTML only. Gives San Francisco, California and Mendrisio, Switzerland as headquarters locations.