In an increasingly connected maritime industry, cyber resilience has become as fundamental as connectivity itself. Shipowners and operators are no longer asked whether they need cyber protection, but whether they can trust the digital infrastructure supporting critical operations at sea.
A ship’s physical isolation at sea once provided an inherent buffer against cyber threats. Today, that isolation has disappeared. Modern vessels rely on connected applications for navigation, engineer performance, remote diagnostics, business operations and crew welfare, creating significant operational advantages while also expanding the potential attack surface.
The numbers reflect this growing challenge. In DNV’s Maritime Cyber Priority 2024/25 report, 31% of maritime professionals said their organisation had suffered at least one cyber-attack in the preceding year, up from 17% over the previous five years.
Yet it is not only the frequency of attacks that is increasing. Cyber threats have become more sophisticated and operationally relevant, disrupting everything from business-critical communications and shore-to-ship workflows to remote access into vessel systems.
Recent geopolitical tensions have added another dimension. The International Maritime Organization has expressed particular concern surrounding an increase in navigation system interference, such as spoofing and jamming attempts. These attacks compromise navigational confidence and pose a direct risk to operational safety.
Recognising that maritime assets can no longer rely on isolation for protection, regulators have in recent years moved to instil a risk-management, governance-focused mindset across the industry.
As digitalisation accelerates, the industry has recognised that cyber resilience must be designed into the vessel’s digital infrastructure from the outset. IMO 2021 embedded cybersecurity within ship safety management systems, laying a foundation for the International Association of Classifications’ (IACS) Unified Requirements (URs) E26 and E27 to push shipping towards a ‘secure-by-design’ philosophy.
The IACS URs E26 and E27 offer an easy-to-follow blueprint for building cyber-resilience into the design of a newbuild ship and its onboard systems. The challenge is that most fleets are mixed. Operators manage vessels of different ages, with varying levels of digital maturity, different onboard systems and crew possessing different levels of cybersecurity expertise. Delivering effective protection across an entire fleet therefore requires a practical, managed approach that works consistently regardless of vessel type or onboard technical capability.
Increasingly, this is changing how operators evaluate connectivity providers. Connectivity is no longer assessed solely on bandwidth or coverage. It is judged on whether it can provide the resilience, security and operational confidence needed to support increasingly digital vessel operations.
Independent verification is becoming equally important.
Recently, Inmarsat Maritime’s NexusWave became one of the first fully managed maritime connectivity services to receive Cyber Security Type Approval from ClassNK, confirming that its onboard ICT architecture complies with the latest IACS UR E27 (Rev.1) cyber security standard. Importantly, the assessment extended beyond individual hardware components to evaluate the entire onboard architecture, service orchestration and managed connectivity platform as an integrated system.
The certification provides independent validation that cybersecurity has been built into the service from the ground up, rather than being added later through standalone security products. For shipowners investing in long-term digital infrastructure, it offers confidence that their connectivity platform has been independently assessed against the latest international cyber standards.
This secure-by-design philosophy is reflected throughout NexusWave.
The multi-network bonded connectivity solution integrates protection throughout the network architecture. Enterprise-grade, end-to-end AES-256 encryption secures data both in transit and at rest, while packet splitting across multiple network paths enhances both privacy and resilience. Deep packet inspection actively identifies and blocks malware and suspicious activity. Crucially, the service also provides network segregation, ensuring that crew, business, and operational traffic remain isolated to prevent the lateral spread of cyber-threats.
The result is a managed security posture that reduces operational complexity while helping maintain business continuity.
As maritime digitalisation continues to accelerate, cybersecurity will increasingly determine how confidently operators can adopt new technologies, connect critical applications and comply with evolving regulations.
By combining independently verified secure-by-design architecture, managed connectivity, advanced threat protection and crew awareness, Inmarsat Maritime is helping shipowners and operators move beyond compliance towards operational confidence. In today’s maritime environment, cybersecurity is no longer an optional add-on; it is an essential foundation that allows digitalisation to deliver on its full promise.