Digitalisation has made shipping more connected and efficient than ever. But that connectivity is creating new vulnerabilities at a time when the wider maritime security environment is becoming considerably less predictable.

For Thomas Nordberg of The Swedish Club, cyber risk can no longer be separated from that broader picture.

“I can’t really think of many topics or areas that are more important or relevant today,” he says.

The Swedish Club was an early mover in introducing cyber insurance and has since entered into strategic cooperation with CyberOwl and DNV Cyber, providing members with regular cyber threat and risk insights.

But cyber risk cannot be viewed in isolation. It is part of a much larger security environment in which geopolitics, physical threats and digital vulnerabilities are increasingly intertwined.

From benign conduit to contested domain

Nick Childs, Senior Fellow for Naval Forces and Maritime Security at the International Institute for Strategic Studies, has spent much of his career watching the international security environment evolve.

What he sees today concerns him.

“We are living in very dangerous times,” he says.

For much of the period following the Cold War, the maritime domain could be viewed as what Childs describes as a “benign conduit” for globalisation. Ships moved goods, shipping lanes connected economies and the rules governing international trade and navigation were broadly understood.

That picture has changed.

Commercial shipping is increasingly operating within a contested security environment. Conflict, pressure on critical maritime infrastructure and growing geopolitical competition all affect a sector that depends upon freedom of navigation and predictable international rules.

“We’re not just talking about maritime trade, shipping lines and shipping lanes, but also the broader maritime economy, undersea cables, the connectivity of that and the vulnerabilities,” says Childs.

For shipping, the significance is clear: cyber security can no longer be treated as a purely technical issue.

When breaking the rules becomes normal

Elisabeth Braw, Senior Fellow at the Scowcroft Center for Strategy and Security, sees another important shift.

“We are seeing in the maritime domain a decreasing adherence to rules,” she says.

Shipping is particularly exposed when accepted international norms begin to weaken. Vessels, cargoes and companies move constantly across jurisdictions and rely upon rules being understood and broadly respected.

Cyber activity fits naturally into this more uncertain environment.

A significant attack can be launched remotely, attribution may be difficult and the appropriate response is rarely straightforward. That creates scope for actors to test boundaries without necessarily provoking the kind of response associated with a conventional physical attack.

For Braw, the risk is a “broken windows” effect: when one actor sees another breaking rules without meaningful consequences, further rule-breaking becomes easier to contemplate.

In cyber, there are many opportunities to exploit that ambiguity.

The hybrid threat moves offshore

Niels Markussen, Director of NATO’s Shipping Centre, views cyber through the lens of hybrid warfare.

“Cyber is a huge part of the hybrid threat,” he says.

The concern goes far beyond somebody compromising an individual computer onboard a ship.

Shipping is part of a highly interconnected system involving ports, logistics, energy, financial services and communications. Disruption to one part of that network can quickly affect another.

“A lot of our supply chains are in private hands,” Markussen says. “Therefore we need to include the private sector in our redundancy and resilience planning.”

That creates a fundamental tension for shipping. Greater digitalisation and automation can improve efficiency and safety, but every additional connection also creates something that must be protected. Resilience therefore has to develop alongside connectivity.

Shipping cannot tackle cyber alone

There is a lesson here from previous security challenges at sea. Individual companies can strengthen their own defences, but industry-wide threats cannot be addressed effectively by organisations working in isolation. Childs believes cyber requires greater cooperation between commercial shipping, governments and security organisations.

Shipping companies understand their vessels, systems and operational vulnerabilities. Governments and intelligence agencies may have visibility of threats that individual businesses cannot see. Neither necessarily has the complete picture.

Braw argues that better intelligence-sharing could therefore become an important part of maritime cyber resilience. Intelligence agencies “see some things while shipping lines might see other things”, she says.

That does not mean sharing commercially sensitive information indiscriminately. But anonymised intelligence around new vulnerabilities, attack methods and emerging threats could enable the industry to react much faster.

Nordberg makes a similar argument from the insurance perspective. Increasing connectivity creates shared exposure, and that demands a more collective response. The challenge is building sufficient trust for useful information to move between organisations before the same weakness is exploited elsewhere.

Resilience starts with the basics

Against discussion of hybrid warfare and sophisticated cyberattacks, it can be easy to overlook the most basic defences. For Braw, one of the most important remains awareness.

“The best way to get in is by exploiting weaknesses,” she says.

Cyber awareness, training and strong digital hygiene can make those weaknesses considerably harder to exploit. That matters because many attacks facing owners and operators remain far more routine than the geopolitical scenarios attracting the headlines. Sophisticated threats should not distract companies from vulnerabilities they can control.

Markussen makes the same point about resilience.

“You need to be on top of these and testing your security all the time,” he says.

Cybersecurity cannot be treated as a one-off exercise. Technology changes, systems change and attackers change their methods with them. Preparedness therefore has to be continuous.

A collective responsibility

The maritime cyber landscape is becoming more complex at the same time as the wider rules-based security environment is becoming less predictable. That combination creates a difficult challenge for shipping. Yet it also makes the response clearer. Companies need stronger cyber awareness and resilience internally, while the industry needs better cooperation and information-sharing externally.

For Nordberg, no shipowner, insurer, technology provider or government can address the threat alone. Shipping has learned before that collective security problems require collective solutions. As the boundary between physical and digital security becomes increasingly difficult to define, that lesson is becoming relevant once again.