Of all the equipment on board a modern cruise ship, a golf simulator might seem an unlikely place to begin a discussion about seaworthiness. For ethical hacker Ken Munro, however, that is precisely the point.

His team was carrying out a penetration test when it found that the simulator’s PC was connected through a third-party network segment. A series of misconfigurations allowed the testers to move from there into the vessel’s business network — and eventually towards one of the ship’s high-value assets: the voyage data recorder.

“If that’s not operational, there’s a problem around seaworthiness. Someone really hadn’t thought about how that system was put together.” says Ken.

The story sounds extraordinary until Ken starts listing what else he has encountered: an auto-playing piano in a cocktail bar that interacted unexpectedly with a stage lift; an emergency generator system that could be disabled through a new IP connection; weaknesses affecting fire zones and power supply; bridge systems accessible from a laptop elsewhere on the vessel; and passwords that offered little protection at all.

The common thread is not the golf, the piano or any single piece of equipment. It is connectivity.

A ship full of connections

Ken, a physicist by training and cybersecurity specialist since the mid-1990s, is Managing Partner at Pen Test Partners. His job, as he puts it, is to find the bugs before the bad guys do.

That job has become more complicated as ships have become more connected. VSAT and, more recently, Starlink have brought major operational benefits. They have also connected systems that were never conceived as part of an internet-facing environment.

“We’re connecting vessels and systems that were never designed to be connected — because they weren’t built with connectivity, cybersecurity was an afterthought.”

For an ethical hacker, the task is to discover where those connections lead without disrupting the ship. Documentation helps when it is accurate. Often, Ken says, it is not.

“You have to go and explore the ship — half the time no one is really sure what the systems do.”

His team looks at what systems are connected to, what they depend on, what data they share and consume, and what happens when they receive something unexpected. ECDIS and VDR may be obvious areas of interest, but the same questions can extend all the way to the sewage treatment system.

The first defence: know your own ship

For owners, Ken’s first recommendation follows directly from that experience: know what you have on board. That is harder than it sounds. Every vessel is different. Even sister ships can diverge as equipment is replaced, engineers troubleshoot problems and new functionality is added. A ship that left the yard with a strong security configuration may look very different six months later.

Then there are the connections that sit beyond the owner’s immediate view. Equipment manufacturers increasingly use remote telemetry so that problems can be diagnosed and fixed at sea. The operational benefit is obvious; the cyber question is whether those connections were built securely.

“Third parties often have access to systems, and they may not have told you about it.” Ken explains.

Ken says his team has found engine interfaces exposed on the internet. Owners therefore need to be prepared to ask suppliers awkward questions: who can connect, how, and with what safeguards?

A maintenance problem, not a one-off project

There is another uncomfortable lesson from Ken’s work: cyber protection has no finish line. Traditional engineering instinct can say that if equipment is working, leave it alone. Cybersecurity behaves differently. New vulnerabilities are discovered; patches are released; configurations change. Security can deteriorate even while the underlying equipment continues to perform its normal function.

“Just as an engine wears and needs maintenance, your cyber systems need maintenance too.”

Ken cites a vulnerability in iDirect software that was subsequently exploited against vessels in the Strait of Hormuz. The vulnerability had been disclosed and fixed by the manufacturer, he says, yet some operators had not applied the update more than a year later. For an attacker, that turns an old vulnerability into an easy opportunity.

The incident nobody wants to admit

Better maintenance is only part of the answer. Ken also wants shipping companies to talk to each other more openly about attacks.

He understands the hesitation. No operator wants to announce that it has been hacked. But if one company explains how an attacker got in, another can look for the same weakness before it is exploited. Repeated across the industry, that knowledge becomes a collective defence.

“Everyone’s been hacked — it’s just that no one’s talking about it.” he says.

From a cyber problem to a shipping problem

Ultimately, Ken’s concern is not cybersecurity for its own sake. It is what happens when a digital weakness reaches a system that matters to the safe operation of the vessel.

He focuses particularly on high-value assets: the emergency generator, voyage data recorder and ballasting system among them. If one starts behaving strangely, the immediate challenge may be determining whether the cause is an ordinary technical fault or malicious interference. And once a cyber incident affects whether a vessel can sail, the questions extend beyond IT.

“If through a cyber incident my voyage data recorder is not functioning and I can’t set sail, where does that liability sit?”

The technology provider? The owner or operator? A failure to update? A crew member who bypassed a security feature? Ken sees considerable complexity — and the potential for important legal test cases.

It is also why he warns against treating any cybersecurity specialist as automatically qualified to test a ship. Maritime operational technology, propulsion and navigation systems require specialist understanding, because an over-aggressive penetration test can itself create an operational problem.

“It’s all very well hiring an ethical hacker, but if they break your system like a real hacker, that’s a really bad day.” says Ken.

The golf simulator is funny because it sounds so improbable. But its lesson is serious: on a connected ship, the cyber risk may not begin where anyone expects. Finding it starts with understanding what is on board, how it is connected, who can reach it — and how that picture changes over time.