Connected Vessel Risk Review

What we did

• We designed a black-box assessment without supplied credentials or internal network details. A focused plan covered the vessel's information technology and operational technology networks, approved physical areas, and employee email defenses. Testing followed NIST technical assessment guidance and relevant IMO maritime cyber-risk guidance while staying within the agreed onboard window.
• We mapped reachable systems and services, then used targeted scanning and controlled validation to investigate the most important exposures. The assessment confirmed weaknesses involving network access, wireless security, passwords, privileged accounts, outdated software, and separation between business and operational systems. High-impact testing was limited where exploitation could affect the vessel's live environment.
• We reviewed physical protections in the approved equipment area and security settings on onboard workstations. Unsecured infrastructure, exposed credentials, and permissive device settings showed how physical access could weaken digital controls. We tied each observation to practical measures such as tighter equipment access, safer startup settings, and stronger account handling.
• We ran a controlled spear-phishing exercise to assess both email filtering and employee response. The campaign showed that automated defenses did not stop every realistic attempt and that account safeguards needed improvement. The findings supported recommendations for multifactor authentication and focused awareness training.
• We delivered a detailed findings package that connected technical, physical, and human risks with specific corrective actions. Recommendations covered network separation, software updates, password and administrative access controls, physical safeguards, multifactor authentication, and phishing readiness. This gave the operator a clear record of verified issues to guide remediation and future testing.