Shipsoc — Maritime Cyber Assurance for Fleet Vessels
Watch Desk online — 24/7/365 UTC 00:00:00
Shipsoc Maritime Cyber Assurance Book a fleet assessment →

I Fleet cyber monitoring

Every vessel, watched from berth to horizon.

Shipsoc keeps a shore-based watch over the IT and OT networks of your ships — detecting intrusions on board, correlating them across the fleet, and keeping class-ready evidence on file.

See what we watch → How the watch works
0
Vessels under watch
24/7
Duty analyst on station
<6 min
Median time to triage
423861 55748847 104°E105°E106°E107°E108°E 12°N11°N10°N09°N PORT ALPHAPORT BRAVO N MV ARCTURUS · NOMINAL MV VEGA · USB ANOMALY PV SENTRY · PATROL
Fig. 1 — Live fleet picture (illustrative) NominalAnomalyPatrol
MV Vega · bridge PC Unknown USB device detected — triaged by the watch desk. 06:12 UTC · escalated to Master

II Why it matters

A ship is now a floating data centre with a satellite dish for a perimeter.

Navigation, engine monitoring, cargo systems and crew internet increasingly share one network and one uplink. What was once an isolated machine is now reachable.

Without segmentation or monitoring
Crew
Wi-Fi
Flat
switch
ECDIS /
Engine PLC

A single phishing click on a crew laptop can be one hop from systems that keep the ship moving.

  1. 01
    Hazard · Flat networks

    IT and OT share the same water.

    Crew Wi-Fi, business laptops, navigation and machinery control often sit on one flat network, with firmware that has not been touched since commissioning.

  2. 02
    Hazard · Intermittent links

    The link comes and goes.

    VSAT and L-band connections drop, throttle and cost money per megabyte. Cloud-only tools go quiet exactly when a vessel is furthest from help.

  3. 03
    Hazard · Evidence gap

    Surveyors ask for evidence, not intent.

    Class societies and flag states increasingly expect documented cyber resilience — inventories, logs and incident records you can hand over on the day.

III Coverage

Five zones on board, one view ashore.

A passive sensor watches every network segment that matters. Hover a zone to follow the signal path from the cargo hold to the bridge and out through the satellite.

TO SHORE WATCH DESK ENGINE ROOM CARGO · BALLAST 1 2 3 4 5
  • 1

    Bridge systems

    ECDIS, radar, GMDSS and voyage data recorder networks watched for unexpected devices and traffic.

    Watches: new USB · rogue devices · config drift
  • 2

    Crew & admin network

    The most exposed segment — email, browsing and personal devices — separated from control networks and monitored.

    Watches: phishing · malware · lateral movement
  • 3

    Engine & machinery control

    PLC, alarm and monitoring traffic observed passively — never in-line with the control loop.

    Watches: Modbus · firmware drift · unauthorised writes
  • 4

    Cargo & ballast systems

    Loading computers, reefer monitoring and ballast control checked against a learned baseline.

    Watches: protocol anomalies · remote access
  • 5

    Satcom & network edge

    Firewall, VPN and uplink events correlated, with local queuing when the link drops.

    Watches: inbound scans · VPN misuse · link state

IV The watch

There is always an analyst on watch ashore.

We run the shore desk the way ships run the bridge: fixed watches, written handovers and a named duty analyst who owns every open incident until it is closed.

  • i.Six four-hour watches, every day of the year.
  • ii.A written handover at every change of watch.
  • iii.One duty analyst owns each incident from first signal to closed report.

V How it works

From engine room to shore desk, five waypoints.

Detection starts on the vessel and never depends entirely on the link back to shore.

  1. 01Onboard sensor

    Passive tap

    Mirrors traffic from bridge, engine and admin segments without ever sitting in-line with control systems.

  2. 02Edge triage

    Detects offline

    Rules run on the vessel, so a ship days from a signal still watches itself in real time.

  3. 03Satcom uplink

    Syncs when it can

    Compressed events queue locally and travel in small batches whenever bandwidth allows.

  4. 04Shore watch desk

    Fleet-wide view

    Analysts correlate across every hull, turning one ship's alert into the fleet's early warning.

  5. 05Response & record

    Contain, confirm, file

    Onboard isolation steps, shore confirmation and an evidence trail ready for your next survey.

VI What the watch includes

Built for hulls, not just hosts.

Maritime protocols, patchy links and class requirements shape every capability below.

01 — Detection

Intrusion detection for IT and OT

Onboard sensors tuned for the protocols ships actually speak, so a navigation or machinery anomaly is not lost in generic IT alerts.

NMEA 0183Modbus/TCPAISOPC UACAN busBACnetSNMP
02 — Edge

Offline-first analytics

Keeps detecting with no link at all, then reconciles the full timeline.

SatcomLink lost · queuingSyncing…
212 events held on board
03 — Correlation

Fleet-wide patterns

A signal on hull three warns hulls four to nine.

04 — Inventory

Asset inventory & drift

Every device tracked and diffed after each port call.

  • Switches14
  • Workstations22
  • PLC / OT devices9
  • New since last port+2
05 — Response

Same playbook, any hull

Containment and notification steps that run identically fleet-wide.

  • Isolate affected segment
  • Notify Master & DPA
  • Capture evidence
  • Confirm from shore

VII Fleet classes

One watch, every hull class.

Sensor placement and playbooks adapt to the vessel. The shore desk stays the same.

Container & bulk carriers

The widest surface on the water

Cargo, engine and crew networks under one segmentation model, with reefer and loading systems covered.

Tankers & specialised

Process-critical OT

Manifold and cargo-control networks monitored without ever sitting in-line, with zoned control mapping.

Offshore support vessels

Dynamic positioning & cranes

Positioning, crane and winch systems observed alongside bridge and crew networks, even on remote stations.

Coastal patrol & workboats

Edge-first, low bandwidth

Full anomaly coverage even when the link home drops for days, with local triage on board.

VIII Inside the console

What the duty analyst sees.

One fleet register — position, link state and open alerts for every hull — instead of a tab per vessel during an active incident.

Shipsoc fleet console — all vessels
164 / 168Sensors online
7Open alerts · 1 high
3Links degraded
VesselClassLast positionUplinkAlertsActivityLast sync
MV ArcturusContainer10°42′N 107°18′EVSAT012s ago
MV VegaBulk09°27′N 106°05′EVSAT1 high6s ago
MV AltairTanker11°03′N 108°21′EL-band · degraded04m ago
PV SentryPatrol10°12′N 107°48′E4G / VHF2 med9s ago
MV RigelOSV08°55′N 108°40′ELink lost212 queued3h ago

IX Standards

Evidence your surveyor can read.

Inventories, logs and incident records are produced continuously and mapped to the frameworks class societies and flag states already ask about.

Standards are named to show how evidence is mapped. A mapping supports your own compliance programme; it is not a certification.

IACS UR E27

Cyber resilience of onboard systems

Design and operational evidence for the systems the requirement covers, without manual paperwork.

IEC 62443-3-3

System security requirements

Control coverage mapped to the foundational requirements, with gaps surfaced as configurations change.

IMO MSC.428(98)

Cyber risk in the SMS

Records that support cyber risk management inside your Safety Management System.

BIMCO Guidelines

Cyber security onboard ships

Monitoring and incident records aligned to the guidance most owners already use.

X Questions

Before you set sail.

The questions masters, superintendents and IT managers ask first.

Does the sensor sit in-line with our control systems?

No. Sensors are passive: they mirror traffic from SPAN or tap ports and never sit in the control path, so a sensor fault cannot interrupt navigation, propulsion or cargo operations.

What happens when the satellite link drops?

Detection continues on board. Events are time-stamped, queued and compressed, then synced in small batches when bandwidth returns — the shore desk receives the full timeline, not a gap.

How much bandwidth does monitoring use?

Only compact event summaries leave the vessel by default. Raw packet data stays on board unless an analyst requests a targeted capture.

Can findings flow into our existing tools?

Yes. Alerts and incident records can be forwarded to your SIEM, ticketing or fleet-management systems using standard syslog, API or email integrations.

XI Set your course

Chart your fleet's cyber course.

Start with one vessel or the whole fleet. A fleet assessment gives you a clear picture before you commit to anything.

  • A network and asset review for a sample vessel
  • A gap map against IACS UR E27 and IEC 62443-3-3
  • A proposed sensor and watch plan, in plain English