MARITIME / RESEARCH BRIEFING
The great
disconnect.
Who joins up cyber risk
across the fleet?
A reading guide to the 2022 report on maritime cyber risk management, with practical questions for the people responsible for vessels, suppliers, and recovery.
READ IN CONTEXT
This is a briefing on research published in 2022, first shared here in January 2023. It is not a current estimate of attack frequency, ransom costs, or fleet readiness. For later research, see the publishers’ report hub.
THE MANAGEMENT ISSUE
A fleet needs a shared picture of risk.
The Great Disconnect examines gaps between organisational responsibilities, supply-chain arrangements, and the way maritime cyber risk is understood. Its recommendations connect security governance with day-to-day operations.
The report was produced by Thetius, CyberOwl, and HFW. IIMS subsequently shared its findings. This distinction matters: the report is the primary research; the IIMS article is a useful summary.
KEY TAKEAWAYS
- Give responsibility for fleet cyber risk a clear home.
- Exercise the response with people ashore and at sea.
- Review supplier access and insurance before an incident.
FROM RESEARCH TO REVIEW
Four questions for fleet leadership.
The headings reflect the report’s recommendations. The prompts translate them into a management discussion; they do not replace a vessel-specific assessment.
01
Who owns the whole problem?
The report calls for dedicated fleet responsibility covering information technology and operational technology.
Ask next: can the responsible team obtain evidence from vessels and act on what it finds?
02
Have we rehearsed a realistic incident?
Its training recommendation includes practical incident exercises matched to the organisation’s people, systems, and working arrangements.
Ask next: when did vessel and shore teams last practise making decisions together?
03
What must a supplier demonstrate?
The report recommends minimum security standards before suppliers connect to vessel systems or access their data.
Ask next: who approves access, what is permitted, and how is that access withdrawn?
04
Do cover and response plans agree?
The report recommends reviewing insurance and obtaining specific legal advice on ransomware payments.
Ask next: have the broker, legal advisers, and response team checked the same assumptions?
USE THE REPORT IN A REVIEW
Start with one vessel
and one critical service.
Choose an operational dependency that matters to your fleet. Ask the people accountable for it to describe how a cyber incident would be detected, escalated, and managed.
Leave with an action record.
Capture the gap in evidence or responsibility, the person who will resolve it, and the date it will be checked. If an assumption depends on a supplier, obtain their answer rather than filling the gap on their behalf.
Keep the exercise proportionate to the vessel and its operating context. A general industry report cannot establish the security of an individual ship.
RESOURCE DESK
Read the evidence
in its original setting.
Keep the 2022 report separate from subsequent editions. Later reports may use different populations, methods, or measures.
Connect responsibility with operations.
CyberSolace can help you turn a broad cyber risk discussion into clearer responsibilities and practical response priorities.
SOURCE NOTE
The Great Disconnect — Nick Chubb, Patrick Finn, and Daniel Ng; Thetius, CyberOwl, and HFW, 2022. Report recommendations summarised with attribution; management prompts are CyberSolace commentary.
Originally published 18 January 2023. Editorial review 20 October 2026.