From Compliance to Culture: Advancing Maritime Cyber Resilience at Sea

By Pete Rucinski – Managing Director, Assure Technical

Advancing maritime cyber resilience has never been more critical. In September, I had the privilege of joining a panel at Seatrade Europe in Hamburg to discuss “Cyber Security at Sea: A European Perspective”, alongside Ian Richardson from Nevetal and Željko Medić from Marlink Cyber. Together, we examined how the maritime industry can defend itself in an era of unprecedented connectivity, digitalisation, and automation.

Since that discussion, I’ve reflected on the wider implications of our conversation – particularly how the sector must evolve from treating cybersecurity as a compliance exercise to embedding it as a core part of vessel design, operation, and culture.

Cyber resilience at sea is not a static goal. It is an ongoing process that requires the alignment of people, processes, and technology across both information technology (IT) and operational technology (OT) domains.

The Human Element: Bridging Knowledge and Practice

While technology provides the backbone of defence, people remain its most crucial layer. Maritime operations are unique – crews are transient, multicultural, and often working with limited time and bandwidth for training. This creates a distinct challenge: how do we deliver consistent, practical, and relevant cyber awareness in an environment where turnover and operational pressure are constant?

Effective programmes must be concise, scenario-based, and aligned to real shipboard duties. Routine, drill-style training – for example, responding to a suspected phishing attempt or isolating a compromised navigation terminal – ensures cyber behaviour becomes instinctive.

At Assure Technical, our Maritime Cyber Consultancy service helps organisations develop this human layer of defence. We work with operators to design role-specific awareness programmes and integrate cyber into daily operations, ensuring that training reflects both regulatory expectations and operational realities.

By embedding cyber into the rhythm of shipboard life, crews build confidence, and cybersecurity ceases to be an abstract concept – it becomes part of seamanship itself.

Beyond Compliance: Security by Design and the Role of Standards

Standards such as ISO 27001, Cyber Essentials, and the IMO’s cyber risk management guidelines provide the framework for a resilient foundation. Yet certification alone cannot guarantee protection. Cyber threats evolve faster than policy, and attackers exploit the smallest oversight.

True resilience comes from security by design – integrating cyber principles into vessel systems and processes from conception, not retrofitting them once risks emerge. This includes:

• Segmentation of IT and OT networks to prevent lateral movement of threats.
• Deployment of intrusion detection systems designed for low-bandwidth maritime environments.
• Regular vulnerability assessments aligned to operational cycles.
• Configuration management ensuring patching can be achieved without disrupting navigation or safety systems.

For many operators, navigating these technical requirements can be daunting. This is where Maritime Cyber Baseline Certification provides a practical pathway. Developed by the UK’s Maritime & Coastguard Agency (MCA) in partnership with IASME, it offers a sector-specific framework that bridges the gap between compliance and operational resilience.

Assure Technical supports organisations through every stage of certification – from readiness assessment and evidence gathering to remedial action and ongoing improvement. For fleets seeking assurance that their cyber controls meet recognised maritime standards, this certification provides both compliance value and tangible risk reduction.

Controlled Simulations: Testing Real Resilience

Even the most robust systems and certifications are only as strong as the people and procedures supporting them. That’s why controlled cyber incident simulations are essential.

These exercises expose vulnerabilities that static audits cannot. By replicating a ransomware attack on a vessel’s bridge network or simulating GPS interference, organisations can assess decision-making, communication flow, and recovery time under realistic pressure.

At Assure Technical, we’ve seen how these simulations transform attitudes. They reveal how policies perform under stress and allow teams to adapt procedures to the realities of shipboard operation. The result is measurable resilience – not theoretical compliance.

Culture as the Ultimate Defence

Regulations and frameworks define the “what”. Culture defines the “how”. A truly cyber-resilient maritime organisation treats cybersecurity as integral to operational safety – not as a box-ticking exercise.

This cultural shift begins with leadership. Boards, superintendents, and captains must champion cyber resilience, allocate the right resources, and communicate its importance consistently. When leadership views cyber risk management as an enabler of operational reliability, that mindset cascades through the organisation.

Drawing parallels with health and safety is particularly effective. Both disciplines rely on awareness, accountability, and continuous improvement. Both protect lives and assets. And both succeed when they are embedded into daily behaviours, not confined to policy documents.

Designing for Tomorrow’s Risks

As vessels become more connected, the line between IT and OT continues to blur. Remote monitoring, predictive maintenance, integrated bridge systems, and autonomous technologies all expand the attack surface.

To safeguard future operations, we must embrace defence-in-depth, applying multiple protective layers across physical, digital, and human domains. Cyber resilience must be engineered into every component – from design specification to data handling procedures and vendor management.

This evolution demands collaboration. Shipowners, classification societies, system integrators, and training providers must align around common expectations and assurance models. The Maritime Cyber Baseline plays a pivotal role here, providing a clear and accessible benchmark for demonstrating due diligence to regulators, insurers, and clients alike.

Conclusion: A Call to Action for the Maritime Sector

The discussions in Hamburg confirmed one truth – advancing maritime cyber resilience at sea is no longer optional. It is essential for safe, efficient, and reliable operations.

Ships today depend on complex digital systems. A single weak link can disrupt navigation, delay voyages, or compromise safety. The industry cannot afford to wait for an incident to act.

Compliance frameworks are valuable, but they are only the starting point. Real resilience comes from action — from leadership, from training, and from embedding security into every process and design decision. Each day without progress increases exposure to risk.

At Assure Technical, we help organisations make this shift with clarity and confidence. Our Maritime Cyber Consultancy service provides tailored guidance to identify vulnerabilities, improve crew readiness, and align technology with regulatory and operational goals. Meanwhile, our Maritime Cyber Baseline Certification gives shipowners and operators a clear, achievable route to verified assurance.

Every hour at sea presents new cyber challenges. The most resilient organisations act now – before threats reach them.

Don’t wait for a wake-up call. Strengthen your cyber defences today.
👉 Contact Assure Technical to begin your journey from compliance to lasting resilience.

About the Author

Pete Rucinski is the Managing Director of Assure Technical, a leading UK-based cybersecurity provider delivering award-winning security testing, compliance, and consultancy services.

Before founding Assure Technical, Pete served as a Royal Navy Weapon Engineer. In that role, he was responsible for the operational readiness of advanced weapons, sensors, and communication systems. This experience gave him a first-hand understanding of mission-critical resilience and the discipline required to maintain it.

Today, Pete applies that expertise to help organisations manage complex cybersecurity risks in both marine and land-based environments. He brings a clear, practical perspective – one built on years of engineering experience and a deep understanding of operational technology.

Pete also sits on the Board of the International Maritime Cyber Security Organisation (IMCSO). Through this role, he supports the creation of global maritime cybersecurity standards and promotes best practice across the sector.

With his mix of naval engineering insight, commercial experience, and commitment to continuous improvement, Pete leads Assure Technical in helping clients strengthen their defences and build lasting cyber resilience.