Securing Nuclear-Powered Shipping: Maritime Cybersecurity at the Heart of the NEMO Workshop

The maritime sector is entering a new era. As the potential of nuclear energy at sea moves closer to reality, the maritime cybersecurity challenges facing vessel operators, regulators, and technology providers grow ever more complex. Nowhere is this more evident than in cyber resilience – a domain that underpins every element of modern maritime operations.

At the recent NEMO Security-by-Design Workshop, hosted by Lloyd’s Register in London, Assure Technical’s Pete Rucinski delivered a keynote session on managing cyber threats in the maritime environment. His presentation made clear that cyber resilience is not simply a compliance issue. It is a strategic enabler for safe and secure maritime innovation.

A Shifting Maritime Threat Landscape

The cyber threat to shipping has matured rapidly in recent years. Modern vessels are no longer isolated assets. They are complex, connected platforms, exchanging continuous data with ports, suppliers, regulators, and global partners. While this connectivity supports efficiency and safety, it also introduces new vulnerabilities.

Attackers have already demonstrated intent and capability. Incidents include:

• Ransomware against shipping majors, leading to port closures and financial losses in the hundreds of millions.
• GPS spoofing and jamming, disrupting navigation in congested waters.
• Manipulation of cargo management systems, with potential knock-on impacts for safety and international trade flows.

For vessels powered by nuclear energy, the stakes are even higher. Beyond commercial loss, a successful cyber attack could carry strategic and geopolitical implications. Pete emphasised that cyber resilience in this context is not optional – it is a cornerstone of maritime security.

Technology as a Security Enabler

Pete stressed that technology, when intelligently deployed, is central to resilience. Yet he warned against viewing cyber controls in isolation. They must be integrated into broader security and operational frameworks.

He outlined four technical priorities:

1. Situational awareness – Continuous monitoring through Security Information and Event Management (SIEM) platforms and OT-aware network monitoring tools. These provide early detection of anomalies and support rapid response.
2. Network segmentation – Clear separation of operational technology (OT) and information technology (IT) environments. This prevents compromise in administrative systems cascading into safety-critical control networks.
3. Zero Trust principles – Verification of every user and device, regardless of network location. Strong identity and access management reduces insider threats and limits lateral movement by attackers.
4. Automated response capabilities – Embedded intrusion detection and incident response tools capable of containing threats at machine speed. In a maritime nuclear context, the ability to respond before human intervention can be decisive.

Convergence of Physical and Digital Security

One of Pete’s key insights was that physical and digital security cannot be separated. The manipulation of an access control system is both a cyber intrusion and a physical breach. Similarly, the compromise of a vendor’s supply chain may deliver vulnerabilities in both software and hardware.

This convergence demands integrated risk management. Crew training, port processes, and vendor assurance must operate alongside technical controls. Maritime security culture must evolve to treat cyber risk with the same seriousness as traditional physical threats.

Security by Design: From Principle to Practice

The strongest message from Pete’s session was that security must be engineered in from the outset. Retrofitting controls to legacy systems can only ever provide partial mitigation. In contrast, a security-by-design approach embeds resilience into ship and port systems from day one.

This involves:

• Conducting threat modelling and design basis threat assessments during concept design.
• Engineering defence-in-depth architectures into vessel networks.
• Applying vital area identification and zoning to protect safety-critical functions.
• Integrating cyber and physical security requirements into procurement and vendor contracts.

This aligns with NEMO’s wider goals: embedding resilience into the DNA of nuclear-enabled maritime systems. It also reflects Assure Technical’s ethos – that compliance is not enough. True security is achieved when systems are designed to resist real-world adversaries.

Assure Technical’s Perspective

The workshop reinforced a critical truth: cyber security is no longer peripheral. It is fundamental to maritime safety, resilience, and international trust.

As Pete highlighted, collaboration between regulators, operators, vendors, and states will be essential. Standards will evolve, but industry must not wait for regulation. Proactive adoption of best practice, informed by real-world threat intelligence, is the only way to keep pace with adversaries.

Technology, used well, is not only a shield but an enabler. It gives operators confidence to innovate, regulators assurance that risks are managed, and the wider sector a foundation for safe deployment of nuclear energy at sea.

Speaker Bio: Pete Rucinski

Pete Rucinski is a recognised authority on maritime cybersecurity. At Assure Technical, he leads cyber resilience strategy, helping operators, shipyards, and technology providers embed robust controls into operations and system design.

He also serves on the board of the International Maritime Cyber Security Organisation (IMCSO), where he contributes to the development of global standards and industry-wide collaboration.

Pete’s career spans both defence and commercial shipping. He has designed secure maritime architectures, advised on complex OT environments, and led incident response in high-consequence sectors. His insight, informed by frontline experience and international engagement, positions him as a leading voice on the future of maritime security.

Building on Our Maritime Expertise

At Assure Technical, our expertise extends across the full spectrum of maritime security. We understand the interdependence of cyber resilience, operational safety, physical protection, and regulatory compliance. This allows us to deliver solutions that are technically rigorous, operationally viable, and internationally recognised.

Our work with shipowners, ports, and regulators places us at the cutting edge of maritime security. We help clients anticipate emerging risks, not just react to them. By applying security-by-design principles, we ensure that systems are not only compliant but genuinely resilient.

As nuclear power moves into the maritime domain, the need for trusted expertise has never been greater. If you would like to learn how our maritime cyber security services can strengthen your operations, safeguard your assets, and provide assurance to regulators and stakeholders, please contact the Assure Technical team.