DNV: cyber risk appetite in maritime grows despite recognition of increased threat

In a survey of hundreds of maritime professionals about digitalisation and cyber risks, around 61% of respondents said the industry must accept the increased cyber risk from digitalisation if it enables innovation and new technologies.  

The maritime sector’s appetite to taking on emerging risks arising from digitalisation is notably higher than other critical infrastructure industries including energy, manufacturing and healthcare. 

Of the almost 500 maritime professionals surveyed by Norwegian class society DNV, 71% said leaders of their organisations consider cyber security to be the greatest risk their business faces. 

Shipowners, operators, managers, ports and the entire maritime value chain are increasingly reliant on more connected digital technologies as the industry transforms to become greener, safer and more efficient.  

Maritime professionals in the survey pointed to advanced data analytics, the internet of things, artificial intelligence, machine learning, high-bandwidth satellite communications and autonomous operations as presenting the greatest opportunities for their businesses in the coming years. 

These make the industry more vulnerable to cyber attacks, and require high levels of security. In the survey, 83% said their organisation has a good cyber-security posture, and 71% are confident their organisation would quickly get back to business as normal following a cyber attack. 

Around 73% reported their organisation is increasing cyber-security spending compared with 2023. The majority stated their organisation was prepared against potential outcomes, such as asset downtime and disruption to operations, theft of sensitive data, physical injury or loss of life and a grounded vessel. 

While industry awareness of cyber risks and cyber-security investments have grown rapidly, there are signs of a false sense of security within the maritime industry. 53% of those surveyed are confident their organisation can demonstrate full visibility of supply chain vulnerabilities. 

Additionally, 68% thought their organisation’s IT security is stronger than its operational technology (OT) security – which is linked to physical assets like sensors, programmable logic controllers, and enables automation, safety and navigation systems.  

Some 76% said the cyber-security training their organisation provides is not advanced enough to protect against sophisticated threats. 

“Organisations may feel they are prepared as more resources are being deployed to manage cyber risk, but the reality is more complex than that,” said DNV head of maritime cyber security Svante Einarsson.