Cybersecurity on a yacht means protecting the connected systems on board against attacks that could expose data, disrupt operations or mislead the bridge. Those systems range from the satellite link and crew laptops to navigation, communication and machinery controls. A modern superyacht runs office IT and operational technology (OT) on the same vessel, often through the same internet connection. Where the two are not properly segregated, or are connected insecurely, a compromise in one can spread to the other.
Which Systems on a Yacht Are Exposed?
Engine-room control and monitoring systems are operational technology, and they are increasingly connected to the same onboard network.
Any system that stores data, takes software updates or connects to a network can be attacked. On a typical superyacht that includes:
- Connectivity: VSAT and Starlink terminals, 4G/5G routers, onboard Wi-Fi, firewalls and switches.
- Navigation: ECDIS, radar, GPS and other GNSS receivers, AIS, autopilot and heading systems, and the NMEA 2000 or Ethernet networks that link them.
- Safety and communication: GMDSS equipment, NAVTEX, VDR where fitted, and BNWAS.
- Machinery and hotel systems: engine monitoring and controls, power management, HVAC, CCTV, access control and audio-visual systems.
- Office and personal devices: the captain’s and crew laptops, the owner’s and guests’ phones, and the management company’s cloud software.
These systems are not equally exposed or equally critical. A 2024 doctoral thesis by Saim Atalay Keleştemur at İstanbul Gedik University, followed by a 2025 book chapter with colleagues, shows how this can be measured. Working from past incidents recorded in NHL Stenden University’s Maritime Cyber Attack Database, it matched 26 shipboard components, from AIS and ECDIS to main engine controls and the VDR, to MITRE CAPEC attack patterns. It then rated each match for likelihood, severity and impact. The lesson for a yacht team is that risk sits in specific equipment and can be ranked.
On the bridge, typical patterns include CAPEC-627, Counterfeit GPS Signals, for spoofed position data; CAPEC-148, Content Spoofing, for false AIS, NAVTEX or chart data reaching ECDIS; and CAPEC-186, Malicious Software Update, for compromised chart or software updates loaded from a USB stick.
How Attacks Are Catalogued: CVE, CWE, CAPEC and ATT&CK
Security teams use four public catalogues, all maintained by MITRE, to describe threats in a common language:
| Catalogue | What it lists | Example question for a yacht |
|---|---|---|
| CVE | Specific, published vulnerabilities in specific products and versions | Does the software version on our satcom terminal have a published CVE? |
| CWE | Types of weakness that cause vulnerabilities | Does the equipment use hard-coded passwords? |
| CAPEC | Attack patterns: how an attacker exploits a weakness | How could someone feed false position data to the bridge? |
| ATT&CK (including ATT&CK for ICS) | Tactics and techniques seen in real attacks | How do attackers move from a guest network to an operational one? |
Maritime equipment appears in these records. Cobham’s SAILOR 900 and 6000 satcom terminals were found to have hard-coded administrator credentials (CVE-2014-2940). The SAILOR 250 and 500 FleetBroadband terminals allowed an unauthenticated password reset (CVE-2018-19392). Furuno’s FELCOM 250 and 500 Inmarsat FleetBroadband terminals exposed a credentials file without authentication (CVE-2018-16705). Check manufacturer advisories for available fixes, and where no fix is available, assess isolating or replacing the equipment. The step that matters is to know which models and software versions are on board, and to check them against the National Vulnerability Database and manufacturer notices.
What Can Happen: Examples from Yachting and Shipping
- GPS spoofing of a superyacht (2013). A University of Texas team, invited aboard the 213 ft White Rose of Drachs between Monaco and Rhodes, used counterfeit GPS signals to steer her off course while the bridge displays showed nothing unusual (UT News).
- GNSS interference in the Eastern Mediterranean and Black Sea (2024 onwards). Lloyd’s List reported that on 4 April 2024, AIS data placed 117 cargo vessels at Beirut airport, and that on 1 April 2024, 227 vessels in the Black Sea appeared on land (Lloyd’s List). In March 2025, the IMO, ICAO and ITU warned jointly that GNSS interference could cause collisions and groundings (IMO). Yachts cruising to and from Türkiye pass through these waters.
- Garmin outage (2020). Garmin confirmed that a cyber attack encrypted some of its systems in July 2020. The attack interrupted its online services. Garmin stated that its products kept working apart from access to those services (Garmin).
- DNV ShipManager (2023). A ransomware attack in January 2023 cut about 70 customers and roughly 1,000 vessels off DNV’s fleet management software. The onboard offline functions kept working (The Register).
- Lürssen (2023). The German builder confirmed a cyber attack over Easter 2023, widely reported as ransomware, that disrupted its operations (Marine Industry News).
- MarineMax (2024). An attack on the US yacht dealer in March 2024 exposed personal data of more than 123,000 people (BleepingComputer).
- Groupe Beneteau (2021). The builder detected a malware intrusion in February 2021, which slowed or stopped production at several sites (Beneteau Group).
VSAT and Satellite Connectivity: Secure the Link and the Network Behind It
Technical spaces hold CCTV, power and control equipment that is often linked to the onboard network.
The satellite terminal is the yacht’s front door to the internet, and the terminal itself is only part of the risk. A secure VSAT or Starlink installation depends on what sits behind it:
- Change default passwords on terminals, routers and management portals, following the manufacturer’s procedure, and remove unused accounts.
- Separate the networks. Guest Wi-Fi, crew devices, the office network and operational systems belong on separate segments. Firewall rules should allow only the traffic each segment needs.
- Control remote access. Manufacturers and service companies often need remote access for support. Give each supplier a named account with multi-factor authentication, and enable access only when a job requires it.
- Keep firmware current on terminals, routers and firewalls. Follow the manufacturer’s instructions, keep a configuration backup before each update, and record what was installed.
- Log and monitor. Keep firewall and terminal logs, and make sure someone on board or ashore is responsible for reviewing them.
Which Rules Apply to Which Yachts?
The answer depends on the yacht’s size, use and flag.
- Commercial yachts under the ISM Code. IMO resolution MSC.428(98) (2017) affirms that an approved safety management system should take cyber risk management into account. It encourages Administrations to make sure this is done no later than the first annual verification of the company’s Document of Compliance after 1 January 2021. Commercial yachts of 500 GT and over that operate under the ISM Code, for example under the Red Ensign Group Yacht Code, have cyber risk in their audited safety management system as a result.
- Private yachts not engaged in trade. These yachts are outside the ISM Code, so MSC.428(98) does not apply to them. Other obligations depend on the flag and on how the yacht is used, so check these separately. In any case, the IMO guidance below is the best place to start.
- IMO guidance. The Guidelines on Maritime Cyber Risk Management (MSC-FAL.1/Circ.3, latest revision Rev.4 of May 2026) are recommendatory. Since Rev.3 (2025) they have been built around six functions: govern, identify, protect, detect, respond and recover. They also list minimum controls, such as changing default passwords, using multi-factor authentication and separating operational networks from IT networks.
- Class rules for new ships. IACS Unified Requirements E26 (cyber resilience of ships) and E27 (cyber resilience of onboard systems and equipment) are mandatory only for the ship types listed in their scope, mainly passenger ships on international voyages, whatever their tonnage, and cargo ships of 500 GT and over on international voyages, contracted for construction on or after 1 July 2024. For commercial yachts carrying no more than 12 passengers, and for pleasure yachts not engaged in trade, E26 is non-mandatory guidance. It does not apply retrospectively to existing ships.
- Flag guidance. Some registers publish cyber guidance for their fleets, for example the Marshall Islands, which asks that maritime cyber incidents be reported to the Administrator. Check what your flag state and classification society expect.
What to Check During a Refit
A refit is a particularly good moment to review cyber risk. Equipment is being replaced, cables are being pulled, networks are being reconfigured, and specialists from several companies are already on board. The work falls into three steps.
1. Survey connected and legacy systems before the work is specified
Build or update an inventory of every networked device: make, model, software or firmware version, network address, who supports it and how it is accessed remotely. Check each item against published vulnerabilities and manufacturer support status. Equipment that no longer receives updates is a candidate for replacement or isolation. Include the findings in the refit brief, so that cyber work is priced and scheduled with the rest of the job.
2. Plan network segmentation and remote access as part of the electrical and electronic scope
New navigation, satcom or AV equipment changes the network. Decide in the design stage how the network will be segmented, which firewall rules apply between segments, and how each supplier will reach their equipment remotely. Planning this early reduces later changes to cabling and configuration. The refit specification should state who designs the cyber measures and who controls supplier access, usually the yacht’s technical team or the specialists appointed by the owner’s team. At KRM, the physical installation and cabling are part of our electrical and electronic work in the yard period.
3. Hand over records the crew can use
At redelivery, the yacht should leave with:
- an updated network diagram and asset inventory;
- a list of who holds each administrator account;
- remote access arrangements with every supplier;
- the firmware versions installed;
- the responsibilities for future updates.
Default passwords set during commissioning should be changed before handover. These records turn a one-off fix into something the crew and the management company can maintain.
Day-to-Day Cyber Habits for Yacht Crew
- Plan software updates for navigation and machinery systems with the manufacturer, at a suitable maintenance window, with a rollback plan and a function check afterwards.
- Back up critical data and configurations, keep one copy offline, and test that the backup can be restored.
- Train crew to recognise phishing and to report anything unusual promptly.
- Keep a simple incident plan: who to call, how to isolate a network segment, and how to navigate if GNSS or ECDIS data cannot be trusted.
Frequently Asked Questions
Is cyber risk management mandatory for my yacht?
It is mandatory for commercial yachts that operate a safety management system under the ISM Code, which typically means yachts of 500 GT and over. A private yacht not engaged in trade is outside the ISM Code, so MSC.428(98) does not apply. Other requirements depend on the flag and on how the yacht is used, so check with both the flag and the classification society.
Does IACS UR E26 apply to yachts?
E26 and E27 are mandatory for specified ship types contracted on or after 1 July 2024, mainly passenger ships on international voyages, whatever their tonnage, and cargo ships of 500 GT and over on international voyages. For pleasure yachts not engaged in trade, and for commercial yachts carrying no more than 12 passengers, E26 is non-mandatory guidance. Your classification society can confirm how it applies E26 and E27 to your yacht.
Does Starlink or VSAT make the yacht less secure?
A satellite link adds an attack surface: the terminal’s own software, its management interface and the service accounts that reach it. Risk also depends on the network behind it. Default passwords, flat networks without segmentation and uncontrolled remote access make attacks easier. A terminal with current firmware on a segmented network is far easier to defend.
What should we do if GNSS data looks wrong?
Cross-check the position with radar, visual bearings, depth and dead reckoning, and follow the vessel’s procedures for degraded navigation. GNSS jamming and spoofing have been widely reported in the Eastern Mediterranean and the Black Sea, so plan for it on those passages.
When is the best time to review a yacht’s cybersecurity?
Review it regularly in normal operation, and in particular during a refit or major equipment upgrade, when the network changes and suppliers are on board.
What is the difference between AIS and radar?
AIS displays information broadcast by other vessels: their position and course normally come from positioning sensors such as GNSS, while identity details are programmed into their equipment. Radar detects targets directly by their echoes, including vessels without AIS, and does not depend on what other vessels report. Under the collision regulations, keep a proper lookout by sight and hearing, assess collision risk using all available means, and use radar properly when it is fitted; AIS supplements this assessment.
How can I check a vessel’s position if its AIS looks suspicious or keeps dropping out?
Compare the AIS target with the radar picture and, where possible, a visual bearing. AIS reception can be interrupted by limited VHF range, terrain shielding, antenna or equipment faults, interference, or a transponder that is not transmitting. Implausible positions or movements warrant cross-checking but do not prove spoofing, because sensor errors or duplicate identities can also cause them. For your own position, see the GNSS question above.
Sources
- IMO, Resolution MSC.428(98), Maritime Cyber Risk Management in Safety Management Systems (2017).
- IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on Maritime Cyber Risk Management (2026).
- IACS, UR E26 Rev.1, Cyber Resilience of Ships (2023).
- Keleştemur, S. A. (2024). Türkiye’de faaliyet gösteren deniz taşımacılığı işletmelerine yönelik siber risk analizi için matematiksel model önerisi [Doctoral thesis, İstanbul Gedik University].
- Keleştemur, S. A., Elmas, G., Özdemir, İ. and Köseoğlu, A. M. (2025). Assessing Maritime Assets Using Cyber Risk Framework Based on MITRE CAPEC. Springer, Green Energy and Technology series, pp. 233-256. doi:10.1007/978-3-031-89869-3_16
- NVD records: CVE-2014-2940, CVE-2018-19392, CVE-2018-16705.
- MITRE, CAPEC, CWE and ATT&CK.
