ICS: Shipping Cyber Maturity Scores 2-3 Out of 10 on Ships — Industry Is Waiting for a Disaster

The International Chamber of Shipping's Leadership Insights publication has issued a frank assessment of maritime cyber risk: if aviation scores 8-9 out of 10 on cyber maturity, shipping overall sits around 4, and the ships themselves score just 2-3. The finding, attributed to Daniel Ng, CEO of CyberOwl — now part of DNV — frames what many in the industry already sense but rarely quantify so plainly: maritime is not just behind other transport modes on cybersecurity, it is dangerously behind in an environment where attack sophistication is accelerating and onboard systems connectivity is rapidly increasing through VSAT, IoT sensors, and cloud-connected operational technology. The structural problem is compounding: ICS identifies a patchwork of IMO, IACS, and national regulatory frameworks that are fragmented and inconsistently enforced. IACS E26 and E27 requirements — which set cyber resilience standards for newbuilds — have limited retroactive reach into the existing operational fleet, meaning the vessels actually carrying most of the world's trade operate under rules that predate the connected ship era. Legacy OT systems on board were not designed for network environments and cannot be easily patched or updated. The human factor remains critical: Ng specifically noted that many mid-sized owners "are still waiting for something to happen before they act" — a reactive posture that mirrors where aviation was before several high-profile incidents accelerated mandatory security investments. The ICS report highlights human behaviour alongside fragmented regulation and legacy systems as the three interlocking obstacles widening the gap. What this means for ship managers: The window for voluntary investment ahead of mandatory requirements is closing as regulatory pressure builds and incidents become more frequent. AI-powered threat detection and anomaly monitoring tools — capable of identifying unusual network behaviour patterns across OT systems that human IT teams cannot monitor continuously — represent one practical response that does not require ripping and replacing legacy infrastructure. [Splash247 / ICS Leadership Insights]

This story is part of the Maritime AI Digest of 1 March 2026.