Two Hundred Software Flaws or Twenty, the Risk Came Out Almost the Same

Korean cybersecurity company CYTUR looked back at more than a dozen cyber risk assessments of ship equipment that it carried out for clients. It rated 94% of the systems as needing cyber risk treatment under IACS Recommendation 171, the guidance on bringing cyber risk into the safety management system. About 60% were rated "Required", which means treatment is mandatory under that framework.

Read the limit first, because CYTUR wrote it. The 94% does not mean 94% of ship equipment is at risk. The systems were chosen and paid for by CYTUR's own clients, so this is not a random sample. "More than a dozen" is also a small number. And CYTUR sells these assessments. So this is an interesting finding from a small, self-selected sample, by a company with a business interest. We are running it because of what it found inside the sample, not because of the headline number.

The finding that matters. Many buyers judge equipment by counting CVEs, the publicly listed software flaws. CYTUR found that count misleads. One integrated automation system with more than 200 known flaws scored a risk level of 20. Another with about 20 flaws scored 16. Both needed treatment. Ten times fewer flaws, almost the same risk. What counts is whether a flaw can actually be reached, whether it leads to other systems, and what happens to the ship if someone uses it. CYTUR looks at four things together: vulnerability, exposure, connectivity and impact.

Where the risk hides. In one case the maker's main controller had no known flaws at all, while a network device installed next to it had 13. Other flaws sat in PLCs, operator screens, input and output modules and firewall software delivered with the equipment. One type of equipment talked to the ship over a serial cable, yet had eight open service ports on an Ethernet connection nobody used, and CYTUR found the same setup on equipment from two different makers. It also found unsupported operating systems, and security patches that had been available for years but were never installed.

The good news. One system dropped from risk 20 to 12, from "Required" to "Appropriate", after software and firmware updates, switching off services nobody needed, encrypting management traffic and checking the network setup. Ordinary work, not magic.

Why ship managers should care. On 6 September we wrote about tools for tracking supplier cyber certificates under IACS UR E27. This study shows why the certificate for the main unit is not the whole story. The risk often sits in the parts that arrive in the same box. When you buy or refit, ask the maker for a list of every software component delivered with the system, including third-party network devices, and ask who will patch them, and how often. [Smart Maritime Network · Digital Ship · Safety4Sea · AiatSea, 6 September]

This story is part of the Maritime AI Digest of 27 September 2026.