Maritime risk is no longer defined by one threat at a time. Two patterns are intensifying together: armed piracy is reasserting itself in the western Indian Ocean after years of suppression, and state-backed coercion below the threshold of open conflict (the so-called grey zone) is hardening across contested waters such as the South China Sea. Treated as separate news items, each looks containable. Treated as what they are, a simultaneous rise in both criminal and state pressure on the same trade routes, they compound. For shipowners, charterers and insurers, the direction of travel matters more than any single incident. This analysis explains why both threats are climbing at once, how they interact, and what operators should do about it.
Piracy is back, and it has learned
The collapse of Somali piracy after 2012 was never permanent. It was suppressed by naval patrols, armed guards aboard ships and a temporary improvement in conditions ashore, not solved. From late 2025 those conditions eroded, and a clear resurgence followed. Pirate Action Groups put to sea again using hijacked dhows as motherships, a method that extends their reach far beyond the coast. In November 2025 they hijacked the tanker HELLAS APHRODITE, the most prominent seizure in years, and attacks have continued into 2026 with further dhow hijackings and approach incidents in both Somali and Yemeni waters.
The tactics have evolved. Today's groups tend to target smaller, slower and less-defended vessels, fishing boats, supply ships and coastal traders, rather than attempt the high-profile captures of the 2000s. They can operate more than 1,000 nautical miles from the Somali coast, pushing the threat deep into the Indian Ocean and Arabian Sea rather than confining it to a narrow chokepoint. The practical effect is that a much larger area of ocean now carries real boarding risk, and the vessels most exposed are precisely those least likely to carry armed teams or hardened citadels.
The grey zone: pressure without a shot fired
The second pattern is different in kind. Grey-zone coercion is the deliberate use of pressure that stays deliberately below the line that would trigger an open military response. At sea this looks like coast guard and maritime-militia vessels swarming, shouldering and water-cannoning others, rapid construction on contested reefs and features, and the steady normalisation of a presence that was once contested. The South China Sea is the clearest example, where law-enforcement and paramilitary activity around disputed features keeps reshaping who controls what, one incident at a time. We examine that dynamic in detail in our analysis of South China Sea energy and territorial friction.
For commercial shipping the danger is rarely a direct attack. It is ambiguity. A vessel can find itself boarded, inspected, delayed or warned off in waters it has every legal right to transit, with no clear authority to appeal to and no clear line between routine enforcement and coercion. That ambiguity raises insurance, routing and crew-safety questions long before any shooting starts.
Why both are rising at once
Piracy and grey-zone coercion have different actors and motives, but they feed on the same conditions. Naval assets are finite, and when warships concentrate to escort traffic through one crisis, such as the Red Sea, coverage thins elsewhere. Distraction in one theatre creates opportunity in another. Both threats also exploit the same weakness: the limits of who enforces the law on the high seas and who answers when a vessel is in trouble far from any friendly coast.
The result is a compounding effect. An operator routing around one hazard can sail straight into another. Re-routing tankers away from the Red Sea, for instance, sends them through the very western Indian Ocean waters where piracy is resurgent. Avoiding a contested chokepoint can add days, fuel and exposure on a longer leg. Risk is not being removed; it is being redistributed, and the map of where it sits is changing faster than annual planning cycles assume.
| Dimension | Resurgent piracy | Grey-zone coercion |
|---|---|---|
| Primary actor | Non-state criminal groups | State coast guards and maritime militia |
| Goal | Ransom, theft, vessel seizure | Control of waters and features over time |
| Threshold | Open violence (boardings, small arms) | Deliberately below armed conflict |
| Main exposure | Smaller, slower, unprotected vessels | Any transit through contested waters |
| Operator response | Hardening, armed teams, routing | Documentation, legal clarity, monitoring |
What operators should do
The countermeasures for each threat are well established. The discipline that is often missing is treating them as one risk picture rather than two separate worries.
- Update high-risk-area assumptions. The geography of piracy has widened well beyond the Gulf of Aden. Voyage plans drawn against older boundaries understate the exposed area in the Somali Basin and wider Indian Ocean.
- Match hardening to the real target profile. Because today's pirates favour slower, less-defended vessels, ship protection measures, citadels and, where justified, armed teams matter most for exactly the ships once assumed to be too small or too slow to bother attacking.
- Document everything in contested waters. In a grey-zone encounter the record (position, communications, the conduct of the approaching vessel) is the operator's main protection. Clear evidence supports insurance, flag-state and legal responses when authority is ambiguous.
- Plan re-routing as risk redistribution, not risk removal. Every diversion trades one exposure for another. The decision should weigh the full risk of the alternative leg, not just the hazard being avoided.
- Watch the trend, not the headline. A single hijacking or stand-off is a data point. The strategic question is whether tempo and geography are shifting, and they are.
Where Verihelm helps
Verihelm tracks both criminal and state-backed maritime threats as a single, evolving risk picture rather than a stream of isolated incidents, so operators can see where piracy and grey-zone pressure overlap on a given route and plan accordingly. By combining incident monitoring, threat-actor analysis and route-level assessment, the platform turns scattered reports into a clear view of which waters are hardening and why. Explore how this fits into our wider regional and threat intelligence coverage.