CIRM 2025: Global cyber & risk in the maritime domain

Last week (14–16 October 2025), the CIRM Annual Conference gathered the marine-electronics community in Lisbon to tackle the biggest technical and operational issues facing shipping today.

Representing Dryad Global, Frank Fenner (Chief Commercial Director) and Erik Speyer (Technical Director) delivered our “Global Cyber & Risk” briefing, sharing real-world incidents, trend data, and practical steps operators can take right now.   

The signal through the noise: what’s changed in 2025

Our presentation highlighted a set of linked threats that spanned regions and disciplines — from comms-layer disruptions to OT compromise and regulatory change. Key points included:

• Undersea cable interference is no longer theoretical. Disruptions in multiple theatres over the last 12 months underscore how fragile maritime connectivity can be and how quickly knock-on risks cascade across fleets and ports. 

• A coordinated cyberattack on NITC vessels left dozens unable to connect to shoreside facilities; adversaries claimed root-level access to satcom terminal OSs and disruption to Falcon maritime comms. It’s a clear example of adversaries moving beyond IT into communications infrastructure. 

• AIS/GPS spoofing and jamming are spiking. We’re seeing sharp rises in anomalous position “jumps” and deliberate interference that degrades navigation, compliance, and safety — including national-level directives to halt navigation during outages. 

• Cargo-infrastructure malware is real and present. From reports of backdoors in Chinese-manufactured ship-to-shore cranes to malware (e.g., Korplug) identified across European shipping firms — some directly on vessels — the crane-to-bridge attack surface is expanding. These developments sit alongside USCG MARSEC Directive 105-5 requiring additional cyber-risk measures for PRC-made STS cranes.   

• More incidents, more actors, more cross-silo attacks. IMO noted 109 reported cyber incidents between 1 January and 17 June 2025, with attacks increasingly moving between port IT, terminal OT, and vessel systems — and likely to serve as precursors to hybrid operations. The upside: as solutions proliferate and mature, dynamic protection remains possible.