A contractor connects remotely, resolves an engineering fault and saves everyone several hours of troubleshooting; the engineer can return to other work and the guests remain happily unaware. Weeks later, that connection may still be available, with its continued existence attracting considerably less attention than the fault that justified it.

I find this a useful place to begin a conversation about superyacht cyber security, because everyone can recognise the practical reasons behind the arrangement. Remote support is valuable, engineers are busy and keeping equipment operational matters; somewhere within that perfectly reasonable sequence of decisions, however, the yacht has acquired an enduring dependency and someone else has retained a set of digital keys.

High-bandwidth satellite services such as Starlink have made these connections increasingly useful. Owners and guests can conduct business throughout a passage, while engineers can bring specialist expertise aboard remotely. The security implications depend on what is connected through that service and how access is controlled; each upgrade deserves a fresh examination of the systems it brings within reach.

Equipment installed when external access was limited may now communicate through a supplier’s gateway or share infrastructure with services added during successive refits. Over time, those changes can erode the isolation on which the original installation depended, leaving the crew responsible for an arrangement that nobody has reviewed as a whole.

Every connection needs an owner
What concerns us is how easily responsibility becomes dispersed. The communications provider delivers connectivity, the equipment manufacturer maintains its installation and the management company oversees operations; the captain then has to rely on the security of the combined arrangement.

A sensible assessment follows the route a connection actually takes. If a supplier can reach a control panel or an engineering workstation, the next question is what that workstation can reach, including any other controllers or management interfaces accessible through it. That establishes the potential consequences of compromised credentials and gives the vessel team a basis for deciding where restrictions belong.

Operational technology brings particular engineering considerations. A programmable logic controller may operate machinery through instructions received from an engineering workstation; access to that workstation therefore deserves scrutiny proportionate to the physical processes it can influence. The installation’s design determines the exposure, which makes an accurate network diagram and equipment inventory essential working documents.

Guest, crew and business services should be separated appropriately from operational systems, with explicit rules governing necessary communications between them.

Matthew Geyman, Managing Director, Intersys

Guest, crew and business services should be separated appropriately from operational systems, with explicit rules governing necessary communications between them. Creating separate virtual networks is one step; the routing and firewall rules between those networks determine whether the separation provides meaningful protection.

Remote maintenance should follow the same discipline. A supplier can authenticate through a controlled gateway using an individual account and multi-factor authentication, with permission limited to the required equipment and maintenance period. Recording the session’s activity helps establish what changed and gives the next engineer a useful history.

Monitoring then needs an operational purpose. The NCSC’s guidance on operational technology recommends using logs to establish normal activity and identify departures from it; for a yacht, an unexpected supplier connection outside an agreed maintenance window is the kind of event that should prompt investigation.

The shore is part of the picture
The same examination must extend ashore, where management companies exchange information with family offices and charter brokers hold confidential guest records. A refit brings further organisations into the picture, often with legitimate reasons to access equipment or receive sensitive documents.

An attacker who compromises a supplier’s mailbox may find enough genuine correspondence to make a fraudulent payment request convincing. The timing, terminology and invoice history can all appear familiar; verifying a change of bank details through a previously established contact route gives the recipient a way to test the instruction independently.

Artificial intelligence increases the pressure on these processes. The NCSC assesses that AI will almost certainly make elements of cyber intrusion more effective and efficient, including work involved in researching targets and exploiting vulnerabilities. For owners and managers, this strengthens the case for disciplined verification and timely attention to exposed systems.

Superyacht service depends on responsiveness, and an apparently urgent request from an owner carries weight; crew need explicit support to pause when a payment instruction or request for confidential information, or access, requires checking.

There is a cultural consideration here that deserves frank discussion. Superyacht service depends on responsiveness, and an apparently urgent request from an owner carries weight; crew need explicit support to pause when a payment instruction or request for confidential information, or access, requires checking.

Privacy also depends on decisions made well before an incident. A passport copy or itinerary may travel through several businesses during a charter booking, with each recipient retaining its own copy. Agreeing who needs that information, how it will be transferred and when it should be deleted helps preserve the discretion guests reasonably expect.

Engineering discipline should carry through to cyber security
Builds and refits offer a valuable opportunity to establish security requirements while responsibilities are being negotiated. Specifications should address remote access and network boundaries, with acceptance testing demonstrating that the agreed restrictions work; the handover should leave the crew with accurate records and control of the necessary administrative accounts.

New builds deserve at least as much attention as refits. In both cases, cyber security needs to be treated as part of the whole system from the earliest stages of the project, with specialist input informing the design before construction or refit work begins. Decisions about equipment, connectivity and how systems interact should account for cyber requirements while there is still scope to get the overall arrangement right.

Getting that input right early also makes it possible to plan how the design will be tested, both within individual systems and across their connections. Problems identified at this stage are generally easier and cheaper to rectify than those discovered after installation. Proposed changes should be assessed for their wider impact before implementation, so that the protection intended in the design carries through to the completed yacht.

Software maintenance requires similar care, particularly where an update could affect the compatibility or availability of operational equipment. Engineers need manufacturer guidance and an appropriate testing window, supported by a recovery procedure that accounts for the installation’s configuration. The fact is that a backup of a computer may leave important gaps if the controller settings or software licences needed to restore service are held elsewhere.

Builds and refits offer a valuable opportunity to establish security requirements while responsibilities
are being negotiated.

Penetration testing can provide useful evidence about exposure, provided its scope and timing respect the vessel’s operational constraints. Findings should lead to assigned remedial work and subsequent verification, so that the captain, or management agent, can see which risks have been addressed and which still require mitigation.

Supplier dependence belongs in this assessment too. Where a single specialist holds the knowledge or tools required to recover an installation, the yacht’s continuity arrangements depend partly on that company’s resilience. Owners should establish how support would continue during a supplier outage and ensure that essential recovery information remains accessible.

David Irwin, Managing Consultant, Intersys Superyacht Risk Advisory

Clear responsibilities, practical procedures and consistent expectations for crew and contractors help address the human behaviour that can undermine even a well-designed system.

A supply chain is only as strong as its weakest link and thus rigorous scrutiny, assessment and monitoring of vendors and suppliers is a discipline which also controls cyber risk. A strong Third Party Risk Management framework increases Operational Resilience and helps compliance with IMO Safety Management System requirements.

These decisions become easier when investment is linked to the consequences of failure. The potential loss includes interrupted operations and sensitive information, alongside the possibility of interference with safety-related systems; understanding those consequences gives owners a defensible basis for prioritising expenditure.

The crew need arrangements they can rely on
At commissioning, evidence that the cyber design works as intended should give the captain confidence to focus on embedding good governance aboard. Clear responsibilities, practical procedures and consistent expectations for crew and contractors help address the human behaviour that can undermine even a well-designed system.

Chief engineers and electro-technical officers already manage demanding technical responsibilities, and cyber security adds work requiring its own expertise. Owners and managers should establish what their support contracts provide, including who will investigate suspicious activity and who can advise on containment when operational equipment is involved.

We would judge the quality of those arrangements partly by what they remove from the crew’s workload. A managed process for approving and withdrawing supplier access should reduce the engineer’s uncertainty; a clear escalation route should allow the captain to obtain qualified advice without assembling an incident response team during a passage.

Crew turnover makes that continuity especially important. Access should follow each person’s role and end when they leave, while practical training should prepare new arrivals for the requests and devices they will encounter aboard. Stronger integration of cyber risk into maritime human-element training would help connect these decisions with familiar principles of judgement and accountability.

An exercise can reveal whether the support arrangements hold together. If a maintenance provider reports a compromise while the yacht is underway, the vessel team needs to identify the affected connection and understand what isolating it would do; the management company must be ready to coordinate specialist assistance and owner communications.

A yacht’s digital access deserves the same considered scrutiny as permission to step aboard;
everyone entrusted with a set of keys should have a defined reason to hold them and someone
accountable for taking them back.

Working through that scenario also exposes recovery assumptions, including whether backup communications are available and whether systems can be restored within an acceptable period. This belongs within the vessel’s safety management arrangements: IMO Resolution MSC.428(98) affirms that approved safety management systems should address cyber risk under the ISM Code, with applicability established for the yacht’s circumstances and regulatory regime.

The practical ambition is for responsibility to remain clear as the yacht changes. Every refit, supplier appointment and connectivity upgrade provides an opportunity to review access and test the assumptions behind it; owners and managers should make that review part of the work they commission.

When the contractor completes the next remote repair, the engineer should be able to close the job knowing what was changed, what access remains and who has authorised it. That confidence is earned through the design of the system and the people supporting it, and it is a reasonable expectation aboard any connected yacht.

Lucrative targets in an evolving risk landscape
Superyacht owners scarcely need reminding that their wealth and public profile make them attractive targets; the yacht brings that exposure into an environment where private life, business interests and complex engineering meet. The potential rewards for an attacker extend from a diverted payment to confidential information that could be used for extortion, while the consequences for those aboard can reach into the safe operation of the vessel. Implementing the gold standard of Zero Trust cyber security principles will help prevent compromise of sensitive data as well as the vessel’s systems.

Owners have the authority to make cyber resilience a condition of how their yachts are built, managed and maintained; that means funding specialist support and expecting evidence that access controls and recovery arrangements work. The captain and engineer should be able to rely on those arrangements when a contractor connects remotely or a suspicious instruction arrives from shore, with clear authority to question, verify and intervene.

A yacht’s digital access deserves the same considered scrutiny as permission to step aboard; everyone entrusted with a set of keys should have a defined reason to hold them and someone accountable for taking them back.

As an open-source platform we offer an industry-wide invitation to anyone and everyone in our sector to share their knowledge, experience and opinions. If you have an interesting and valuable contribution to make, and would like to join our growing community of guest columnists, share your ideas with us at newsdesk@thesuperyachtgroup.com

Click here to become part of The Superyacht Group community, and join us in our mission to make this industry accessible to all, and prosperous for the long-term. We are offering access to the superyacht industry’s most comprehensive and longstanding archive of business-critical information, as well as a comprehensive, real-time superyacht fleet database, for just £10 per month, because we are One Industry with One Mission. Sign up here.