AI shrinks maritime cyberattack window to 48 hours, Cydome warns

AI is shrinking your cyber response window: what maritime operations must change now

AI is speeding up shipping. It's also speeding up attackers. New Cydome data shows up to 60% of newly disclosed vulnerabilities across ship, onshore, and offshore systems are being weaponised within 48 hours - with some hits landing just 15 minutes after a flaw is detected.

Back in 2018, the average time from disclosure to attack was 63 days. By 2024, it was five. Today, sub-48 hours is the norm. That's a different game for operations.

The window has collapsed

AI-augmented attack tools scan, exploit, and pivot faster than traditional defenses can respond. According to Cydome's latest research, 87% of organisations now see AI-related vulnerabilities as the fastest-growing risk - a clear signal that the old patch-and-pray cycle is broken.

As AI moves from generative to agentic and physical models across navigation, fleet optimisation, and maintenance, Tetsuji Madarame sums it up: "protecting AI-related assets must be a top priority." Treat AI systems, prompts, data feeds, and control interfaces as critical assets - because they are.

Phishing now speaks your crew's language

Attackers aren't blasting generic emails anymore. The report notes 83% of phishing emails already use AI to target multi-national crews in their native language - and in a tone that builds instant trust. That same tech has driven a 1600% surge in voice phishing, cloning C-suite voices to push fraudulent authorisations.

Theofano Somaripa warns 2026 attacks will reflect a shift from simple digitalisation to a radical rework of business models through AI. Translation: bigger blast radius when AI systems make, or appear to make, decisions on your behalf.

Your edge is their door

Routers, firewalls, and VPNs - the "digital gateway" - were routinely exploited, with attacks up 800% in 2025; 20% went straight at firewalls and VPNs. One campaign by Lab Dookhtegan wiped VSAT partitions and disconnected 116 tankers from the internet and shore. Connectivity gone. Ship-to-shore VOIP taken over. Operations and safety put at risk.

If the edge fails, your ships fly blind. That's an operations problem first, an IT problem second.

Trust is the real vulnerability

"Shipping companies are deploying AI faster than they are defining cyber accountability," warns Katerina Raptaki. "In 2026, the question after an incident won't be 'was the AI wrong?' but 'why was it trusted?'" Build the why into your processes now.

Øystein Brekke-Sanderud adds: the most significant risk will come from inside the perimeter - malicious, compromised, or accidental. "Resilience will increasingly depend on how well we detect subtle signals early, not just how well we defend the edge." And as Panagiotis Anastasiou notes, the differentiator will be how quickly and safely you detect, respond, and continue operations.

90-day operations playbook

Map your AI attack surface: Inventory models, agents, APIs, data sources, and third-party integrations across vessel and shore. Include ECDIS add-ons, route planners, maintenance tools, and procurement bots.
Set trust boundaries: Define who can approve AI actions that change OT/ICS setpoints, routing, or payments. Enforce human-in-the-loop with dual control for high-risk steps.
Patch by exposure, not schedule: Prioritise internet-facing and edge devices against the CISA Known Exploited Vulnerabilities (KEV) list. Aim for 24-48 hours max. Separate maintenance windows for VSAT, firewalls, and VPNs.
Segment the edge: Isolate VSAT/LTE modems, routers, and firewalls from OT. Block east-west by default. Allow-list ship-to-shore services.
Back up what actually matters: Capture router/firewall configs and VSAT partitions. Store offline. Test bare-metal restores quarterly.
Tighten remote access: Short-lived VPN creds, MFA with hardware keys, device posture checks. Rotate keys before port calls.
Email and voice controls: Enforce DMARC/DKIM/SPF. Use verification passphrases for voice approvals. Require out-of-band checks for payment, routing, and procurement changes.
Drill the crew: Run multilingual phishing simulations that mirror AI-written lures. Add vishing drills targeting bridge and office. Track time-to-report, not just click rate.
Watch insider signals: Monitor privilege creep, unusual data pulls, after-hours access to OT jump hosts. Provide an anonymous reporting path.
AI governance that bites: Keep decision logs and model cards. Put agents in shadow mode before execution rights. Maintain a kill-switch.
Incident scripts on paper: Pre-approve playbooks for connectivity loss, GPS spoofing suspicion, and ECDIS anomalies. Put laminated checklists on the bridge and in the engine control room.
Stronger supplier terms: 48-hour patch SLAs for edge devices, SBOMs for onboard software, and a right-to-audit clause.

What to track weekly

Median time-to-patch for internet-facing and edge assets
Phishing report rate and time-to-report (crew and office)
MFA coverage for remote access and privileged accounts
Backup restore test outcomes for VSAT/firewalls
Insider-risk alerts reviewed and resolved
% of AI-initiated actions that require human approval

For maritime operations, speed is the threat - and the answer

Attackers use AI to compress discovery, execution, and fraud. Your edge, your people, and your AI agents are the levers. Shorten your detection and response loops, treat edge devices as single points of failure, and make trust something you can verify - every time.

If your team is rolling out AI across fleet and shore, align capability with control. Start with AI for Operations to build processes that improve output without creating blind spots you can't afford.

For wider guidance on maritime cyber risk expectations, see the IMO cyber risk guidance. And keep your patching aligned to active threats via the CISA KEV catalog.