The thread: each of them counts something real, and none of them knows what is on your ship unless you do.

Disclosure first: Blue Initiative is led by Cydome, a commercial partner of our parent company in Poland, and ClassNK, one of its partners, worked with us on an exercise in Panama this year.

On 26 October Cydome, Rakuten Maritime, Bureau Veritas, ClassNK and the Maritime Transportation System ISAC (MTS-ISAC) launched Blue Initiative, a free index of vulnerabilities in IT and OT used at sea. Its home page promises "every vulnerability that can reach a ship, in one place" and says it "lists only the ones that matter at sea, explains what each means on a vessel". Subscribers get alerts on new critical and high-severity entries, and vulnerabilities are published only once a patch is available, according to Infosecurity Magazine. Bureau Veritas named the problem it is meant to solve: relevant information "is often scattered across general-purpose databases and vendor advisories".

On Monday evening the index showed 29 671 entries, 591 of them in CISA's Known Exploited Vulnerabilities catalog and 37 marked "Maritime-Native", "built for ships and ports". A note at the bottom of its home page is open about where the rest come from: "Most entries are selected and classified automatically from public CISA ICS advisories and the CISA KEV catalogue: segment, environment and system are assigned by a matcher rather than an analyst, and carry no analyst note." Entries without a note say so. Scores are reproduced from their source, not re-scored, and the data may be reused under CC BY 4.0.

That candour is the most useful part. A filtered view of CISA's lists, with a label saying whether a person has looked at an entry, saves a fleet IT team real time. The 37 are a reminder of what no database can do: it can index only what has been disclosed, and much of the equipment on a bridge or in an engine room has few public disclosures to index.

Why this matters for maritime: IACS UR E26 asks owners to keep onboard systems secure for the life of the ship. As Bureau Veritas's Panagiotis Anastasiou put it at the launch, "Owners are expected to maintain the security of onboard systems as new vulnerabilities emerge". An index helps with that only if you know what is on board.

What to do: Start from your asset inventory, the one E26 already requires, and match the index against it, not the other way round. Subscribe to alerts for the vendors on your list. For entries without an analyst note, read the vendor's own advisory before anyone changes a setting on board. And ask the makers of your bridge, engine and cargo systems how they publish vulnerabilities, and whether they would contribute to an index like this one.

Test your response: A flag state inspector asks how you learn about vulnerabilities in your bridge equipment. Your answer is a free alert subscription that nobody on board reads. What does the inspector write down? MSC.428 Inspection: When the Flag State Finds Your Secrets →

There are now three common ways to count GNSS interference at sea, and last week each produced a number.

Ships report it. In the week ending 30 October, ships sent UKMTO four reports of GNSS interference (see Number of the week).

Satellites measure it. SAT-JAM, a free online map launched in September by Kian Bostani Nezhad, a PhD researcher at the Technical University of Denmark, shows where spacecraft 400 to 600 km up experience interference, using public data from European Sentinel satellites (more in Resource of the week).

AIS analytics infer it. On 1 November Windward, a maritime analytics company, wrote that GPS jamming "touched 124,235 distinct vessels worldwide in Q3 2026", up 11,7 percent on the previous quarter, and that in August "393 of the 642 transits logged through the Strait of Hormuz, 61.2%, never happened". Jamming had corrupted AIS positions and produced transits that no ship made. Windward draws a distinction worth keeping: jamming "is an area-level event that corrupts the reported position of every ship in the zone", while AIS spoofing "is a choice made by a specific vessel".

Why this matters for maritime: the numbers do not contradict each other. They count different things. A report counts a crew that noticed and wrote it down. A satellite counts what it heard in orbit, which may be far from the source. AIS analytics count wrong positions, including those of ships whose crews never noticed anything. Only the first is evidence about your own ship, and it exists only if somebody records it. A charterer, a screening service or an insurer reading the third kind of count about your vessel will not know what the bridge saw unless the bridge wrote it down.

What to do: Treat a quiet week in the reports as a quiet week in reporting, not in jamming. Before a voyage through a known area, look at a map such as SAT-JAM, but read it as where satellites hear interference, not where your ship will. When an alert or a screening report shows one of your ships doing something odd in a jamming zone, check first whether every ship in the area showed the same thing. And make the report: time, a position from an independent fix, what failed and what the watch did.

Test your response: A screening report says your tanker met another vessel at anchor off Fujairah for two hours. Your bridge log shows no meeting, and a GNSS alarm at the same time. What do you send the charterer this afternoon, and what evidence do you actually have? Hormuz Haze: The Tanker That Couldn't See, Couldn't Stop, Couldn't Call →

On 23 October Hanwha General Insurance signed a memorandum of understanding with CYTUR, a Busan-based maritime cybersecurity company, to develop cyber insurance for South Korean shipowners. CYTUR will assess a vessel's IT and OT security "covering the vessel lifecycle from design and construction through to operation", and its findings will feed underwriting. Hanwha plans criteria "linking vessel security assessment results to insurance eligibility conditions and preferential measures".

The assessment does not end when the policy starts. According to the companies' announcement, "Even after insurance enrollment, CYTUR plans to continuously monitor vessel security status through its cyber resilience management system and support risk mitigation and reassessments for insurance renewal." After an incident, CYTUR would carry out remote analysis and onboard forensic investigation and write the technical report for the claim. A pilot with Korean shipping companies is due in December. It is a memorandum, not yet a product, and neither company has disclosed premium rates or a launch date, Splash247 reports.

The announcement names the gap it targets: "existing vessel insurance policies exclude general cyber-related losses from coverage". Others are moving too. In August we wrote about Sompo Japan's cover for lost earnings when GNSS interference stops a ship working, with a crew cyber course as a condition (MCW #23). Splash247 reports that DNK, the Norwegian war risk insurer, has introduced premium incentives for vessels that adopt alternative positioning systems; we have not found DNK's own announcement.

Why this matters for maritime: when cover is priced on a ship's assessed security and reassessed at renewal, the evidence moves from the audit file into the premium. It also puts a third party on watch over your ships for the whole policy year, and a forensic team on board after an incident. Who sees that data, and for what, belongs in the contract.

What to do: Before renewal, read your hull and P&I policies for cyber exclusion clauses, and ask your broker in writing which losses from a cyber incident or from GNSS interference are covered today. If you are offered assessment-linked terms, ask what is measured, how often, who holds the data, and whether you see the same report the insurer sees. And keep what you would need for a claim, logs, a timeline and a record of who decided what, somewhere that survives the incident.

Test your response: Your renewal questionnaire asks for the date of your last cyber exercise and the corrective actions that came out of it. The last exercise was eighteen months ago and nobody wrote the actions down. What do you send? NIS2 Nightmare: The Audit That Turned Into a Crisis →

Full calendar, with cyber tracks flagged: https://mc3.maritime-ogmios.tech

Unconfirmed signals from open-source and regional channels we monitor. Confidence is flagged on each item. Treat these as early warning, not fact, until confirmed.

KTU Shipyard (single source: the attackers' listing), listed by Whitearmor, a new group, on 30 October. The listing names PT Karya Teknik Utama, a shipbuilding and ship repair yard in Batam, Indonesia (ktushipyard[.]com), claims more than 3 TB including ticketing systems, user drives and customer data, and gives the company 20 days. We found no statement from the yard.

Tailormade Logistics (single source: the attackers' listing), listed by Play on 27 October with the location "Belgium". Company directories describe a freight forwarder in Ghent with sea freight from Asia through Antwerp. We found no statement from the company.

Last week's Aveva listing drops out: the publication date the group set has passed, and we found neither published data nor a statement.

SAT-JAM, a free map of GNSS interference measured by satellites (Kian Bostani Nezhad, Technical University of Denmark, launched September 2026)

The idea came from a spacecraft operator complaining about GNSS problems over Europe. Nezhad found that several European Space Agency missions publish the navigation data their satellites collect, and that every mission he examined showed interference. SAT-JAM maps it, inspired by GPSJam, which does the same from aircraft data. Read the caveat before the map: "SAT-JAM does not show where GNSS interference originates from, but where spacecraft measure the GNSS interference. The actual source, and the measurement can be far apart, due to the high altitude of satellites." His advice to shipowners is blunt: "Everyone who uses GNSS must change their mindset from GNSS being a primary and dependable navigation solution, to it being a supplement to other navigation methods."

Splash247 interview with the creator of SAT-JAM →

Maritime Cyber Intelligence Brief covers what the weekly cannot: full incident timelines, regulatory analysis, GNSS threat data, and OT advisory breakdowns. The latest issue is a free preview.

Read the Intelligence Brief →

"Cyberinsurance Policy: Rethinking Risk in an Age of Ransomware", by Josephine Wolff, 2022.

How cyber insurance has evolved, from the first policies through the NotPetya "act of war" exclusion disputes to the current arguments over what should be covered. Relevant this week because Story 3 is about an insurer that wants to measure security before it prices it.

Browse maritime cyber book recommendations →