Why Safety Critical Design Must Lead Cybersecurity in the Era of Maritime Digitalization
Walter Caharija, Siemens Energy, Hamburg
The maritime industry is rapidly advancing toward higher levels of digitalization and automation, prompting classification societies to introduce dedicated cybersecurity regulations such as IACS Unified Requirements UR26 and UR27. These frameworks establish essential expectations for secure system integration, risk assessment, and the protection of critical operational technologies throughout a vessel’s lifecycle. While such regulations provide a structured foundation, they must be understood within the context of a threat landscape that is growing in both scale and sophistication.
Cyber threats targeting maritime assets are evolving at unprecedented speed, driven in part by the proliferation of artificial intelligence. AI enables attackers to automate reconnaissance, exploit complex system interdependencies, and execute coordinated, multi vector attacks that can compromise shipborne infrastructure. As vessels increasingly integrate IT, OT, and cloud based interfaces, the challenge of securing critical functions intensifies.
To mitigate these risks, our architectural philosophy prioritizes the embedded level for executing real time, safety critical control functions, while relegating PLCs to limited, non critical roles. This separation reduces the overall attack surface and enhances operational resilience by ensuring that essential functions remain insulated from network exposed subsystems. Complementing this technical strategy is a pragmatic mindset: at times, a deliberately disconnected cable or isolated subsystem provides more meaningful protection than complex add ons, preventing unnecessary integration efforts and reducing cost without sacrificing reliability.
Ultimately, safety and mission critical functionality must always take precedence over cybersecurity measures. Cybersecurity serves as a vital enabler, but it cannot supersede the fundamental requirement to maintain safe, stable, and predictable vessel operations in an increasingly interconnected and contested digital environment.
