Composite: a 40-vessel operator, the first ninety days

The starting position

A mid-sized operator, roughly forty vessels across three classes, technical management in-house, no security function afloat and a small one ashore. Shoreside IT documented and reasonably managed. Aboard, no current inventory, drawings from the last refit, and a firm and correct instruction that nothing may be actively scanned while under way.

The trigger was commercial rather than regulatory: a charterer questionnaire nobody could answer from evidence.

Weeks one to three: one class, not forty vessels

Scope narrowed to a single vessel class. Passive collection deployed on two vessels of that class, chosen because they were mid-rotation and their technical superintendents were available.

Deliberately no attempt to cover the fleet. The findings from one class generalise to its sisters; the effort of covering everything at once does not, and it delays the first useful conversation by months.

Weeks three to six: the asset count

The first genuine surprise is rarely a vulnerability. It is the count. Passive discovery consistently surfaces devices that appear in no inventory: equipment added during a refit, vendor gear left connected after commissioning, spares swapped in without documentation.

This is the point at which the conversation changes, because the discussion stops being about security products and becomes about an estate the operator did not know it had.

Weeks four to eight: deciding what leaves the vessel

Satellite bandwidth is the architectural constraint, and it has to be settled early. Full telemetry ashore is not viable, so detection runs locally and what crosses the link is chosen for value.

Getting this wrong in either direction is expensive: ship everything and you exhaust the link; ship nothing and the shore team has no picture.

Weeks six to twelve: value appears ashore first

The earliest measurable improvement is usually in the shore-side conversation rather than aboard. Charterer and class questions get answered from evidence. The technical superintendent stops being the first line of cyber triage. Remote access arrangements that nobody held a register for become a register.

Aboard, the change is quieter: events surface ashore as they develop rather than when the master calls.

What we would do differently

Involve the technical superintendents earlier. In a composite of this kind the pattern is consistent: where they are engaged from week one the deployment goes smoothly, and where they meet it as a fait accompli it does not, regardless of how good the technology is.