A modern ship is a floating industrial-control network: engine management, cargo systems, ECDIS, radar, ballast, DP, satellite comms — increasingly bridged to shore. Since IMO Resolution MSC.428(98) embedded cyber risk into the ISM Code (from 2021) and IACS UR E26/E27 became mandatory for newbuilds contracted from 1 July 2024, cybersecurity aboard is not optional hygiene — it is surveyed compliance.
The security question has therefore shifted from 'should we monitor the ship's network?' to 'what can detect an intrusion on it?' — and increasingly the answer offered is AI. This article separates what AI intrusion detection demonstrably does aboard from what remains unproven.
Key findings
- Maritime cyber is regulated reality, not speculation: IACS UR E26 (ship-level) and E27 (onboard systems) apply to new ships contracted on/after 1 July 2024. Established
- Shipboard networks are OT, not IT: CANbus/NMEA buses, vendor-proprietary protocols, and systems that must not be rebooted — classical IT security tools transfer poorly. Established
- ML anomaly detection on vessel networks shows promise in research testbeds; public evidence of production-ship deployments is thin. Research demonstration
- The labelled-attack-data problem is worse than in most fields — real ship-intrusion data is rare, sensitive, and mostly unpublished. Established
- False positives aboard are operationally expensive — an alarm the crew can't triage is worse than none on a small ship's team. Maritime-GPT analysis
The ship is an OT network, not an office
Enterprise intrusion detection assumes the defender can patch, reboot, and sandbox. Aboard a ship none of that is routine. ECDIS, engine control, and ballast systems run continuously on certified software that can't be updated at sea; the buses are proprietary and document-poor; the crew has no security operations centre. An AI detector must therefore work <em>passively</em>, on traffic it cannot fully parse, without disrupting the systems it watches — a harder constraint than most cyber research addresses. Established
What AI detection demonstrably does
- <strong>Anomaly detection on traffic.</strong> Autoencoder/one-class approaches trained on normal vessel traffic flag deviations — spoofed AIS, unexpected bus chatter, novel protocol use — in research testbeds. Research demonstration
- <strong>Abnormal-behaviour flags.</strong> Wide-area work on AIS/GNSS anomalies (detailed in our spoofing piece) is the same technique applied to the radio layer. Research demonstration
- <strong>Cross-layer correlation.</strong> The promising architectures fuse IT, OT and radio-layer signals — an anomaly on one layer is noise; the same anomaly across layers is an event. Maritime-GPT analysis
- <strong>Baseline shift detection.</strong> Learning what 'normal ship' looks like, then flagging drift — the unsupervised approach that ships' lack of attack labels forces. Research demonstration
The data problem nobody solved
Ships rarely publish their intrusions; vendors rarely publish their logs; the result is that maritime cyber ML trains mostly on testbed traffic and synthetic attacks. The detectors that work in a lab face a deployment gap: real vessel traffic includes vendor quirks, transients and undocumented behaviours the testbed never produced. The literature acknowledges the gap; it has not yet closed it. Established
Regulation already moved
MSC.428(98) made cyber risk a part of the safety-management system from 2021; UR E26/E27 turned that into surveyed, mandatory design requirements on newbuilds from July 2024 — network segmentation, hardening, logging and incident-response capability are now class items, not best practice. The regulatory floor exists; the question is what sits above it. An AI detector is a candidate component of the 'detect' function these rules require — not a substitute for the segmentation and hardening that are the actual requirement. Established
What we know
- Cyber resilience is mandatory on new international ships ≥500GT contracted from July 2024 (UR E26/E27 Rev.1).
- Unsupervised anomaly detection is the only viable ML family aboard — labelled ship-attack data barely exists.
- Ship networks are OT with constraints IT security tools weren't built for.
What we don't
- Public evidence of AI intrusion detection running on production commercial vessels at scale.
- How detectors handle proprietary protocol diversity across fleets.
- Whether the false-alarm rate is tolerable for crews without SOC support.
Being tested
- Passive bus/traffic anomaly detection on testbeds and training vessels.
- Cross-layer (IT+OT+RF) correlation architectures.
- On-device edge inference for shipboard security tools.
Maritime-GPT analysis
The regulation is real and the need is real — the AI is the least-proven part. The honest position: anomaly detection can add a layer on top of the segmentation and hardening UR E26/E27 mandate, and it may be the only way to watch a network that can't be patched. But buyers should treat 'AI ship cybersecurity' claims the way class treats the equipment — ask for the validation environment, not the model name. Detection aboard is an assist, not a firewall. Maritime-GPT analysis
This is a research feature, not operational guidance. Simulation results are reported as simulation; demonstrations are not deployments; company claims are attributed as such. Verify safety-critical decisions against official nautical publications and flag-state requirements.
Sources & evidence
The regulation that made ship cyber resilience surveyed, not voluntary.
Embedded cyber risk into the ISM Code — the compliance floor for fleets since 2021.
Scope, applicability and survey detail of the mandatory requirements.
Official statement of the July 2024 mandatory application date.