Key Takeaways
- Maritime VAPT is multi-environment: vessel OT, vessel IT, shore IT, port terminal systems, satcom links and crew networks each need a discrete test plan.
- Scope separation between IT and OT is decided first. OT testing on a vessel at sea is dangerous and almost always restricted to passive observation plus port-stay active testing.
- Port terminal systems (TOS, gate, cranes, RFID, port community systems) are tested with adapted IT methodology plus IEC 62443 awareness for the OT subset.
- Crew WiFi is a recurring entry point. A flat network where crew BYOD reaches bridge OT is a finding in nearly every engagement that finds one.
- Reporting is built for flag state audits, P&I clubs, charterer questionnaires and the BIMCO gap closure cycle, not just for the IT team.
Why Maritime VAPT Is a Distinct Discipline
Maritime VAPT brings together several disciplines that are usually scoped as separate engagements: enterprise IT pentest (shore office), OT pentest (bridge and engine systems), wireless pentest (crew WiFi and bridge wireless), network pentest (vessel LAN, port LAN), cloud pentest (fleet operations platforms), and supply-chain assessment (chart vendors, satcom providers, planned maintenance vendors). Treating them as a single coherent engagement is how we produce a report that satisfies IMO 2021, BIMCO, and the flag state in one document.
The other distinguishing factor is the safety constraint. A web app pentest can fuzz a login form. A maritime OT pentest cannot fuzz a propulsion alarm, an autopilot, or a cargo control loop while the vessel is operational. Methodology is built around what is safe to do when, often translating to passive observation at sea plus deeper active testing at port stay or in dock.
Scope Definition: IT vs OT, Vessel vs Shore
Scoping is the most important hour of the engagement. The customer typically arrives with one of three positions: 'test everything', 'test the vessel only', or 'test the IT systems only'. None of these is precise enough. The engagement letter must enumerate each environment and each test method per environment.
Our standard scope template covers six environments and three test depths per environment (passive observation, active non-disruptive, active intrusive):
- Vessel OT: bridge systems, engine monitoring, cargo control, ballast and scrubber control. Typically passive at sea, active non-disruptive at port
- Vessel IT: ship office workstations, planned maintenance system, document management. Standard pentest depth
- Crew network: welfare WiFi, BYOD segment, captive portal. Standard wireless pentest depth
- Shore IT: head office, fleet operations centre, ERP, chartering and accounting. Standard enterprise pentest depth
- Port terminal systems: TOS, gate systems, cargo manifest, port community system integration. Standard pentest with OT awareness for the controlled subset
- Vendor and cloud surface: satcom portal, chart distributor, planned-maintenance vendor, fleet platform. Standard cloud and API pentest depth
Need Maritime Cyber Assessment?
Codesecure runs IMO 2021 and BIMCO-aligned cyber risk assessments and OT pentests for shipowners, managers, ports and terminals. ISO/IEC 27001:2022 certified, named consultants with OSCP and ICS credentials, fixed-price proposals and free retest within 90 days.
See Maritime Services →Vessel Network Topology Testing
Once on board, the first task is mapping the actual network as it exists, not as the network drawing claims. We start with passive observation using a SPAN port (where available) or a managed switch with mirroring, capturing on the bridge LAN, the satcom LAN segment, the crew network, and the engine room network. The capture reveals every device that talks, every protocol in use, every vendor remote diagnostic session, and every cross-zone path the firewall is supposed to be blocking.
Active discovery follows, with constrained Nmap (-sT, low-rate, no service probes against OT-bearing hosts), targeted protocol scans (NMEA 0183 over Ethernet, IEC 61162-450 multicast, Modbus where present in engine or cargo systems), and configuration walk-throughs of every accessible switch, router and firewall. The output is a corrected network diagram, a complete asset inventory, and a list of every cross-zone path with its policy and actual traffic observation.
Port Terminal Systems
Port pentest engagements have a different shape. The terminal operating system (TOS) sits at the centre, integrating with cargo manifests, gate access, crane and equipment control, RFID and barcode scanning, the port community system (PCS), and the customs declaration channel. Each is its own attack surface.
TOS platforms (Navis N4, Octopi, CyberLogitec OPUS Terminal, KALEIDO and others) are typically web or thick-client applications backed by enterprise databases. We test them with standard OWASP web and API methodology plus role-based access tests across operator, supervisor, gate clerk and customer-portal roles. Crane and equipment control are tested as constrained OT (refer to our IEC 62443 maritime guide). RFID gate systems are tested for tag cloning resistance, replay attack resistance, and gate-relay logic abuse.
Common findings: TOS instances with default vendor credentials retained, RFID gate badges using cleartext UIDs trivially clonable with a Proxmark, port community system APIs with broken object-level authorisation (BOLA) across terminals, and customs integration channels with weak authentication.
Crew WiFi: The Recurring Pivot Point
Crew welfare WiFi is the single most-exploited vessel attack path in our engagements. The crew network is by design lower-trust than the ship office or the bridge, but if it shares a physical switch with no VLAN separation, or if the captive portal logic has bypasses, or if the access points expose management interfaces to the crew segment, then a crew device or a visitor can reach into the higher-trust zones.
Standard tests include: enumerate from a crew-network position, attempt to reach the ship office subnet, attempt to reach the bridge OT subnet, attempt to reach the satcom management interface, attempt to bypass the captive portal (DNS tunnelling, MAC spoofing, ICMP tunnelling, captured guest credentials), and attempt to compromise the AP management plane. Findings are typically straightforward to remediate (proper VLAN separation, firewall rules between zones, AP management isolation) and difficult to argue against.
Flag State Audit or Customer Questionnaire?
Whether you need cyber evidence for a flag state, P&I club query, charterer security questionnaire or BIMCO gap closure, our maritime cyber lead is available for a 30-minute free scoping call.
Talk to a Maritime Lead →Pre-Port-Entry Cyber Testing and Inspections
Several major ports and a growing number of charterers now ask for a recent cyber assessment as a precondition for entry or charter. Singapore (MPA), Rotterdam, Antwerp, Houston, the larger UAE ports, and many cruise terminals already integrate cyber questions into their pre-arrival inquiries. India's Major Port Authorities are adopting similar practices.
Codesecure delivers pre-port-entry cyber assessments tuned to the questions the receiving port or charterer is likely to ask. The engagement is shorter than a full vessel pentest (typically 1 to 3 days) and produces a one-page attestation plus an evidence pack the master and DPA can hand over on request. Where a deeper finding emerges, we offer a follow-on full assessment.
Reporting for Flag State, Class, P&I and Charterer
A maritime VAPT report must serve four distinct audiences in one document. The flag state and class society want IMO 2021 and BIMCO control evidence. The P&I club and hull insurer want a risk posture statement that informs premium and excess. The charterer wants a security questionnaire that closes their queries. The internal IT and DPA team want the technical detail with remediation steps.
Our reports map each finding against MSC-FAL.1/Circ.3 functional elements (Identify, Protect, Detect, Respond, Recover), BIMCO Guidelines control areas, IEC 62443 zones and conduits, ISO/IEC 27001:2022 Annex A controls where applicable, and the OWASP Top 10 for web-facing components. CVSS v3.1 with environmental modifiers gives the risk number. A maritime-specific severity overlay (Safety-Impacting / Operations-Impacting / IT-Only) sits alongside CVSS so the bridge and the DPA can read the report as easily as the CISO. Free re-test within 90 days is standard.
Frequently Asked Questions
Can you test our vessel while it is at sea?
Limited testing only. Passive observation (packet capture, configuration review with the chief engineer, document review) is safe at sea. Active testing of OT systems is restricted to port stay or dry dock for safety reasons. Standard active testing of vessel IT and crew networks is fine at sea but requires reliable satcom for the consultant to be remote, which adds cost.
Do we need to be in port for a maritime VAPT?
Most engagements include at least one port-stay visit. For a fleet, a representative vessel per class is typically tested deeply at port and the findings extrapolated across sister vessels with a desk review. Where physical visit is not feasible, we run a remote engagement via the ship office VPN plus master interview and document review.
How long does a vessel pentest take?
A single-vessel engagement covering vessel OT, vessel IT, crew network and satcom typically runs 3 to 5 days on board plus 4 to 5 days of reporting. Fleet engagements covering a representative vessel per class run 6 to 10 weeks end to end depending on class diversity.
Do you also test the shore office?
Yes, where in scope. Most maritime customers ask us to bundle the head office and fleet operations centre pentest with the vessel engagement. Many cyber incidents originate shore-side and propagate to the vessel through legitimate shore links, so the combined scope is more useful than either alone.
Does Codesecure deliver outside India?
Yes. Maritime engagements run across India, Singapore, UAE, the Middle East and parts of Europe and Australia. Our consultants travel to vessels at port stay or to shore offices as the engagement requires. ISO/IEC 27001:2022 certified delivery applies regardless of location.
How much does a maritime VAPT cost?
A single-vessel pentest at port stay typically runs INR 4 to 10 lakh equivalent depending on environment depth (vessel-only versus vessel plus shore). Fleet engagements are priced per representative class with shared shore-side fees. Codesecure provides fixed-price proposals after a 30-minute scoping call.
Get A Maritime Pentest That Auditors and Insurers Trust
Codesecure runs maritime VAPT for shipowners, managers, ports and terminals across India, Singapore, UAE and the Middle East. ISO/IEC 27001:2022 certified delivery, named consultants with bridge OT and port systems experience, IMO 2021 and BIMCO aligned reporting.
