Maritime industry launches new database to track cyber vulnerabilities

According to Cydome Security, more than 350,000 Common Vulnerabilities and Exposures (CVEs) have been published globally, with approximately 200 new entries added daily.

This growing volume of information makes it increasingly difficult for maritime operators to determine which vulnerabilities pose risks to their particular equipment and operating environments. Earlier in October, Cydome warned that an alleged ransomware attack may have exposed operational and commercial information involving dozens of maritime organizations.

The Blue Initiative addresses this challenge by focusing on vulnerabilities relevant to ships, ports, offshore facilities and supporting shore-based systems. Its database allows users to browse vulnerabilities, filter results by equipment or vendor, access technical information and subscribe to alerts about newly identified security issues.

Supporting maritime cyber resilience

The publicly available platform combines vulnerability information with maritime-specific classifications and, for selected entries, expert analysis explaining potential operational implications.

Cydome CEO Nir Ayalon said the initiative’s objective is to establish a common reference point for maritime cybersecurity risks, helping IT teams, equipment manufacturers and researchers identify vulnerabilities relevant to individual vessels and systems.

ClassNK also emphasized the importance of identifying vulnerabilities affecting equipment actually deployed onboard ships. Naoki Saito, General Manager of its Ship Management Systems Department, described the initiative as a practical resource that could support more effective vulnerability management.

Meanwhile, Panagiotis Anastasiou, Cyber Technical & Market Leader at Bureau Veritas Marine & Offshore, highlighted that cyber resilience requires continuous attention throughout a vessel’s operational life, rather than simply meeting requirements during audits. He noted that vulnerability information is often fragmented across general-purpose databases and equipment manufacturers’ advisories, complicating efforts to maintain onboard cybersecurity.

MTS-ISAC has integrated the initiative into its operational information-sharing workflows, while Rakuten Maritime emphasized the importance of monitoring equipment vulnerabilities throughout a vessel’s lifecycle, from design to operation.

In the smart-ship era, cybersecurity isn’t something to leave to the shipyard. It is something owners have to own themselves

… the Managing Director of Rakuten Symphony Singapore & Korea and Head of Rakuten Maritime, Ryan Son, had previously told SAFETY4SEA.

Industry collaboration and access

The Blue Initiative is operated by Cydome Security, with contributions from the four partner organizations. The database draws on public vulnerability records and cybersecurity advisories, using automated processes to identify and classify relevant entries. Selected vulnerabilities receive additional analyst reviews and technical commentary.

The initiative is freely accessible and open to additional maritime organizations interested in contributing to its development.