Maritime transport accounts for about nine-tenths of global trade by volume. The ports that handle these flows rely on increasingly interconnected digital systems, from terminal management software to automations controlling cranes and gantries. This accelerated digitization exposes critical links in the supply chain to cyber threats, the frequency of which has significantly increased over the past two years.
Port OT Systems: The New Attack Surface
Best practice guides published between 2019 and 2023 focused on protecting traditional information systems (IT): email, databases, office networks. The landscape has changed. According to Crisis24, 36% of maritime cyber incidents in 2024 target operational technologies (OT), meaning navigation systems, engine control, or dock automation systems.
A modern container terminal operates thanks to a Terminal Operating System (TOS) that orchestrates the movement of each box, from the ship’s hold to the delivery truck. This TOS communicates with programmable logic controllers (PLC) that command gantries, cranes, and automated guided vehicles. Compromising just one of these automations can immobilize an entire dock.
The IT/OT convergence creates a structural problem: port industrial equipment has life cycles of fifteen to twenty years, while software security patches follow monthly rhythms. This temporal asymmetry leaves vulnerabilities open for years. Managers interested in cybersecurity for port infrastructures must integrate this reality from the design phase of modernization projects.
Port Cyberattacks: Sharp Increase Since 2024
Recent data confirms an acceleration. According to Crisis24, 31% of maritime industry professionals reported a cyber intrusion in 2024, compared to 17% in 2023. The increase is significant enough for the topic to move from technical committees to executive management.
The dominant entry vector remains phishing, involved in nearly half of the maritime incidents recorded in 2024. Terminal operators and subcontracting SMEs are prime targets because their teams do not always have regular training in detecting fraudulent emails.
Cascading Consequences on the Supply Chain
A paralyzed port does not only penalize the port authority. Road transport companies, freight forwarders, customs, and warehouses in the back-port area suffer a domino effect, with potential delays on container flows lasting several days.
The direct cost of a terminal shutdown is difficult to quantify precisely, as it depends on the volume handled, the duration of the interruption, and contractual penalties. Available data does not allow for a reliable average amount to be concluded. However, field reports converge on one point: the time to resume operations almost always exceeds initial estimates.
NIS2 and Maritime Cyber Regulation: What Changes for Ports
The European regulatory framework has reached a new level with the NIS2 directive, which expands the scope of entities subject to cybersecurity obligations. Ports and maritime transport operators are explicitly included. Member states were required to transpose this text into their national law, which compels port authorities to review their cyber governance arrangements.
The obligations focus on several areas:
- Implementing a risk analysis covering all systems, including OT equipment and connections with logistics partners
- Mandatory notification of significant incidents to the competent authorities within constrained deadlines
- Responsibility of company management, which can no longer fully delegate the cyber issue to an external provider
- Extension of requirements to subcontractors and critical suppliers in the digital supply chain
For port SMEs (stevedores, shipping agents, pilotage companies), NIS2 represents a scaling change in documentary and technical requirements. Many still do not have an identified cybersecurity officer.
Alignment with International Frameworks
The International Maritime Organization adopted resolution MSC.428(98) as early as 2017, calling for the integration of cyber risks into security management systems. In the United States, the Coast Guard has published specific guidelines regarding connected port equipment. These frameworks overlap without always coordinating, complicating the task for operators present in multiple geographical areas.
Compromised Identities and Subcontracting: Persistent Blind Spots
Access management remains a rarely addressed issue in port security plans. A medium-sized port can have several hundred active accounts spread across permanent employees, temporary workers, maintenance providers, and shipping company agents.
The rapid turnover of operational personnel exacerbates the situation. Accounts remain active after their holders leave. Shared passwords circulate among teams to access container management systems.
The Equipment Suppliers Link
The industrial control systems installed in ports come from a limited number of manufacturers. An alert published by the U.S. MARAD in 2026 specifically raised concerns about certain Chinese-origin port equipment, reigniting the debate over technological dependence of critical infrastructures. Field reports differ on this point: some operators consider the geopolitical risk overestimated, while others have initiated audits of their equipment inventory.
Port cybersecurity is not just a technical issue reserved for IT teams. It touches on the continuity of international trade, sovereignty over logistical data, and regulatory compliance for port companies.
Ports that have not structured their cyber governance by the full implementation of NIS2 expose themselves to sanctions and an operational risk that the increase in attacks makes less and less theoretical.