Maritime & Ports. Software supply chain security from the bridge to the gate.
Container terminals, shipping lines, port operators, and the logistics partners around them now run on software supplied by a small set of OEMs and integrators. IMO 2021, the EU CER Directive, and national port-cyber regulators turn every shared library — from crane control to customs interface — into an audit obligation. Safeguard makes that obligation a live query against signed evidence.
Four forces converging on the quay.
Flag-state regulators, port-state inspectors, and ransomware crews are collapsing into one continuous evidence requirement.
IMO 2021 cyber resilience
IMO Resolution MSC.428(98) makes cyber-risk management part of the safety management system on every flagged vessel. Continuous evidence across vessel-to-shore software is now an audit obligation, not a working group.
EU CER + national port cyber regs
The EU CER Directive, national rules like the KSA NCA OTCC and Indian DGS guidelines, and US MARSEC pull port operators into the regulated critical-infrastructure perimeter. Annual paper audits will not satisfy any of them.
Customs-data exchange security
Customs brokers, single-window interfaces, and pre-arrival manifests run on software supplied by a small number of vendors. A compromise in that interface is a national-trade incident, not a vendor incident.
OEM concentration on terminal software
A handful of vendors supply the crane control, gate operating, and terminal management systems running the world's container throughput. A shared transitive dependency can cascade across continents.
Capability mapped to terminal-engineering reality.
SBOM for crane + terminal-management software
Every release of terminal-operating, crane control, and gate-system software emits a signed CycloneDX SBOM. Reachability analysis identifies which OEM library is actually wired into production movements.
Reachability-aware OT patching
Patch windows on terminal OT are scarce and expensive. KEV + EPSS + reachability turns the CVE firehose into a ranked, defendable worklist that respects vessel calls and gate schedules.
Signed provenance for GPS/AIS integrations
Navigation and AIS-receiving libraries embedded in vessel and port systems are attested at build time, hash-pinned, and tied to the SBOM that produced them. Spoofing-class libraries surface before they sail.
Vendor risk heatmap across logistics partners
See your single-point-of-failure components across customs brokers, terminal operators, and shipping line software. Concentration risk surfaces at the library level, not the contract level.
Frameworks the platform is mapped to.
Pre-mapped control narratives and evidence in the formats your port-state inspector and maritime auditor already accept.
A typical deployment in a regulated port operator.
Port-side DMZ control plane, vessel-to-shore audit log, logistics-partner concentration heatmap, and a customs-interface attestation portal — all under the operator's control.
Port-side DMZ control plane
Control plane runs in the port operator's DMZ with one-way ingress from terminal OT. No cross-tenant traffic, no shared key material across operators or shipping lines.
Vessel-to-shore audit log
Signed events from vessel scanners and shore-side terminal systems stream into the operator SIEM in JSON and CycloneDX. Chain-of-custody survives a port-state inspection.
Logistics concentration heatmap
Cross-vendor dependency rollup across crane, gate, customs, and TOS software. Concentration risk lights up before a shared library compromise ripples through a corridor.
Customs-interface attestation
Read-only attestation portal for customs authorities and single-window operators. SBOMs, VEX, signed provenance — exposed on demand, no email attachments.
Four risk surfaces your harbour master already worries about.
Ransomware on terminal-operating systems
NotPetya-class wipers continue to reach terminal-operating systems through corporate IT, taking gate, crane, and yard operations offline. The blast radius is throughput, not just servers.
GPS/AIS spoofing through libraries
Vulnerable AIS-receiving and GNSS libraries embedded in vessel and shore systems can be coerced. A spoofed track changes routing decisions before any operator notices the discrepancy.
Customs-broker software compromise
A compromised customs broker, single-window operator, or pre-arrival manifest provider is an attack on national trade — not just on one ship-owner or terminal.
OEM crane firmware vulnerabilities
Long-lived crane and gate-control firmware with deep transitive dependencies create a 10+ year vulnerability tail. Without signed SBOMs, you cannot tell a benign update from a tampered one.
What is actually hitting maritime and ports this year.
- KEV CVEs in terminal-operating system libsShared libraries underneath TOS and gate-operating software ship with KEV-listed CVEs that are seen exploited in the wild within days.We address this through Eagle reachability + KEV prioritisation
- AIS spoofing exposing routingVulnerable AIS and GNSS libraries are coerced via spoofing — a software supply chain failure that changes routing decisions before any operator notices.We address this through SCA on navigation libraries
- Customs interface tamperingCustoms single-window and pre-arrival manifest interfaces are increasingly targeted; a compromise is a national-trade event, not a vendor event.We address this through TPRM with vendor attestation
- Ransomware on intermodal schedulingRail-port and intermodal scheduling systems share libraries with TOS; a single ransomware event stops both yard and inland moves.We address this through Signed SBOM + reachable-CVE prioritisation
- Vendor SBOM gaps in OEM crane softwareLong-lived OEM crane and gate-control firmware lacks signed SBOMs, making 10+ year vulnerability tails impossible to audit defensibly.We address this through Comply with global regulations
Quantified benefits for maritime and ports.
Numbers from production deployments. Same OEMs, same terminals, dramatically less spreadsheet.
| Metric | Before Safeguard | With Safeguard |
|---|---|---|
| Terminal cyber audit prep | 8 weeks | 2 days |
| OT-vendor monitoring | Quarterly | Continuous |
| Vessel-to-shore patch cycle | 21 days | 4 days |
| Alert noise | ~75% | ~5% |
| Tool consolidation | 6 vendors | 1 |
| Customs-interface attestation prep | 2 weeks | 30 min |
| Logistics-partner concentration | Hidden | Mapped |
Evidence at the speed of a port-state inspection.
Talk to the team about IMO 2021 evidence pipelines, port cyber audit mappings, and a deployment shape that lives inside your terminal perimeter.