An exclusive CSN interview between Adonis Violaris and Dr Matthew Maheras

As commercial shipping becomes ever more digitally integrated, the industry finds itself operating at the crossroads of complex geopolitical friction and unprecedented connectivity. High-speed Low Earth Orbit (LEO) satellite networks, operational technology integration, and cloud-based services have transformed fleet efficiency, yet they have simultaneously exposed vessels and shore-based offices to sophisticated cyber vectors. From state-sponsored interference and spoofing to deepfake payment fraud and shadow artificial intelligence, the maritime attack surface has expanded well beyond the ship’s physical hull.

To explore these pressing challenges, Adonis Violaris, Managing Director of Cyprus Shipping News, sat down with Dr Matthew Maheras, President of the Association of Maritime Managers in Information Technology and Communications (AMMITEC) and Chief Information Officer of Metrostar Management Corp. In this wide-ranging discussion, Dr Maheras shares strategic insights from both an association perspective representing maritime IT leaders across Greek shipping and his executive role steering fleet digitalisation at Metrostar.

Matthew, looking at the geopolitical climate over the past couple of years, maritime cyber incidents have surged dramatically. From where you sit, what is the fundamental nature of this shift, and how are attack vectors evolving across our sector?

The fundamental change I observe is one of intent rather than simply volume. Untargeted, opportunistic cybercrime has largely given way to the deliberate targeting of shipping as critical national and international infrastructure. Operational technology aboard vessels has moved firmly into scope rather than remaining an abstract, theoretical concern. Reported maritime incidents have roughly doubled year on year through 2025 and into 2026, with the proportion touching OT systems being the fastest growing element within those numbers.

The more instructive shift lies in where these attacks actually originate. Increasingly, an intrusion does not begin at the shipowner’s own perimeter. It starts with a third-party manager, a port agent, an equipment supplier, an unmonitored remote maintenance session, or a compromised mailbox two organisations removed.

Alongside this, business email compromise has emerged as the most immediate and damaging financial risk in our sector, and it is certainly not hypothetical for our region. In July 2026, the Cyber Crime Prosecution Unit of the Hellenic Police identified suspects involved in a four million Euro fraud against a Greek shipping company, executed simply by intercepting correspondence with the company’s bank and substituting fraudulent payment instructions from a lookalike domain. The International Transport Intermediaries Club issued a similar alert in March 2026 regarding vessel invoice payments diverted through altered email identities and modified bank details.

What makes these attacks so dangerous is precisely that they are technically unsophisticated. No system aboard the vessel is breached. The threat actor merely inserts themselves as an entity the recipient already trusts, choosing a moment when the transaction appears entirely routine and the operational timing is urgent. The conclusion I draw, and one I consistently put to our members, is that an attacker no longer needs to break the ship. It is quite enough to break somebody who communicates with the ship. That reality reframes the entire defensive posture for our industry.

Navigation and satellite positioning have faced severe disruptions in sensitive corridors. How should owners approach GNSS vulnerabilities, and what secondary risks are emerging?

The standard working assumption across serious ship operators today is that GNSS must be treated as an untrusted input. Once an organisation accepts that premise, mitigation stops being a procurement dilemma and becomes an operational and procedural discipline, which is where it properly belongs.

What is proving most resilient in practice is rather unglamorous. It comes down to disciplined cross-checking of vessel position against radar, terrestrial and visual fixes, dead reckoning using gyro and speed logs, and, above all, bridge teams that are properly trained and actively encouraged to challenge an implausible position on the screen rather than trusting it blindly. Clear fleet circulars defining known jamming corridors, combined with direct reporting channels back to the technical office so that jamming events are systematically logged rather than ignored, deliver far more value than any single piece of hardware.

At the same time, there is a second-order risk that is commercial rather than navigational, which remains widely underappreciated. The manipulation of AIS identities by sanctioned operators means a legitimate owner can suddenly find their vessel associated with illicit activity through an indirect ship-to-ship transfer one or two steps removed. This is a due diligence and regulatory compliance challenge rather than a bridge problem. It is precisely where behavioural analytics platforms are proving their worth. It also represents an acute vulnerability for smaller owners, because sophisticated screening platforms require significant investment, while the operational and reputational fallout of an erroneous sanctions association is severe and painfully slow to unwind.

The rollout of high-throughput LEO constellations such as Starlink has revolutionised shipboard connectivity. Does this sudden abundance of bandwidth reshape the cybersecurity equation?

LEO constellations did not so much create a new attack surface as remove the bandwidth constraints that had quietly kept the existing one in check. When connectivity was scarce, costly, and metered, a great deal of poor digital practice was simply impractical to execute. That operational brake has disappeared.

The approach I advocate is to treat the ship as a connected remote site with safety-critical operational systems and distinct physical and remote access constraints, applying corporate security standards while respecting its operational requirements. That means deploying managed endpoints with genuine endpoint detection and response capabilities, maintaining a strictly segregated crew welfare network, and enforcing access control at the shipowner’s own edge hardware rather than delegating security to the satellite terminal. There should be no assumption of trust simply because network traffic originates aboard the vessel. Furthermore, operators must maintain a diverse fallback communications path, ensuring that reliance on a single constellation does not inadvertently create a single point of failure.

The most challenging dimension here is governance rather than technology. High-speed pipes naturally invite unmanaged personal devices, unauthorized software, and consumer AI tools onto the vessel. That is a governance problem arriving disguised as a bandwidth upgrade, and many shipping organisations have yet to modernise their corporate policies to reflect the fact that the vessel is now just as connected as head office.

Given that human error remains a primary point of entry, how must we rethink maritime cyber training and crew awareness?

Annual training alone is insufficient given crew rotation schedules and the evolving threat landscape. It should be reinforced at joining and through brief, frequent, role-specific refresher modules that work even over intermittent connectivity. The aim is to make cyber awareness a continuous part of onboard practice.

The training content itself requires substantial reform. Generic phishing warnings do not reflect the sophisticated threats that seafarers and shore-based teams encounter today. Synthetic voice and video generation tools are now inexpensive enough to be deployed in standard payment scams, meaning our defence must be procedural rather than perceptual. We cannot expect employees to reliably spot an AI-generated fake. Instead, company policy must mandate strict out-of-band verification for any payment instruction or banking alteration, with zero exceptions granted for perceived urgency or executive seniority. Urgency and executive authority are the primary levers of the attack itself.

Underpinning all of this is the necessity of a genuine no-blame reporting culture. A crew member who clicks a suspicious link and reports it within five minutes is an invaluable asset. A crew member who clicks and remains silent out of fear of disciplinary action becomes the incident. This is why constructive collaboration with maritime training organisations is so critical, and it forms a major pillar of AMMITEC’s ongoing awareness work with bodies like HELMEPA.

Third-party access and remote maintenance have become essential for modern machinery support. How can shipowners mitigate the supply chain risks associated with external vendors?

Remote maintenance access is currently the widest open door across our industry, and unfortunately the least guarded. As an absolute baseline, every shipowner should maintain an exhaustive, continuously updated register of every external vendor possessing access of any kind. Direct connections should be replaced with brokered access, multi-factor authentication must be mandatory without exception, access rights should be granted only for defined time windows rather than left permanently active, and full session logging must take place.

It is equally essential to transition this requirement out of informal IT practice and directly into commercial contracts. Standard ship management agreements increasingly feature robust cybersecurity clauses covering clear divisions of responsibility, realistic incident notification timeframes, and audit rights that are actively exercised rather than merely drafted on paper.

Handovers between technical managers warrant extreme vigilance, as that is precisely when legacy accounts, orphaned mailboxes, and dormant endpoint agents outlive the commercial relationship. This is an arena where an industry association can achieve what an individual company cannot. Our members are negotiating similar terms with an overlapping group of global vendors. Establishing unified baseline expectations across the Greek and Cypriot maritime clusters will raise standards across the board, relieving smaller operators of the burden of creating their own technical standards in isolation.

Artificial intelligence is dominating corporate agendas. Where do you see AI genuinely contributing to maritime IT, and where are the hidden risks?

Practical maritime investment in AI is concentrating in two distinct areas: threat detection and response, where machine learning dramatically improves signal-to-noise ratios and accelerates containment, and regulatory screening, where the capability to analyse complex fleet relationships and anomalous vessel behaviour surpasses human capacity.

However, the more immediate question is not what technologies companies are buying, but what tools employees are already using without corporate oversight. Shadow AI represents the defining governance risk for our sector over the next two years. Highly sensitive commercial information, charter party clauses, seafarer personal documentation, and proprietary vessel drawings are being pasted into public consumer AI models daily. Traditional data loss prevention tools in shipping were never designed to intercept that activity.

AI governance must apply consistently at every level of the organisation, including the executive suite, where particularly sensitive commercial information is handled. Senior leaders should set the example by using approved tools and following the same data protection and acceptable use policies expected of all employees.

The logical sequence must always be governance prior to tooling: a well-defined acceptable use policy, strict data classification defining what can never leave corporate boundaries, enterprise-sanctioned AI tools that prevent staff from seeking unvetted consumer alternatives, named accountability for AI risk, and alignment with emerging frameworks like the EU AI Act and ISO/IEC 42001.

In this regard, Greece’s proposed constitutional revision offers an encouraging signal through draft Article 5B, which outlines that artificial intelligence must serve individual liberty and societal welfare. While this proposal must pass the next Parliament to take legal effect, the underlying direction is significant. Establishing at a constitutional level that technology must serve humanity provides corporate boards with a clear principle beyond basic compliance checklists. To support our community, AMMITEC has formed a dedicated AI working group developing our Maritime AI Playbook (MAP-AI), supported by a memorandum of understanding with AI Catalyst Greece to channel wider technological expertise into the maritime sector.

Looking forward over the next 18 to 24 months, what is the single biggest hurdle facing maritime IT managers, and what should be their immediate priority?

The single greatest hurdle will be the direct collision between an increasingly dense regulatory stack and the lean resource realities of typical Greek and Cypriot shipping companies. IMO cyber risk guidelines, the mandatory IACS Unified Requirements E26 and E27 for newbuildings, national transpositions of NIS2, and the EU AI Act are descending simultaneously upon companies whose internal IT departments often consist of just one to three professionals.

The grave risk is that all of this is treated as mere paperwork. An organisation can look impeccably compliant on paper while remaining utterly incapable of answering the only operational question that matters: what happens when a vessel underway loses its systems on a Sunday night?

My advice is practical and direct. Assign cyber risk to a named executive with direct board access and a dedicated budget. Conduct comprehensive, cross-departmental incident rehearsals at least once a year, bringing technical, operations, and chartering teams into the room alongside IT. Ensure your third-party vendor and remote connection registers are thoroughly updated before an auditor or an incident forces the issue.

Crucially, invest in verified security rather than administrative documentation. At Metrostar, we have mandated the Cyber Secure class notation for every newbuilding delivered from 2024 onward. This ensures that security architecture, system hardening, and network segmentation are engineered directly into the vessel at the shipyard and independently validated by Class prior to delivery. A class notation requires you to demonstrate that security controls function on physical shipboard machinery to an external auditor, which is an entirely different and far more rigorous discipline than preparing an office compliance folder.

Ultimately, this is why collaborative industry associations matter so deeply. Smaller shipowners across Greece and Cyprus cannot manage this operational burden alone. Developing shared threat intelligence, harmonised vendor requirements, and unified technical frameworks are no longer optional extras. Over the coming two years, they represent the clear dividing line between nominal compliance and true operational resilience.