In an industry undergoing rapid digital transformation, the operational interface between vessel, satellite, and shore has become maritime’s most contested front line. Few industry leaders understand this intricate territory as practically as Apostolos Giannetsos, ICT & Digital Transformation Executive at Cyprus Sea Lines.

Responsible for navigating one of the region’s premier fleets through the converging pressures of LEO satellite adoption, heightened cyber-physical threats, AI integration, and rigid regulatory frameworks like NIS2 and IACS UR E26/E27, Giannetsos approaches maritime technology with refreshing realism. For him, fleet resilience is neither a marketing slogan nor a paper-compliance exercise; it is an unforgiving operational discipline built on strict network segmentation, disciplined bridge cross-checks, and continuous emergency drills.

In this exclusive executive interview, Adonis Violaris speaks with Apostolos Giannetsos to unpack the working version of maritime cyber security and satellite connectivity, cutting through commercial hype to address how modern fleets must defend themselves in an increasingly volatile digital and geopolitical environment.

 

Apostolos, a year ago people across conferences were debating “connected fleets under siege” as a conceptual talking point. Today, that phrase feels like an understatement. Looking at your daily operations at Cyprus Sea Lines, what is the actual threat environment you are managing right now?

You are entirely right, Adonis. A year ago, “connected fleets under siege” sounded like a punchy conference slogan. Today, it is simply an accurate description of our day-to-day operating environment. We are experiencing a confluence where deliberate cyber attacks, severe GNSS interference, a massive LEO satellite connectivity boom, and aggressive regulatory enforcement have all arrived simultaneously.

On the geopolitical front, the 2025 grounding of MSC Antonia on the Eliza Shoals near Jeddah served as a stark reference case for weaponised navigation. Several maritime intelligence firms analysed the AIS and navigation data and concluded that deliberate GPS jamming and spoofing were a major factor. With final Flag State findings still pending, we treat the incident as a strong warning rather than a settled case. UKMTO continues to log severe spoofing and interference in the Red Sea and the Strait of Hormuz, with vessels suddenly showing positions miles inland or making impossible positional jumps. Those are the exact corridors our ships transit.

Ashore, it is just as relentless. We see AI-assisted phishing that imitates routine shipping correspondence almost flawlessly, ransomware targeting booking systems, and continuous probing of the remote access portals that every ship operator relies upon. DNV’s research noted that 31% of maritime professionals faced a cyber incident in the 12 months leading up to late 2024. The real shift is not just raw volume; it is sophistication.

 

 

Let us stay on the bridge for a moment. When a vessel enters high-risk waterways where electronic warfare and spoofing are rampant, how do you prevent bridge teams from blindly trusting corrupted digital instruments?

We drill a fundamental rule into our bridge teams: GNSS is merely one sensor, not absolute truth. The position shown on that screen is an opinion, and recently in the Red Sea, it is frequently a badly informed one. The MSC Antonia reconstruction demonstrated a receiver quietly accepting false data while the bridge team assumed they were safely on track.

To counter this, our operational protocol demands continuous, disciplined cross-checking. We cross-reference radar overlays, gyro compasses, depth sounders, and visual bearings, particularly around known regional hotspots. On newer vessels and during major refits, we install multi-constellation receivers covering GPS, Galileo, GLONASS and BeiDou, fitted with proper antenna siting and signal filtering. We also take account of IMO’s guidance on mitigating deliberate GNSS interference, including MSC.1/Circ.1644. We also feed inertial navigation data, AIS consistency checks, and engine telemetry into monitoring streams so that any unrealistic jump in speed or coordinate triggers an alert.

However, multi-constellation hardware alone is not a silver bullet; a sophisticated adversary can spoof Galileo just as easily as GPS. What truly proves most resilient is basic, disciplined seamanship: inertial data verified against radar and physical visual fixes. No electronic upgrade beats an attentive bridge team that treats a digital display as only one data point among many.

 

High-speed LEO satellite connectivity has revolutionised shipboard life over the past couple of years,with Starlink becoming almost standard. How do you balance this enormous demand for bandwidth with operational cyber security?

Starlink has undoubtedly been the single most transformative operational shift across our fleet in a decade. Being able to conduct live video troubleshooting between chief engineers and shore specialists, running uninterrupted machinery telemetry, and providing dependable welfare connectivity for crew calling their families has delivered tangible value. We are also evaluating Eutelsat OneWeb as a complementary secondary LEO channel and watching Amazon Leo with interest. LEO competition is healthy for budgets and redundancy.

However, high bandwidth can easily become a high-speed motorway into your operational core if left unmanaged. The industry has seen documented instances of seafarers buying retail satellite kits and plugging them directly into onboard networks, inadvertently circumventing every perimeter defence.

At Cyprus Sea Lines, our architectural rule is unambiguous: every satellite uplink is treated as untrusted by default. Terminals land in isolated, dedicated zones shielded by default-deny firewalls. Crew Wi-Fi is strictly partitioned on separate VLANs and SSIDs, and traffic is shaped so that business-critical fleet management and safety data invariably take absolute priority over recreational streaming.

 

Beyond the technical risks, there is also an emerging geopolitical dimension to satellite broadband that few seem willing to talk about openly. How do you view this landscape evolving?

It is a strategic question every shipping executive must confront. The LEO market is rapidly fragmenting along geopolitical fault lines. We have already witnessed commercial LEO operators altering or restricting coverage in conflict regions based on unilateral policy decisions. That may be their prerogative as private entities, but it sits completely outside a shipowner’s contractual service agreement.

Meanwhile, alternative sovereign constellations are accelerating. China is launching its Guowang and Qianfan networks at pace, with thousands of satellites planned. Russia deployed the initial operational batch of its Rassvet constellation earlier this year. Multiple providers will eventually offer technical redundancy, but it forces a critical strategic evaluation: whose digital infrastructure is carrying your fleet’s sensitive operational data, and what is your contingency if an overseas provider switches off access tomorrow? Connectivity sourcing is no longer a routine IT procurement; it is a board-level risk decision.

 

 

Vendors supporting modern vessels constantly demand remote access for maintenance, updates, and engine diagnostics. How do you control the ship-to-shore bridge without locking out vital technical support?

Every marine vendor wants an open, permanent tunnel into shipboard systems. Our default answer is a firm “no”.

Our vessel network architecture enforces strict physical and logical boundaries. Our Operational Technology (OT), administrative IT and crew networks are hard-separated. OT systems reside on dedicated VLANs protected by default-deny firewall policies, and only explicitly approved, documented paths can reach the shore. When a vendor must connect, they do so via encrypted VPNs utilising strict multi-factor authentication, least-privilege role permissions, and complete session logging. Every action must tie back into our formal change management records so we can always audit who changed what, where, and when.

For telemetry analysed ashore — performance, condition monitoring, selected navigation data — we use one-way transfer patterns, logical or physical data diodes, so the analytics platform cannot talk back into OT. That is the standard we design to on newbuilds and refits, consistent with IMO’s cyber guidelines and IACS UR E26/E27. Network segmentation may not sound glamorous, but when something goes wrong, it is the difference between an incident and a casualty.

 

Regulatory mandates have intensified, from IMO MSC.428(98) and IACS Unified Requirements E26 and E27 to the European Union’s NIS2 Directive. How are you handling this compliance burden, and what are inspectors really looking for?

Paper compliance in shipping is dangerously easy to fabricate, and modern inspectors know it. The European Maritime Safety Agency (EMSA) and proactive port State surveyors are no longer satisfied with browsing glossy manuals or high-level policy declarations. They are actively auditing objective evidence: verified software asset inventories, physical USB governance, training drill logs, and network configuration backups.

Furthermore, NIS2 brings uncompromising regulatory teeth into maritime management bodies: strict 24-hour early warnings, 72-hour comprehensive incident notifications, and direct personal legal accountability for board members.

Our approach is to test operations as though an audit is happening tomorrow. We carry out controlled failover and link-saturation trials on critical routers and firewalls. We run continuous vulnerability assessments feeding straight into our Safety Management System risk registers, alongside realistic tabletop simulations confronting ransomware, GNSS outages, and total communications loss. If an exercise does not yield at least one corrective procedural action, it was not rigorous enough.

Technical controls aside, human error remains the primary vulnerability exploited by threat actors. How do you cultivate a functional security culture among crew members serving demanding, months-long rotations?

Verizon’s 2026 DBIR puts the human element in 62% of breaches and reports median success rates around 40% higher for phone-centric phishing simulations (voice calls and text messages) than for email phishing. When you factor in generative AI, malicious emails and voice messages can mirror legitimate communications from real port agents, chandlers, or technical superintendents.

Annual e-learning alone is not enough to change behaviour. Our training is embedded directly on board through brief, highly practical scenarios during routine safety drills. When we conduct simulated phishing exercises, they look identical to everyday shipping workflows. We train personnel on strict verification pathways and escalation protocols rather than trusting gut instinct.

Equally vital is how leadership responds to mistakes. When a seafarer or an office staff member flags a suspicious communication or admits to clicking an erroneous link, they are commended for speaking up. If you punish people for reporting security near-misses, they simply stop reporting them, and you lose your most valuable tripwire.

 

 

The maritime industry is racing to adopt Artificial Intelligence. Where is Cyprus Sea Lines directing AI investments, and where do you urge caution?

We focus our near-term AI investments in areas where clean data delivers measurable returns. Specifically, this means automated anomaly detection across complex network telemetry and predictive maintenance algorithms for main engines and critical auxiliaries. While we utilise voyage optimisation and weather routing analytics, every model is thoroughly vetted against human seafaring experience and established KPIs. We never allow an unexplainable algorithmic black box to dictate a passage plan.

The immediate hazard industry-wide is “shadow AI”. Verizon’s 2026 DBIR reports that employee AI use on corporate devices tripled in a year, from 15% to 45%, and that 67% of those users accessed AI services through personal accounts. The imminent threat is not an apocalyptic rogue system; it is confidential commercial data, voyage logs, or proprietary technical documentation being pasted into public consumer AI portals by well-meaning employees. Every AI tool we use must reside within our formal governance structure, fully aligned with the EU AI Act, now in phased application. We leverage AI to strengthen our analytical edge, but we never substitute it for baseline cyber hygiene: identity controls, disciplined patching, and hard segmentation.

 

 If a worst-case scenario occurs—a total satellite blackout, corrupted ECDIS, or a vessel-wide cyber lockdown—what does operational resilience look like in practice?

Our design philosophy is simple: whenever any new digital system is proposed for a ship, our very first question is, “What does the crew do when this fails?” If there is no clear, safe answer, that system does not get installed. We design on the assumption that GNSS can be jammed, broadband links can drop, and networks can fail.

If the primary bridge systems fail, our teams fall back immediately to core seamanship: radar fixes, visual bearings, echo sounders, and the vessel’s approved chart backup arrangements — paper charts where applicable. We routinely rehearse operating under degraded-ECDIS and denied-GNSS conditions. Complete, hard-copy playbooks and incident response checklists are kept physically on board, because a digital recovery manual stored on a frozen cloud drive is useless.

If satellite broadband drops, communications immediately revert to MF/HF radio and VHF, prioritising MRCCs and our company crisis centre. Resilient operation is not about assuming your technology will never break; it is about designing for the ship to keep operating safely when it does.

Looking forward over the next 18 to 24 months, what should executive teams across the Cyprus and Greek shipping clusters prepare for?

The defining challenge will be convergence and compression. Four distinct curves are rising simultaneously: stringent regulatory supervision under NIS2 and IACS requirements, cyber-physical warfare targeting navigation, generative AI outpacing governance, and satellite connectivity tangled with international geopolitics. Each of these demands executive attention, budget, and engineering bandwidth.

For owners and managers across Cyprus and Greece, I see three clear priorities:

First, master the core fundamentals. Zero-trust segmentation, robust identity management, disciplined patching schedules, and practical drill procedures matter infinitely more than buying another niche software subscription. The coming period will reward relentless, boring operational excellence.

Second, formalise AI governance immediately. Establish explicit policies outlining approved applications, risk parameters, and strict rules regarding what data may leave the organization before informal use sets a dangerous precedent.

Third, interrogate your third-party supply chain. Demand Software Bills of Materials (SBOM), conduct joint cyber resilience exercises with key technology vendors, and critically assess whose satellite infrastructure your fleet depends on.

Finding qualified personnel who understand both maritime operations and network engineering is tough across our region. Those who start now can scale their resilience methodically, sustainably, and on their own terms. The day will come when every operator faces a spoofing attack, a ransomware vector, or an unexpected satellite outage. Thorough preparation is what turns a potential crisis into a routine, boring event.