Maritime Sector Launches Dedicated Vulnerability Database for IT and OT Risks

A new industry coalition has launched the Maritime Vulnerabilities Repository (MVR), the first database dedicated exclusively to tracking information technology (IT) and operational technology (OT) security flaws within the global shipping sector.

The Blue Initiative — a partnership comprising cybersecurity vendors Cydome and Rakuten Maritime, alongside certification specialist Bureau Veritas, classification society ClassNK, and the Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC) — aims to bridge a critical intelligence gap. While general-purpose repositories such as the National Vulnerability Database (NVD) catalog thousands of Common Vulnerabilities and Exposures (CVEs), identifying which flaws specifically affect specialized maritime systems remains a challenge for vessel operators.

Focused Intelligence for Shipboard Systems

The MVR will focus strictly on vulnerabilities relevant to maritime infrastructure, including systems used for navigation, propulsion, and cargo management. By filtering out irrelevant IT flaws, the initiative aims to provide security teams and vessel owners with a more efficient way to manage risks.

According to Cydome, identifying flaws in specialized maritime equipment has historically been difficult because relevant information is often scattered across various vendor advisories and broad databases. The new repository is intended to serve as a public, open “single source of truth” for the industry.

To ensure the quality of the data, all proposed entries to the MVR will undergo a validation process. Researchers from Cydome and other partners will review and refine the technical details before publication. Notably, the group has committed to a policy of only publishing vulnerability details once a patch or mitigation is available from the affected vendor.

Escalating Threats to Maritime Infrastructure

The launch comes amid a period of heightened cyber activity targeting the shipping industry. In August 2026, the US Coast Guard and the FBI were required to board two oil tankers in the Gulf of Mexico following cyber-attacks that targeted on-board systems. These intrusions reportedly breached both IT and OT networks, interfering with critical functions including navigation and propulsion.

Furthermore, extortion groups have recently claimed to have targeted dozens of global maritime organizations, including port operators and carriers. While many of these claims remain unverified, they highlight the growing interest threat actors have in maritime critical infrastructure.

“Cyber resilience for ships is not simply a checklist for audits, but a continuous process throughout a vessel’s operational life,” said Panagiotis Anastasiou, cyber technical and market leader at Bureau Veritas Marine & Offshore. He noted that owners are expected to maintain the security of systems as new flaws emerge, a task that has been complicated by fragmented information.

Operational Integration

The MTS-ISAC has already integrated the new repository into its operational workflows. This allows the organization to contribute community-driven situational awareness while leveraging the database to provide better alerts to its members.

Users of the MVR will be able to browse CVEs, filter results by specific equipment or vendors, and subscribe to alerts for new vulnerabilities affecting their specific fleets. This proactive approach is expected to significantly reduce the time between the discovery of a flaw and its remediation on active vessels.