Can the cyber risk of maritime equipment really be assessed by simply counting CVEs?
CYTUR analyzed data from its recent maritime equipment Risk Assessments. 94% of the assessed systems fell into the Appropriate or Required risk treatment categories under IACS Recommendation 171, indicating that additional risk mitigation measures should be considered or were required.
But the more important finding was not the 94% itself.
The assessments showed that real cyber risk was shaped not only by the number of known vulnerabilities, but also by active ports and services, network connectivity, software and firmware status, attack surface, and the potential impact on vessel operations and safety.
This CYTUR Threat Brief explores a more important question:
Not simply “How many vulnerabilities are there?” but “What real-world risk could those vulnerabilities create onboard a vessel?”
The report includes real assessment cases where CVE counts differed by more than tenfold but resulted in the same risk treatment category, as well as findings involving unnecessary exposed services, vulnerabilities in third-party components, outdated software and firmware, and a case where remediation reduced the Risk Level from 20 to 12.
CYTUR Threat Brief | September 2026
Read the full report to explore the findings and understand what actually determines cyber risk in maritime equipment.