Cybersecurity Solutions for Yachts: System Hardening Guide

Key takeaways

There is no single yacht cybersecurity product; effective protection is a set of per-system controls across navigation, satellite comms, engine networks, AV/IT and crew devices.
The IMO's MSC-FAL.1/Circ.3 guidelines make cyber risk management part of safety management, with the owner setting policy, the captain owning the plan and crew accountable for their devices.
Navigation and ECDIS systems are the highest-consequence attack surface, with USB chart updates and visiting engineers' laptops the usual infection routes.
Segment networks into crew, guest and operational zones, and treat satellite terminals as their own trust zone with changed default passwords and disabled WAN remote management.
Tie hardening tasks to haul-outs and refits, logging firmware versions, password rotations and access grants as dated work orders for insurers and surveyors.

Cybersecurity solutions for yachts are practical controls applied to each onboard system: ECDIS and navigation gear, VSAT and Starlink links, engine networks, AV/IT, and crew devices. This guide maps each system to a hardening checklist you can run during a haul-out or refit, so cyber tasks get scheduled like antifouling or generator service instead of sitting in a compliance binder.

What are cybersecurity solutions for yachts?

There is no single product called "yacht cybersecurity." What works is a set of per-system controls: firewalls and firmware updates on navigation kit, segmented networks for VSAT and Starlink, locked-down engine and automation VLANs, managed Wi-Fi for crew devices, and access rules for contractors during a refit. A modern yacht is a floating network, and each of those layers fails differently (cybersecurity and onboard systems on modern yachts). The baseline is regulatory, not optional. The IMO's Guidelines on Maritime Cyber Risk Management (MSC-FAL.1/Circ.3) treat cyber risk as part of safety management, which puts responsibility on the captain and vessel manager, not just the shore-side IT contractor. For a marine business, the practical entry point is the work order: quote the survey, the firewall swap, and the network audit as line items, then track them like any refit job.

Which onboard systems are actually at risk?

A modern yacht is a floating network, and every system that touches it is part of the attack surface. The ones that matter break down like this:

System	What's exposed	Typical entry point
Navigation and ECDIS	Chart data, autopilot, GPS feed	USB charts, maintenance laptops
Satellite comms	VSAT, Starlink, Fleet Broadband	Router admin panel, default credentials
Engine and automation	Engine control networks, monitoring, work order systems	Flat networks shared with guest Wi-Fi
AV/IT and CCTV	Guest streaming, camera feeds, media servers	Unsegmented VLANs, shared passwords
Crew devices	Personal phones, laptops, tablets	Phishing, rogue Wi-Fi, infected USB sticks

Navigation and ECDIS

Chart plotters and autopilots were built for reliability, not security. USB chart updates and visiting engineers' laptops are the usual infection routes. Treat the navigation LAN as its own zone.

Satellite comms and VSAT

VSAT and Starlink terminals are the yacht's front door to the internet. Default router passwords and unpatched firmware are the most common weaknesses we see flagged during refit planning.

Engine and automation networks

Engine control and monitoring systems often share a switch with the office network. If a work order or RFQ platform sits on the same flat network, one compromised laptop can reach the machinery space.

AV/IT and guest networks

Guest Wi-Fi, CCTV, and media servers are low-value targets with high-value access. Segment them from operational systems.

Crew devices

Crew phones are the least controlled and most used devices aboard. A haul-out window is the practical moment to audit them alongside antifouling and other yard work. More on this in our guide to cybersecurity and onboard systems.

What do IMO cyber risk management requirements mean for a yacht?

Since 2021, the ISM Code requires vessels to manage cyber risks as part of their safety management system, per IMO resolution MSC.428(98) and MSC-FAL.1/Circ.3. Yachts over 500 GT in commercial use fall under this directly; private yachts are not forced to comply, but insurers, flag states and charter managers increasingly ask for evidence of a plan anyway.

Who owns the cyber risk on a yacht?

The BIMCO/ICS Guidelines on Cyber Security Onboard Ships put accountability in this order: the company or owner sets policy, the master implements it, and every crew member follows it. In practice on a Med yacht, that means the owner signs off a budget, the captain owns the plan and reviews it at each haul-out or refit, and crew are responsible for the devices they bring aboard. If you are a technician or supplier doing RFQs and work orders through a platform, you are part of the yacht's attack surface too. Nautaes handles this on its side with verified provider accounts, and pricing is public at https://nautaes.com/en/pricing, but your own laptop and quote documents still need your own controls.

What a cyber risk plan must include

Your plan needs an inventory of onboard systems, identified threats, procedures for responding to an incident, and named responsibilities for crew. Keep it short enough that someone actually reads it before a shipyard stay.

How do you harden navigation systems?

Navigation is the highest-consequence attack surface on the boat, and it is also the one where a haul-out or refit window gives you uninterrupted access. Work through it system by system, before the yard wakes the crew up at 06:00.

ECDIS and chart plotter checklist

Confirm firmware is on the manufacturer's current version and record the version in the work order.
Pull chart updates only from the official IHO-compliant distribution source; never from a USB stick someone brought aboard.
Write a USB policy into the ship's standing orders: no unscanned media in the ECDIS, full stop.
Disable any unused network ports and put the ECDIS on its own VLAN, not the crew Wi-Fi bridge.
Log every update as a work order so the next refit has a paper trail.

GNSS and autopilot checklist

Check GNSS receiver firmware against the manufacturer's current release and update from a wired, isolated laptop.
Enable multi-constellation and, where supported, multi-antenna heading input so a single spoofed signal cannot quietly steer the boat.
Put the autopilot on the segregated bridge network, not the entertainment VLAN.
Verify alarm behaviour: a lost or drifting fix should sound on the bridge, not just on a screen nobody watches.

This is also where a refit pays for itself twice. When contractors are aboard anyway, bundle navigation hardening into the same RFQ, get an in situ quote, and let Dock Assist keep the work moving. Nautaes lets you run that quote and work order flow in one place (https://nautaes.com/fr/blogs/nautaes-revolutionizing-the-yacht-service-industry-22), and we will be honest: our platform handles the paperwork and the providers, not the firmware updates themselves. Your crew still has to plug the laptop in.

How do you secure VSAT, Starlink and onboard Wi-Fi?

Satellite terminal hardening

Satellite terminals are the yacht's front door to the internet, and they get attacked directly. Change default admin passwords on the VSAT and Starlink units, disable remote management from the WAN side, and put the terminal's management interface on a VLAN no guest can reach. Check firmware before every haul-out, not after an incident. NIST's guidance on segmenting OT and IoT systems (NIST SP 800-207) treats each terminal as its own trust zone.

Guest and crew Wi-Fi segmentation

Run three separate networks: crew, guests, and operational systems. Guests get internet only, no access to the router, cameras, or engine monitoring. Crew devices sit on their own segment with a VPN for anything sensitive. At sea, exposure is mostly your own misconfiguration; in port, you inherit every network around the berth, so tighten firewall rules when docked.

When a refit yard or technician needs access, issue a scoped RFQ through a work order rather than sharing admin credentials. We built Dock Assist and in situ quotes into Nautaes for exactly this reason, though we do not yet offer onboard network auditing, so a captain still needs a third-party pen test. Our platform's own security posture is documented on our blog (https://nautaes.com/de/blogs/revolutionizing-yacht-services-the-nautaes-advantage-24).

How do you protect engine networks and automation systems?

Segregating the engine network

Engine control, monitoring and automation networks should sit on their own VLAN or physical segment, firewalled from guest Wi-Fi and crew devices. A work order during a haul-out is the right moment to map it: list every device on the engine network, from the PLC and engine interfaces to tank level sensors, and document what talks to what. If the automation system shares a switch with the AV rack, fix that before antifouling dries. Log every change so the next yard visit starts from a known state.

Vendor and technician remote access

Manufacturers and service engineers often want remote access for diagnostics and updates. Grant it per visit, not permanently: a time-boxed account, on a restricted port, through a jump host you control, revoked when the RFQ closes or the technician signs off. Never share one vendor VPN login across the yard. During a refit, tie technician access to the work order so each contractor sees only the systems they quoted, and review the access log before the vessel leaves the shipyard.

What should crew devices and refit contractors be allowed to touch?

Crew device policy

Treat crew phones and laptops as untrusted. Put them on a guest VLAN, never on the network that serves ECDIS, autopilot or engine monitoring. Ban personal USB sticks outright: issue a small pool of scanned, vessel-owned drives for chart updates and work orders. Two hours of training covering phishing, USB discipline and who to call beats any policy document nobody reads.

Contractor access during refits

A haul-out brings foreign laptops into your shipyard and your network. Give contractors a separate VLAN or hotspot, time-limited credentials, and no direct path to navigation or engine systems. Ask them to patch before they connect: ECDIS and VSAT vendors publish advisories through CISA's ICS advisories, and a tech who has not read them should not be plugging in. Log every device that touches the boat during the refit window.

How do you build a yacht cyber security checklist you can actually run?

Scheduling cyber tasks around haul-outs

Tie each hardening task to work you already do. Password rotations and firmware updates for navigation and engine networks fit the winter refit window, when the shipyard already has systems powered down. Quarterly checks, like reviewing Wi-Fi guest access and crew device rules, run between haul-outs in under an hour. If a refit contractor needs network access, grant it per work order and revoke it at handover.

Documentation for insurers and surveys

Keep a dated log of every change: firmware versions applied, passwords rotated, who held network access and when it was revoked. Insurers and flag surveyors increasingly ask for evidence that cyber risk management is a routine, not a one-off. A folder of signed checklists per maintenance window answers those questions without a scramble.

FAQ

Do I need a cyber security plan for a private yacht under 500 GT?

Legally, no: the ISM Code requirement targets vessels over 500 GT in commercial use. In practice, yes, because insurers, flag states and charter managers increasingly ask for evidence of a plan before quoting or signing. A short document covering system inventory, named responsibilities, and incident response steps is enough to satisfy most of those requests.

How much does yacht cyber security cost per year?

Costs split into one-off and recurring work. A refit window covers the big items: firewall installation, network segmentation, and firmware updates, quoted like any other yard job. Recurring costs are modest: quarterly reviews of Wi-Fi access and crew device rules take under an hour, plus occasional third-party penetration testing. Expect the total to resemble a generator service line item, not a major refit.

Can someone hack a yacht's autopilot or GPS?

Yes, in principle. GNSS receivers can be spoofed, which is why multi-constellation and multi-antenna heading inputs matter: a single faked signal cannot quietly steer the boat. Autopilots are reachable when they share a network with guest Wi-Fi or crew devices. Keeping the bridge on its own VLAN and verifying alarm behaviour for a lost or drifting fix closes the practical routes.

What is the first step to secure a yacht's network?

Map it. List every device on board, from ECDIS and the VSAT terminal to tank level sensors and crew phones, and document what talks to what. Most yachts run flat networks where one compromised laptop reaches the machinery space. Once you know what is connected, segmenting crew, guest, and operational systems becomes a straightforward refit task rather than guesswork.

Who is responsible for cyber security on board: owner, captain or crew?

All three, in that order. The owner sets policy and signs off the budget, the captain owns the plan and reviews it at each haul-out, and crew are accountable for the devices they bring aboard. Suppliers and technicians doing work orders through a platform are part of the attack surface too, so contractor access should be tied to each job and revoked at handover.