When something breaks on a ship, it is immediately visible. But what if a system works as usual yet displays incorrect data? That is how some hackers operate, and sailors, it turns out, are often not prepared to recognize it. This is discussed in a study accepted for the ACM Conference on Computer and Communications Security (CCS 2026), which will be held on November 15-19 in The Hague. The work has so far been published on the arXiv preprint server.
Researchers from the Georgia Institute of Technology (USA) interviewed 20 military sailors. They were asked about practical cases, about cyber training and about how they would behave in three hypothetical situations. The results point to a gap between ordinary accident preparation and threats in which an attack affects not hardware but information.
The interviewees described weak points. Thirteen people said that standard cybersecurity courses are almost unrelated to their duties on the ship. Fourteen had not received any training that took into account the specifics of a particular mission. Eighteen noted that they had not been taught to distinguish information technology (IT - computers, networks, programs) from operational technology (OT - control systems for navigation, engines and other physical mechanisms). Another eighteen said that if they suspected an attack, they would first look for visible signs of malfunction. And seventeen described their cyber training as absent, weak or secondary.
These gaps matter because an attack may not stop a system but instead imperceptibly distort its data. For example, a hacker can substitute navigation information, and the crew will make decisions based on a lie.
One participant admitted to the researchers: "At first I would think of anything but a cyberattack. It would take me quite a long time to get to that thought."
The paper examines three scenarios: GPS signal spoofing (when an attacker feeds false coordinates to a receiver), loss of control of the propulsion system in an area of heavy shipping traffic, and failure of electronic navigation systems in a narrow channel at night. In all cases, the sailors first seek to make the vessel safe: they follow practiced procedures, stabilize the ship and check systems. In an emergency situation this is correct, but if the crew does not entertain the idea that the system or its data has been hacked, recognizing the attack is delayed.
An example with a narrow channel: the vessel needs precise coordinates. If navigation appears to be working and a hacker substitutes data, the false position may be close enough to the real one that the sailor suspects nothing. The ship will gradually drift toward shallow water or another obstacle without an obvious error and without an alarm signal.
"By the time a sailor realizes something is wrong, the size of the vessel and limited maneuverability may make grounding or collision inevitable," explained Anna Reymaker, a graduate student at the Georgia Institute of Technology studying maritime security.
This scenario shows the main difficulty of cybersecurity at sea: equipment failure is easy to notice, but an attack that substitutes information is far harder. The authors emphasize that they are discussing identified gaps in training, not a proven cause of real incidents. But it is already clear that current training programs do not help sailors recognize threats in which the equipment keeps working while the data becomes false.