Maritime Threat Hunting - What We Actually Find When We Look

The panelists, who run monitoring and assessments for ships, ports and terminals, opened by saying their hunts rarely began with malware. They began with working out what was plugged in. Network diagrams handed over with a vessel tend to be out of date, since equipment is repaired, retrofitted and temporarily patched, and those patches often stay. Walkthroughs turned up unmanaged access points, personal mobile hotspots that reached both the crew network and corporate systems, and in one case an RFID system running on the guest Wi-Fi.

The talk then moved to operational technology. As ships shift from satellite links to Starlink, some operators have asked to keep navigation-related systems connected for updates. The presenters' answer was to open a path only for an approved window and close it afterward. Their hunting method starts with a defined normal baseline, then correlates identity, host, network, timing and maintenance records against hypotheses such as vendor access outside approved maintenance periods. Every manual finding is then turned into an automated SOC detection, so the next occurrence is caught without a person looking.

The takeaways were practical: asset inventory and segmentation come before advanced detection, drift is a condition that accumulates rather than an attack, and accepted risks should be documented even when they are not removed. Crew-introduced devices were the most common find, and the presenters argued that overly restrictive networks push people toward workarounds.