SynapseCommand at NMIOTC’s Maritime Cyber Security Conference in Crete

The conference programme addressed cyber-physical resilience in autonomous shipping, protection of maritime critical infrastructure and supply chains, human factors in cyber defence, shipboard operational technology (OT), coastal-surveillance command and control (C2), and fleet-scale cyber exercises. These topics share a practical problem. A suspicious vessel track, an unexpected sensor outage and a cyber alert may appear on different systems, reach different teams and carry different levels of confidence. The duty staff still has to establish what is known, what is uncertain, and who is authorised to act.

From cyber alert to maritime decision

In the maritime domain, a cyber incident can have a physical consequence. Bridge and navigation systems, cargo handling, propulsion, port interfaces and ship-to-shore connections each cross an information and operational boundary. The International Maritime Organization’s May 2026 guidelines on maritime cyber risk management identify these computer-based systems and distinguish information technology from OT. They also emphasise segmentation and the protection of shipboard systems from Internet-facing networks.

For a watch team, the question is rarely whether one alert exists. It is whether several observations describe the same incident. An Automatic Identification System (AIS) report may disagree with a coastal radar track; a communications interruption may reduce the confidence of an otherwise plausible assessment; an OT alarm may have safety implications that a conventional IT dashboard cannot show. Correlation must preserve the provenance and limitations of each source. Anomalies are grounds for investigation, not proof of hostile activity or attribution.

That is where SynapseCommand’s maritime and subsea protection profile is relevant. It is designed to augment an existing recognised maritime picture with evidence-linked assessment, confidence information and courses of action for human review. The platform can work with feeds such as AIS, radar and imagery where authorised and integrated. A human operator retains control of consequential decisions, including tasking, interception and attribution. Attendance at the conference was an opportunity to engage with the domain’s operational problems; it was not a product presentation or a claim of deployment at NMIOTC.

Sovereign AI across the command boundary

Maritime C2 often spans naval headquarters, coastal authorities, port operators and national agencies. Each has its own authority, data rules and security boundary. A useful AI layer must therefore show its sources, distinguish observation from inference, and remain within the deployment environment approved for the data. SynapseCommand’s sovereign deployment model keeps inference and decision records within the customer-controlled environment, including on-premises and disconnected configurations where appropriate.

The operational advantage is a clearer handover between detection and decision. Watchkeepers can examine why an assessment was raised, correct a mistaken identity or reject a false correlation. Staff can compare response options against available information without allowing an AI agent to issue an order on its own. The value depends on integration quality, data rights, accreditation and human procedures; software cannot supply missing sensor coverage or resolve jurisdiction by itself.

A record that survives the incident

A maritime cyber event is often reconstructed across several organisations after the immediate response. SynapseCommand’s CyberFort Blockchain™ decision record is described as hash-chained and append-only: it binds the evidence state, agent outputs and human approvals into a replayable sequence. In assured deployments, decision records are signed with ML-DSA. This makes later alteration detectable and supports after-action review. It does not establish that a sensor reading was true, nor does it replace independent investigation or a ship’s safety-management obligations.

The distinction matters in exercises as well as incidents. A fleet cyber range may test whether a team noticed degraded positioning, how it handled uncertain AIS data, and whether an escalation was approved by the right authority. A replayable decision trail lets an instructor inspect the actual sequence of evidence and choices, rather than relying only on an end-of-exercise account.

Protecting long-lived maritime information

Ship, port and naval systems have long service lives. Sensitive information shared today may need to remain protected for years, while certificates, keys and software are upgraded on different schedules. SynapseCommand’s post-quantum security approach includes ML-KEM for key establishment and ML-DSA for digital signatures in applicable configurations, aligned with NIST FIPS 203 and FIPS 204. Hybrid migration matters when allied and civilian systems cannot change at once.

Cryptography protects confidentiality and authenticity at defined interfaces. It does not prevent a compromised endpoint, correct a false AIS report or make an unsafe OT network safe. In the maritime setting it works alongside segmentation, identity controls, incident procedures and the risk management described by the IMO.

The discussion at Souda Bay points to a demanding standard for maritime cyber defence: decisions need trustworthy inputs, explicit authority and a record that can be examined later. SynapseCommand’s contribution is to support that chain inside a sovereign command environment while leaving the judgement, and the responsibility, with people.