According to Kris Vedat, CEO of SmartSea, the industry's biggest cyber concern is the potential for a security breach to move from business systems into operational environments where it could affect safety, production and environmental protection.

"A phishing email or compromised supplier account can quickly become a safety issue if the connections into offshore systems are poorly controlled," he told Offshore. "Third-party access deserves particular scrutiny. Operators need to know who can connect, what they can reach and when that access should end."

The issue is becoming more significant as offshore operators adopt remote operations centers, connected assets, automation and AI-driven monitoring systems.

Vedat said offshore organizations should pay particular attention to third-party access management and legacy control systems that were not designed for today's connected operating environments.

"The question for executives is whether a digital failure could compromise safe operations, and are they prepared for that?" Vedat said. 

He added that threats such as GNSS jamming and spoofing can also affect the positioning information vessels rely on for safe operations.

OT security requires a different approach

Unlike traditional IT systems, offshore OT environments directly control physical processes including pressure, power, propulsion and vessel position. As a result, cybersecurity measures must be implemented without compromising safe operations.

"Cybersecurity offshore requires engineering judgement as well as technical expertise," Vedat said.

According to Vedat, activities such as vulnerability scanning, patch management and system maintenance require extensive testing, while remote locations, rotating crews and limited access to specialists can make incident response more difficult.

Practical steps to take

The biggest preparedness gaps, Vedat said, include incomplete equipment inventories, poorly controlled vendor access and incident response plans that have never been tested through realistic exercises.

Accountability is another weakness," he added. "Boards and asset leaders need to own cyber risk alongside other operational risks, supported by IT and engineering specialists."

Practical steps operators can take

Vedat recommended several practical measures to improve cyber resilience:

• Map critical equipment and network connections.

• Segment networks appropriately.

• Tighten third-party access controls.

• Build cybersecurity requirements into procurement and supplier contracts.

• Train offshore crews and regularly test response procedures.

"A policy only has value if people can put it into practice under pressure," Vedat added.

Emergency response and business continuity planning

Vedat said cyber incidents should be incorporated into the same emergency-response frameworks used for events such as fires, power loss and well-control incidents.

"Teams need clear triggers, escalation routes and decision authority. They must know what information they can trust, whether safe operation remains possible and who can authorize isolation or shutdown," he added. 

He also emphasized the importance of conducting realistic exercises involving offshore personnel, OT teams, IT departments and key suppliers to test decision-making and recovery procedures.

Automation and AI raise both opportunities and risks

Looking ahead, Vedat expects remote operations, automation and artificial intelligence (AI) to increase the importance of resilient communications and trustworthy operational data.

"AI could help defenders identify unusual behavior, but it will also help attackers produce more convincing deception and accelerate their activity," he cautioned.

As offshore operations become increasingly automated and remotely managed, Vedat said organizations must ensure resilience is designed into new systems from the outset.

"People remain accountable, and they need the skills and authority to question automated decisions and intervene," Vedat concluded. "Greater automation makes workforce competence more important, not less so, and the offshore industry would do well to remember that."