Naval Dome vs. CyberOwl vs. Marlink Cyber: Maritime OT Cybersecurity Platform Comparison

Understanding why maritime OT security is different from land-based OT requires understanding vessel network architecture:

Vessel network zones (typical):

• Navigation/C2: ECDIS, autopilot, radar, AIS, GPS -- safety-critical systems
• Propulsion and machinery: Engine management, ballast control, cargo systems -- operational-critical systems
• IT/Administrative: Cargo management software, crew welfare internet, vessel management systems
• SATCOM: The uplink that connects all vessel systems to shore management

Security challenges specific to maritime:

• Air gap erosion: Modern vessels are always-connected through VSAT; the network boundary between IT and OT is frequently bridged for cargo management, remote monitoring, and software updates
• Bandwidth constraints: VSAT connectivity is expensive and limited in bandwidth; security monitoring that sends full packet captures or large log volumes to shore is operationally impractical
• Port call USB risk: Software updates, charts, and cargo documentation still commonly arrive via USB in many ports; removable media is a primary malware entry vector
• Long-haul isolation: A vessel at sea for 30-60 days between port calls may not have timely access to security updates or on-site incident response support
• Crew cyber hygiene: Vessel crews have varying security awareness; personal device policies are difficult to enforce when crew welfare internet is a contractual obligation

Naval Dome takes a different approach than the network monitoring competitors: rather than analyzing network traffic, it installs agents on vessel OT endpoints (ECDIS workstations, cargo management terminals, navigation computers) and prevents unauthorized code execution.

Technology approach: Naval Dome uses a whitelist-based execution control model: only authorized applications and processes can run on protected endpoints. Any attempt to execute unauthorized code (from USB-delivered malware, a compromised update, or a network-borne attack) is blocked and alerted.

Why this matters for maritime: USB-delivered malware is the dominant attack vector for vessel OT compromise. The 2017 NotPetya attack on Maersk originated partly from USB transmission at a port facility. Naval Dome's endpoint approach blocks USB-delivered malware at execution rather than attempting to detect it at the network layer.

OT compatibility: Naval Dome is specifically designed for maritime OT endpoints, including legacy Windows XP and Windows 7 systems that run on older ECDIS hardware. The agent is lightweight enough for the constrained hardware environments common in older vessels.

Limitation: Naval Dome does not provide network-layer visibility -- it cannot detect lateral movement between vessels systems if the attacker has already executed code on an endpoint, or detect network-based attacks against systems that are not endpoint-protected. It is an endpoint protection layer, not a full OT monitoring solution.

ISM Code support: Naval Dome provides reporting that documents the security controls in place on each vessel, supporting ISM Code Safety Management System documentation requirements.

CyberOwl's Medulla platform is a passive network traffic analysis (NTA) system designed specifically for the bandwidth and connectivity constraints of vessel VSAT connections.

Technology approach: Medulla sensors are deployed aboard vessels and monitor network traffic passively -- no agents on OT endpoints, no active scanning that could disrupt vessel systems. Machine learning anomaly detection runs on the vessel (not shore) to analyze traffic and identify suspicious patterns.

Bandwidth-efficient shore reporting: Rather than transmitting raw packet captures or full log data to shore (which would saturate VSAT bandwidth), Medulla compresses alerts and summaries and transmits only the high-value data. Full packet captures are retained locally on the vessel sensor for incident investigation when the vessel reaches port.

Fleet visibility: Medulla aggregates vessel alerts into a shore-side fleet dashboard, allowing a central security operations team to monitor the security posture of all vessels in the fleet from a single console. Alert correlation across vessels can identify campaign-style attacks targeting multiple ships.

DNV GL certification: CyberOwl has pursued DNV GL Type Approval for its Medulla platform, which simplifies the certification pathway for operators deploying Medulla as part of their IMO cyber compliance program.

Limitation: Passive NTA cannot detect malicious actions that do not generate distinctive network traffic (a USB-delivered payload that runs entirely on a local endpoint). CyberOwl addresses this by supporting integration with Naval Dome or other endpoint protection tools for a combined detection capability.

Marlink is primarily a VSAT satellite connectivity provider for maritime, offshore, and remote industries. Marlink Cyber is its managed security service layer, delivered as an add-on to Marlink's VSAT connectivity.

What Marlink Cyber provides:

• Managed firewall and network segmentation: Marlink manages network security at the SATCOM boundary -- the connection between the vessel and shore. This includes firewall policy management, traffic filtering, and network segmentation enforcement at the vessel router/gateway.
• Network monitoring: Similar to CyberOwl, Marlink Cyber monitors vessel network traffic for anomalies, with the analysis performed by Marlink's shore-side SOC rather than a vessel-side sensor.
• Vulnerability management: Marlink scans vessel network-facing services and software for known vulnerabilities, with reporting aligned to ISM Code documentation requirements.
• Incident response: As a managed service provider, Marlink Cyber includes incident response support in its service tiers, with shore-side security analysts available for vessel-side assistance.

Key differentiator: Because Marlink provides the vessel's SATCOM connectivity, it has visibility into all traffic at the SATCOM boundary without additional vessel-side hardware in many configurations. This simplifies deployment compared to installing dedicated sensors on each vessel.

Limitation: Marlink Cyber is most valuable for operators who already use Marlink for VSAT connectivity. For operators using other VSAT providers (Inmarsat, SES, Viasat), Marlink Cyber's deployment requires either switching connectivity providers or installing additional hardware, reducing the integration simplicity advantage.

ISM Code support: Marlink Cyber provides documentation and reporting aligned to IMO Resolution MSC-428(98) requirements, supporting the cyber risk component of ISM Code Safety Management Systems.

IMO Resolution MSC-428(98) requires that ship owners and managers incorporate cyber risk management into their ISM Code Safety Management Systems. The practical requirements for fleet operators:

What ISM Code cyber compliance requires:

• Cyber risk assessment: identification of critical systems, threats, vulnerabilities, and risk mitigation measures
• Documented security controls: evidence that controls are in place and tested
• Incident reporting: procedures for reporting cyber incidents that affect safety
• Crew training: evidence that crew members receive cyber awareness training
• Annual review: cyber risk management reviewed as part of annual SMS audit

Port State Control implications: Flag state Port State Control inspections now include cyber risk management under ISM Code audits. Operators without documented cyber risk management in their SMS may receive deficiency notices that affect vessel trading.

DNV GL SL4: DNV GL (now DNV) has published Cyber Secure Class notation requirements for vessels. SL4 (Security Level 4) is the highest level of DNV GL Cyber Secure certification and requires network segmentation, intrusion detection, and documented incident response capability. CyberOwl has pursued DNV GL Type Approval, simplifying the certification process for operators using Medulla.

Practical compliance path: For most fleet operators, ISM Code compliance requires three things: a documented cyber risk assessment, evidence of security controls (monitoring, endpoint protection, or both), and crew training records. All three vendors provide documentation support for these requirements.

Deploying C-UAS -- or maritime OT security in this case -- across a vessel fleet requires planning for the unique logistics of maritime environments:

Hardware installation at port call: Sensor hardware must be installed during port calls. For large fleets, coordinating installations across vessels in multiple ports over a 6-12 month rollout requires scheduling that fits vessel trading patterns.

Satellite bandwidth impact assessment: Before deployment, assess the VSAT bandwidth consumption of the security platform under normal operations and during active incident investigation. Work with the VSAT provider to ensure bandwidth allocation accounts for security monitoring without degrading navigation system connectivity.

OT system compatibility testing: Passive NTA sensors must be tested in a vessel environment before fleet rollout to verify that passive monitoring does not introduce latency or interference on vessel network segments connected to safety-critical systems.

Crew training requirements: All three platforms require some crew-level training: Naval Dome requires that crew understand the endpoint whitelist model and the process for requesting authorized software; CyberOwl requires a crew member who can physically access the sensor for maintenance; Marlink Cyber requires that the vessel's IT officer understands the monitoring scope and incident reporting procedures.

Remote support model: For vessels at sea, remote support must be available via SATCOM. All three vendors provide remote support channels, but the response time and support tier available via satellite may differ from shore-based support SLAs.