In a study accepted for the 2026 ACM Conference on Computer and Communications Security, Georgia Tech researchers interviewed 20 military sailors about their cybersecurity experiences, training, and responses to hypothetical scenarios. Their findings point to a gap between how mariners are trained to handle emergencies and how cyberattacks can compromise the systems they depend on. 

The study found several gaps in how crews prepare for cyber threats:

• Training often misses the mark. Thirteen participants said that standard cybersecurity training was largely irrelevant to their shipboard duties, and 14 reported receiving no mission-specific cybersecurity training.
• Operational technology is often overlooked. Eighteen participants said their training did not distinguish between traditional information technology and operational technology, such as navigation and propulsion systems.
• Obvious failures are easier to recognize. Eighteen participants said they would primarily look for visible signs of operational problems when identifying a potential cyberattack.
• Cybersecurity is often a low priority. Seventeen participants described their cybersecurity training as absent, low quality, or a low priority.

These gaps matter because cyberattacks can compromise a system without causing it to stop working. For example, an attacker could manipulate navigation data, leaving a crew to make decisions based on false information.

“I’d assume it was anything but cyber at first. It would probably take me quite some time to get to that conclusion,” one participant told the researchers.

The team examined three hypothetical scenarios: GPS spoofing, loss of propulsion control in a high-traffic area, and failure of electronic navigation systems in a congested channel at night.

In each scenario, mariners would first focus on keeping the vessel safe, using established procedures to stabilize the ship and troubleshoot its systems. While this response is essential during an emergency, it could delay recognition of an attack if crews do not consider that the system or its data may have been compromised.

For example, a ship navigating a narrow channel depends on accurate location information, but what happens when its navigation systems appear to work normally while a hacker manipulates that data?

An attacker could use GPS spoofing to falsify a vessel’s reported position. If the false position is close enough to the ship’s actual location, a mariner might not notice anything wrong. The vessel could gradually head toward shallow water or another obstacle without triggering an obvious error or alarm.

“By the time the mariner realizes something is wrong, the ship’s size and limited maneuverability could make it too late to avoid a grounding or collision,” said Anna Raymaker, a Georgia Tech Ph.D. student who studies maritime security.

The scenario illustrates a central challenge in maritime cybersecurity: An equipment failure may be easy to recognize, but a cyberattack that provides false information can be much harder to detect.

Batten the Hatches: Cybersecurity with Military Mariners was written by master’s student Ryan Von Brock, Raymaker, Research Scientist Animesh Chhotaray, Associate Professors Frank Li and Saman Zonouz, and Provost & Executive Vice President for Academic Affairs Raheem Beyah.

The research was conducted in Georgia Tech’s Cyber-Physical Security Lab, a collaboration between the School of Cybersecurity and Privacy and the School of Electrical and Computer Engineering. 

Photos by Terence Rushin/College of Computing