Fleet Exposure Assessment: What We Find Before Attackers Do
Give me a yacht's name and a coffee. Before the coffee's gone, I can usually tell you three things about it that most people can't.
Where she's been for the last two seasons. Which crew member reused one password everywhere — or left OPSEC (operational security) loose enough to expose the vessel from the inside. Whose credentials are already sitting in a breach database, out there for years, still working. And more often than you'd think, a camera or a control panel that anyone on the internet can reach right now.
We don't break in. We don't need to. It's all just sitting there in the open, some more open, some less.
Hacking a vessel?
Most people think this work looks like a movie. Dark room, fast typing, a countdown. It doesn't.
Most of what we find in our risk assessments or penetration testing engagements, we find in public first — or in a few particular places you just have to know to look. A yacht broadcasts where it is; that's normal, it's how vessels work. A login page gets stood up during a refit and never taken down. A deckhand uploads a CV to a crew agency in 2021. The agency gets breached in 2023. In 2026, that same credentials are still protecting something that matters. None of it is clever. All of it is left lying around. We just know how to get there first, and oftentimes even identify lurking risks or threats to your vessel, even after you already had a local engagement. Because we find what is often missed.
What "exposed" actually looks like
On one recent engagement in May this year, we found a secured, but poorly configured fleet management portal reachable straight from the open internet — due to the misconfiguration there was no real barrier in front of it in the hands of someone with skill and motive. Behind it: the full staff directory with names and contact details, and live operational data coming off the vessels — position, systems telemetry, the lot. Nobody had "hacked" anything. It was simply left open, and it had been for a while. That's the point. The dangerous exposures aren't dramatic. They're the door someone forgot to lock — on the office side, feeding every boat in the fleet at once.
The risk starts in the office, not on the boat
Here's the part that matters if you manage yachts rather than sail on them.
The weak point is almost never the vessel. It's the office. The inbox. The shared drive. The handover file with everyone's details in one neat tab. The vendor login nobody remembers giving out. A yacht is only as safe as the least careful company that touches it. And if you run a fleet, one weak habit gets repeated across every boat you manage. Attackers know this. They stopped chasing single vessels a long time ago. They go after the company that holds fifty of them.
Why the good firms call us first
Serious clients are asking harder questions now. Can our cameras be seen from outside? What happens to our data after a charter? Can you prove we're clean? The firms that can answer — confidently, with proof — keep the business. The ones that guess lose it to a competitor who did the work. We do the work. We look at a fleet or a vessel the way an attacker would from a unique perspective — every connected system, the crew, the office, the vendors — and hand you the full picture before anyone else builds it. Then you're the firm that already knows its gaps and how to close them. That's the whole pitch. You can hear it from us, in a room, over a coffee. Rather have the coffee in person? We'll be at the Monaco Yacht Show, September 2026 — MYS. Find us there.
Eva Prokofiev — Founder & CEO, EPCYBER & RedRadar Technologies. Former Military Intelligence (Special Operations).
EPCYBER offers vessel and fleet cyber risk assessments, crew cyber awareness training, and digital exposure checks for management companies, brokerages, and service providers. All assessments are conducted with client authorisation.
Complimentary Digital Exposure Check — Club Vivanova partners can request a confidential assessment of their corporate and fleet digital footprint.
