Blue Initiative Lists Ship Cyber Flaws in Free Index

A group of maritime cyber security firms, classification societies and an industry information-sharing body has launched a free public database of software and hardware flaws that can affect ships, ports and offshore sites. The Blue Initiative, run by the maritime security company Cydome with ClassNK, Bureau Veritas, MTS-ISAC and Rakuten Maritime as contributing partners, was announced on 26 October in a release datelined London.

When TSN checked the site on 27 October, it listed 29,523 vulnerabilities, of which 2,006 were rated critical, 588 were on the US Cybersecurity and Infrastructure Security Agency’s list of flaws known to be exploited, and 37 were in systems built specifically for ships and ports.

In brief

Blue Initiative is a free, public index of known vulnerabilities in equipment used on ships, in ports and offshore, licensed for reuse under CC BY 4.0.
It held 29,523 entries on 27 October, including 588 on CISA’s known-exploited list and 37 in maritime-only systems.
Cydome runs and funds it; ClassNK, Bureau Veritas, MTS-ISAC and Rakuten Maritime are contributing partners.
The release says entries are reviewed before going live; the site’s methodology says publication is automatic.

Ship operators struggle to find the flaws that apply to them

The partners’ case is that general vulnerability lists are too big to be useful at sea. The release cites “more than 350,000 published CVEs and 200 entries added daily”, and Cydome calls the project the first public database focused only on maritime IT and operational technology. “Identifying which vulnerabilities actually matter to the systems maritime companies operate is a major challenge,” said Cydome chief executive Nir Ayalon.

Bureau Veritas, the inspection and certification group, linked it to ship owners’ duties. “Owners are expected to maintain the security of onboard systems as new vulnerabilities emerge,” said Panagiotis Anastasiou of Bureau Veritas Marine & Offshore, adding that the information “is often scattered across general-purpose databases and vendor advisories”. MTS-ISAC, the non-profit information-sharing centre for the maritime transport system, says it “has integrated its operational workflows to both contribute to and leverage” the database.

Entries are drawn from CISA and CVE records

According to the site’s methodology page, three public sources feed the index: CISA’s industrial control system advisories, the CVE Program’s own records, and CISA’s Known Exploited Vulnerabilities catalogue. A flaw is listed when it affects a product used on vessels, offshore facilities, in ports or in the onshore systems maritime firms depend on. A Linux kernel flaw on its own is not listed, but the same flaw inside a navigation chart system’s firmware would be.

Entries fall into three tiers: Maritime-Native systems such as navigation, engine and cargo kit from maritime makers; Shared OT, industrial equipment found on ships in numbers; and Fleet IT, the office and network systems that run the business. Users can filter to the systems covered by IACS rule E26 on ship cyber resilience, which applies to new vessels contracted on or after 1 July 2024, though the site says the filter is “a classification aid, not a compliance statement”. It hosts no exploit code.

The site’s own rules undercut the review claim

There is a gap between the launch release and the site’s rulebook that buyers should notice. The release says entries “are reviewed by cyber researchers from Cydome and the contributing partners, who validate and refine them before going live”. The methodology page says something different: a candidate is published automatically once its vendor match is corroborated and it has an advisory reference, and “there is no human step between a match and a public entry, in any tier”. Analyst notes exist only for selected entries; the rest say “No analyst note yet”. Read together, the human review the partners describe appears to apply to a minority of entries and to corrections after publication, not to the bulk of the 29,523.

That matters because only 37 entries are in the Maritime-Native tier, the part no general database covers well. Most of the index is industrial and office technology that also appears in CISA’s lists. The value for a ship operator lies less in new information than in filtering by vendor and system type, which is useful, but it is a narrower claim than “first maritime database” suggests.

The site is also open about ownership. It is “operated and funded by Cydome Security”, which “sells products to some of the vendors and operators listed here” and publishes its own vulnerability findings, including a critical Wärtsilä flaw featured on the home page. Cydome findings are labelled and limited to one of four featured slots, a cap the site says is enforced in code. For an industry that has seen attacks on refrigeration suppliers and growing concern over undersea infrastructure, a free, reusable list is a practical gain. The test will be whether ClassNK, Bureau Veritas and the others start adding entries of their own.