Maritime Security Operations Center (M-SOC): Systematic Literature Review, Research Gaps and Future Areas to Investigate

Abstract

The maritime industry is undergoing rapid digital transformation, integrating advanced technologies to enhance operational efficiency and connectivity. However, this shift introduces significant cybersecurity vulnerabilities, as increasing reliance on digital systems for navigation, communication, and control exposes vessels to cyber threats. Despite growing awareness, the industry lacks unified cybersecurity frameworks, leading to fragmented defenses that attackers can exploit to compromise critical systems such as navigation and control functions. The Maritime Security Operations Centers (M-SOCs) Framework aims to provide a consolidated approach to threat monitoring, detection, and response. However, research on adapting traditional Security Operations Centers (SOCs) to the unique maritime environment remains limited. This paper addresses this gap by conducting a systematic literature review (SLR) using the SALSA (Search, Appraisal, Synthesis, and Analysis) framework to examine the current state of M-SOCs. By analyzing existing research, we identify key trends, challenges, and opportunities in maritime cybersecurity operations. Our findings highlight the need for tailored SOC models that account for the maritime sector's distinct operational, technological, and personnel constraints.

I. Introduction

With cutting-edge technologies quickly incorporated into vessel operations, the maritime industry is seeing a rapid digital transformation. These developments increase connectedness and efficiency, but they also present new cybersecurity threats. Ships are more susceptible to cyberattacks as they depend more and more on digital systems for control, communication, and navigation. The sector currently lacks integrated solutions that provide a comprehensive picture of a vessel's cybersecurity state, despite growing awareness. The defenses in place now are frequently fragmented and focus on specific systems separately. Attackers can use the security flaws created by this disjointed strategy to get access to vital systems or obstruct navigation.

Efforts to enhance cyber resilience in the maritime sector are underway, and the industry is investigating integrated solutions that consider the complexity of contemporary maritime operations to increase cyber resilience. The Maritime Security Operations Center (M-SOC), which aims to offer unified monitoring, threat detection, and response across all onboard systems, is one new approach. There is little research on how to tailor conventional Security Operations Centers (SOCs) for the maritime environment.

II. Background

With the increased cyber integration into the maritime systems, it is needed to tend to the cybersecurity aspect of all the newly introduced concerns and increasing attack surface. However, when planning cybersecurity measures, we need to keep in mind the unique nature of the maritime industry and how complex and vast it is. With majority of the world trade relying on maritime transportation, it is crucial to have secure operations and a similar level of cyber protection as other sensitive infrastructures [1], [2].

Unlike land-based industries, maritime operations face some very particular hurdles. For starters, connectivity at sea is intermittent and bandwidth-limited, making real-time defense and remote support a logistical nightmare. Many vessels also rely on legacy systems that weren't designed with cybersecurity in mind, and there's a wide disparity in digital maturity across different types of ships and fleets. Add to that the fact that many crews have limited IT training, and you're left with a sector uniquely vulnerable to cyber disruption [3], [4].

Safeguarding the maritime domain from cyberattacks is a crucial task that will proactively mitigate devastating incidents, with the maritime industry handling nearly 90% of world trade. It increasingly depends on complicated, interconnected global cyber architectures, integrating Information Technology (IT) and Operational Technology (OT) systems to support its various and complex operations and processes [5], [6].

III. Methodology

A Systematic Literature Review (SLR) is a structured and methodical approach to gathering, critically assessing, synthesizing, and presenting findings from research studies focused on a specific research question or topic. This study applies the PSALSAR framework, an extended version of the SALSA (Search, Appraisal, Synthesis, and Analysis) framework, incorporating a Protocol phase derived from PRISMA guidelines and a dedicated Report phase. The PSALSAR framework consists of six phases: Protocol (defining study scope and research questions using the PICOC framework), Search (identifying relevant databases and formulating search strings), Appraisal (defining inclusion/exclusion criteria and quality assessment), Synthesis (data extraction and categorization), Analysis (quantitative and narrative analysis), and Report (journal article production).

Using the PICOC framework, five research questions were formulated: (1) What is the current state-of-the-art in M-SOC research? (2) What methodological approaches are being used to study M-SOCs? (3) Which aspects of M-SOCs have received the most and least research attention? (4) What are the primary challenges and gaps in M-SOC implementation and research? (5) What are the emerging trends and future directions for M-SOC development? [19]–[25]

IV. Results

The review identified 9 publications covering the period from 2016 to 2024, all conducted within Europe, reflecting a strong regional bias. Most papers are openly accessible, with citations varying widely. Foundational works from earlier years gathered significant attention, while recent publications reflect emerging focus areas such as training, human factors, and cyber resilience.

M-SOC studies can be categorized into four themes: (1) Training and Education, (2) Technical Architecture and Implementation, (3) Human Factors and Operational Challenges, and (4) Threat Analysis and Historical Context. The current state of the art reveals that while SOC principles form the foundation of M-SOC operations, the maritime context introduces unique variables including intermittent connectivity, legacy systems, and limited IT training among crews.

The results show a heavy focus on training programs and technical system architectures, with critical categories such as implementation metrics and small vessel considerations remaining underexplored. Studies addressed topics including cyber ranges and simulation environments, SOC framework adaptation for maritime, human-automation interaction, and analysis of historical cyber incidents in the maritime sector [6], [10], [13]–[18].

V. Challenges and Gaps

Several critical challenges and research gaps were identified. First, the narrow geographical scope — all 9 studies were conducted in Europe, leaving vast maritime regions such as Asia-Pacific, Africa, North America, and South America largely unexplored. Second, the thematic focus leans heavily on training indicators and system architectures, while implementation metrics and the specific challenges posed by small vessels remain underexplored.

There is a disproportionate focus on technical architecture and training programs at the expense of operational assessments, human factors, and real-world implementation metrics. The lack of standardization and the misalignment between regulations and real-world needs present additional challenges. Most M-SOC studies treat the system as a technical artifact, while human operators — their fatigue, training quality, decision-making under stress, and team dynamics — are largely ignored.

VI. Future Directions

Future research must broaden its geographical scope to reflect the true global nature of maritime security operations, encompassing multilingual sources and studies from diverse regions. There is a critical need for empirical evaluations grounded in real-world operations rather than purely conceptual or experimental work. Studies on integrated M-SOC subsystems and holistic frameworks are needed to support a more comprehensive understanding.

Future work should also address the human side of maritime security operations — how personnel interact with automated systems, how communication flows across different units and agencies, and what happens when human judgment clashes with algorithmic recommendations. Understanding these dynamics is essential for building systems that work effectively in real operational environments.

VII. Conclusions

Despite a growing body of work on Maritime Security Operations Centers (M-SOCs), current research only scratches the surface of what is truly needed for a comprehensive understanding. Many studies have remained within a narrow scope, focused largely on conceptual frameworks or experimental validations without evolving into full-scale, operational insights. Our collective knowledge of M-SOCs remains fragmented and disproportionately focused on specific elements like training, technical design, or education.

One of the most striking limitations is the narrow geographical scope, with most studies rooted in European contexts. This regional bias risks generating a partial understanding of maritime security operations, as localized challenges such as piracy hotspots, limited infrastructure, and different regulatory environments remain invisible in the dominant discourse. The thematic focus leans heavily on training and system architectures, while critical categories such as implementation metrics and small vessel considerations remain vastly underexplored.

The emphasis on conceptual and experimental research — around 70% of the reviewed literature — points to a field still in its developmental stages. Without empirical research grounded in real-world operations, it is nearly impossible to design solutions that work under pressure. Future studies must expand geographically, diversify thematically, and place human operators at the center of M-SOC research to build systems that are both technically sound and operationally effective [19]–[51].