A Proactive Defense: An Open-Source Intelligence (OSINT) Framework for Maritime Cybersecurity

Abstract

The accelerating digital transformation of the maritime industry, driven by the widespread adoption of Internet of Things (IoT) devices, integrated vessel systems, and automated port operations, has significantly expanded its cyber-attack surface, rendering it increasingly vulnerable to sophisticated threats. This study investigates the application of Open-Source Intelligence (OSINT) as a proactive, scalable, and cost-effective methodology for enhancing maritime cybersecurity. We present a specialized maritime OSINT framework comprising a systematic five-phase workflow (Identification, Collection, Processing, Analysis and Dissemination) tailored to the sector's unique operational and threat landscape. The framework is supported by a comprehensive taxonomy of maritime cyber threats and a curated toolkit of over 100 OSINT resources, spanning vessel tracking, corporate intelligence, digital reconnaissance, and analytical platforms. Through applied case studies, we demonstrate how this approach can identify critical vulnerabilities such as exposed operational technology, weak software supply chain links, and human-factor risks derived from publicly accessible data. Our findings confirm that maritime OSINT provides an indispensable intelligence layer, enabling stakeholders to transition from reactive security postures to proactive risk management through early threat detection, informed vulnerability assessment, and enhanced situational awareness, while adhering to the proposed ethical and legal guidelines for responsible intelligence collection.

I. Introduction

The maritime industry is undergoing rapid and extensive digitalization across all aspects of the domain. Although this technological integration promises enhanced productivity and streamlined operations, it simultaneously expands the attack surface. With over 80% of international trade relying on maritime transportation [1], it is crucial to secure and protect the different aspects of the sector from cybersecurity challenges. Cyberattacks on the maritime industry have increased by a staggering 900% in recent years [2]. It is sensible to implement additional security layers [3].

This digital transformation includes automation in ports, integration of IoT devices on vessels, and establishment of interconnected logistics systems. Unfortunately, a single vessel often presents a complex security environment, simultaneously operating cutting-edge technologies alongside very old legacy systems, further complicating compliance with evolving regulations such as the Network and Information Systems (NIS)-2 Directive (EU 2022/2555) [4], which mandates stringent cybersecurity risk management for maritime operators and the International Maritime Organization (IMO—the UN agency responsible for regulating shipping) resolution MSC.428(98) [5], requiring cyber risks to be addressed under the International Safety Management (ISM) Code (an international standard for the safe management and operation of ships) [6]. Maritime organizations are high-value targets for various threat actors. Current security practices are often reactive, stressing the need for proactive intelligence capabilities, such as Open-Source Intelligence (OSINT), to anticipate and mitigate threats [7], [8].

OSINT can be weaponized by malicious actors to plan and execute targeted attacks against maritime assets by exploiting the very data intended for safety and transparency. By systematically analyzing OSINT sources, adversaries can identify high-value targets through unexplained loitering patterns and route anomalies, which may signal vessels carrying sensitive cargo or operating under duress.

For example, the Automatic Identification System (AIS) is a standard tracking system used globally to monitor vessel positions, routes, and identities in real time, which can be utilized to detect deliberate gaps in transmission or inconsistencies that indicate spoofing. Attackers can pinpoint vessels attempting to conceal their movements, making them vulnerable to interception, piracy, or cyber-physical attacks. Additionally, by mapping broader traffic patterns within strategic chokepoints or politically sensitive areas, malicious actors can identify optimal times and locations for ambushes, smuggling operations, or coordinated cyber intrusions, turning publicly available maritime data into a tactical blueprint for disruption and exploitation.

The primary objective of this study is to leverage this specialized framework to empower maritime stakeholders with a proactive, cost-effective capability for early threat detection, vulnerability identification, and enhanced situational awareness, thereby enabling a shift from reactive security postures to preventive risk management. Beyond the framework itself, this study makes two additional contributions:

First, it introduces a structured analytical approach that transforms raw OSINT findings into actionable intelligence through vulnerability categorization, severity ranking, and mapping to established frameworks such as MITRE ATT&CK [9].

Second, it provides practical guidance for organizational adoption through a tiered integration model that enables maritime stakeholders of all sizes to operationalize OSINT within the existing governance structures and regulatory compliance frameworks.

The study follows a structured methodological framework organized into five key phases: identification, where strategic objectives are defined; collection, where data are systematically gathered from public sources; processing, where data are cleaned and normalized; analysis, where processed data are examined to extract intelligence; and dissemination, where findings are synthesized into actionable reports. Throughout this workflow, a variety of OSINT tools are utilized, each aligned with the goals of the corresponding phase. These tools were identified through a dedicated research process to assemble a practical toolkit tailored for the maritime domain. This research is primarily methodological and framework-oriented in nature. Rather than presenting quantitative experimental results, it offers a structured, repeatable process for maritime OSINT collection and analysis, validated through a qualitative case study.

This study investigates the potential of OSINT to enhance maritime cybersecurity, with a primary focus on preventive measures. The novelty of this study lies in the development of a comprehensive and actionable OSINT framework specifically tailored to the maritime cybersecurity context, a contribution that fills a significant gap in the existing literature. While prior research has acknowledged the value of OSINT, this study provides a holistic, step-by-step methodology for its implementation, complete with a taxonomy of maritime cyber threats and a systematic process for collecting and analyzing data from diverse public sources such as AIS, Shodan, and crew social media.

The remainder of this paper is organized as follows. Section II establishes the necessary background by detailing OSINT principles, the maritime cybersecurity landscape, key threat actors, and prevalent attack vectors. Section III reviews the related work and positions our contribution within the existing scholarly discourse. Section IV presents the core of our research: a detailed maritime OSINT methodology, including a five-phase intelligence workflow, a discussion of the research process behind the compilation of a categorized toolkit, and a critical examination of ethical and legal considerations. Section V details the resulting taxonomy of maritime OSINT tools. Section VI demonstrates the practical application of the proposed framework through a case study, validating its utility in identifying real-world vulnerabilities. Section VII discusses the findings, emphasizing organizational integration, process development, and human factors in maritime cybersecurity. Finally, Section VIII concludes the paper by summarizing the key contributions and outlining directions for future research.

II. Background

This background section begins by establishing the fundamental role of OSINT and demonstrating how the vast, publicly accessible digital footprint of the industry can be weaponized by threat actors. It then delves into the specific methodologies of passive and active OSINT, highlighting the emerging threat of AI-enhanced attacks that automate profiling and phishing. This section subsequently maps the complex maritime cybersecurity landscape, emphasizing the convergence of Information Technology (IT) and Operational Technology (OT) as a key vulnerability. Finally, it categorizes diverse threat actors and analyzes the primary attack vectors they exploit, from network intrusions and satellite communication compromises to social engineering and supply chain attacks.

A. Open-Source Intelligence (OSINT)

Open-Source Intelligence (OSINT) is the practice of gathering and analyzing information that is freely and legally accessible to the public for purposes such as threat assessment and cybersecurity. OSINT plays a vital role in staying informed and responding effectively using deductions derived from aggregated data [10], [11].

From pictures to videos to other forms of digital media, people are increasingly sharing personal information online, and the same applies to the maritime domain. With proper tools and social engineering skills, malicious actors can gain access to sensitive information, such as passwords, or even extort someone [11].

For example, we can obtain a lot of information related to the maritime sector from public records and websites such as MarineTraffic [12]. Namely, we can find the vessel's IMO number, Maritime Mobile Service Identity (MMSI) numbers, dimensions, owner, current location, and even its departure and destination ports. For some vessels, information about past crew members may also be accessible. All this information can be obtained by knowing the name of the vessel.

II. Background (continued)

D. Threat Actors

The cyber threat landscape in maritime environments is evolving and becoming increasingly complex. Various threat actors with different motivations and skill levels attempt to circumvent security defenses. Based on a retrospective analysis of past maritime cyber incidents and intelligence, we can categorize threat actors into: state-sponsored actors targeting maritime assets with strategic, economic, or military relevance; cybercriminal organizations and individuals targeting maritime operations for financial gain through ransomware, business email compromise, and cargo theft facilitation; hacktivists targeting maritime organizations for ideological reasons; and insider threats from current or former employees with access to operational maritime systems or sensitive data [27]–[35].

E. Attack Vectors

Cyberattacks threaten maritime operations through diverse attack vectors. Network-based attacks target interconnected systems within the maritime sector, including corporate networks, ship communication platforms, and port management infrastructure. Vessel operations relying on Very Small Aperture Terminals (VSAT) and other satellite systems are susceptible to cyberattacks due to inherent vulnerabilities in satellite communication. Social engineering preys on maritime personnel through tactics like phishing, pretexting, and business email compromise (BEC). Supply chain compromises exploit the intricate web of vendors, service providers, and contractors that support maritime operations. Finally, operational technology exploitation targets industrial control systems governing ship propulsion, navigation, and port cargo handling [36]–[48].

III. Related Work

There are only a few studies that explore the intersection of maritime operations and OSINT, and each adopts a distinct methodology and focus. While existing research demonstrates the potential of OSINT for improving maritime situational awareness, cybersecurity, and operational integrity, these works often differ in scope—ranging from privacy and ethical considerations to simulation-based training and real-world case studies.

Tanabe et al. [49] situate OSINT within the broader intelligence cycle... Rajamäki et al. [50] examine the intersection of OSINT and Big Data Analytics (BDA) in maritime surveillance... Lovell and Heering [51] present Exercise Neptune, a simulator-based maritime cybersecurity training program...

IV. Methodology

The methodology presented in this section is designed as a practical framework for maritime OSINT practitioners. It is not intended as an experimental design requiring quantitative validation, but rather as a structured, qualitative approach to intelligence gathering that can be adapted and refined based on operational context.

A. OSINT Tools Research Process

The catalog of tools presented in this research was assembled from a range of public sources to address a gap in literature. This involved reviewing practitioner blogs, security conference materials, and technical forums where tools are actively discussed and evaluated. Tools were assessed based on their relevance to core maritime data streams like AIS, satellite imagery, vessel registries, and corporate records [12], [54].

B. Maritime OSINT Workflow

OSINT workflow is structured around five core phases: Identification, where intelligence requirements and the target's information environment are defined; Collection, involving methodical gathering of data from maritime-specific sources; Processing, where raw data is cleaned, normalized, and structured; Analysis, where processed information is transformed into actionable intelligence; and Dissemination, where findings are communicated to relevant stakeholders [55], [56].

C. Ethical and Legal Considerations

When conducting maritime OSINT operations, privacy is critical. Data minimization and purpose limitation are foundational principles. OSINT activities must also comply with legal frameworks such as GDPR, NIS-2 Directive, and data protection regulations. Ethical guidelines include legitimate purpose, proportionality, and transparency with relevant stakeholders [57]–[61].

V. Taxonomy of Maritime OSINT Tools

This section presents a comprehensive OSINT investigative toolkit for maritime security, structured into a modular framework of interconnected investigative domains.

A. Vessel and Ports Facility Tracking

The ability to monitor vessel movements and maritime traffic constitutes a foundational capability within maritime OSINT. The primary data source is AIS, a publicly broadcast signal designed for collision avoidance and maritime domain awareness [62]. By aggregating and visualizing this data, investigators can reconstruct a vessel's past activities and identify deviations from expected behavior.

B. Administrative and Regulatory Maritime Intelligence

The strategic value of corporate and official registry intelligence lies in its ability to explore the legal and administrative corners of the maritime domain. By mapping corporate hierarchies, verifying ownership through official documents, and assessing financial and regulatory compliance, investigators can transform a vessel identifier into a comprehensive OSINT profile.

C. Crew and Office Personnel

Platforms designed for crew recruitment and maritime networking represent a significant vector for information leakage. These resources are routinely exploited by malicious actors to harvest personnel data, including crew identities, certifications, employment histories, and vessel associations, to facilitate sophisticated social engineering and targeted phishing campaigns.

D. Digital Infrastructure, Social Reconnaissance and Cyber-Threat Intelligence

Once an initial foothold on a vessel's technological systems is established through network scanning (Shodan, Censys), an investigator can deploy a suite of IT-oriented OSINT approaches. This includes tools like Sherlock and Hunter.io for personnel data collection, vulnerability databases (CVE.org), and threat intelligence platforms (AlienVault OTX).

E. Analytical and Threat Assessment Tools

The final analytical phase employs specialized tools to transform raw maritime data into actionable intelligence. Link analysis platforms like Maltego are critical for visualizing complex relationships between vessels, corporate owners, and ports. Vulnerability scanners (Nmap, OpenVAS) probe the digital attack surface of shipboard and port systems.

VI. Case Study: Proactive OSINT Assessment of the Port of Tulum, Erewhon

Note: The case study presented in this section is based on a fictional port (the Port of Tulum) to avoid real-world targeting and ensure ethical compliance. It applies the maritime OSINT framework outlined in Section IV-B to conduct a proactive security assessment of the Port of Tulum, a fictional but representative mid-sized port in Erewhon.

1) Phase One: Identification

Intelligence requirement: "Map the digital and administrative footprint of Tulum Port to identify potential vulnerabilities exploitable by a threat actor." Key focal points included publicly accessible IT/OT systems, personnel information, operational schedules, and physical layout.

2) Phase Two: Collection

Data was gathered from multiple open sources: vessel traffic tracking (MarineTraffic), website analysis revealing email patterns, digital infrastructure reconnaissance (Shodan/Censys) exposing multiple ICS devices and unprotected NAS, and geospatial intelligence (Google Maps).

3) Phase Three: Processing

Data was organized into structured tables: Personnel Database (names, roles, social links), Asset Inventory (IPs, open ports, services, vulnerabilities), and Operational Timeline (vessel arrivals/departures).

4) Phase Four: Analysis

Findings were categorized into four thematic groups (Digital Infrastructure, Human/Personnel, Operational, Physical) and ranked by severity. Three main attack scenarios were identified: targeted ransomware attack via spear-phishing; operational disruption via ICS manipulation; and credential harvesting with network pivot. Findings were mapped to the MITRE ATT&CK framework [9].

5) Phase Five: Dissemination

A classified threat report was drafted for port management, summarizing critical risks (unsecured ICS devices, exposed management interfaces) and medium risks (employee information leakage), with recommendations including OT network segmentation and multi-factor authentication enforcement.

VII. Discussion

A. Human Factor

By systematically collecting and analyzing publicly available data, analysts can uncover vulnerabilities without engaging in intrusive activities. Tools like Shodan allow real-time monitoring of maritime digital footprints. When OSINT is integrated into existing threat hunting workflows, it enables early detection of anomalies and suspicious behavior patterns.

B. Organizational Integration

Effective implementation requires seamless integration of OSINT practices into existing maritime security operations. Penetration testing teams should collaborate closely with OSINT units, using open-source findings to simulate targeted attacks. Integrating OSINT into security operations ensures intelligence insights translate directly into actionable security measures [70].

C. Process Development

Well-defined processes ensure consistency and methodological discipline across maritime OSINT efforts. Requirements management includes regular reviews, prioritization frameworks, and feedback loops to ensure intelligence efforts align with operational security needs [72].

D. Training and Awareness

Running effective maritime OSINT operations requires people with the right skills and domain knowledge, a requirement reinforced by NIS-2 Directive Article 21 [73] and IMO's ISM Code [6]. Continuous learning is essential to keep pace with evolving threats, technologies, and shifting geopolitical dynamics.

E. Ethical and Operational Notes

All information was obtained from publicly accessible sources only. No systems were accessed without authorization. The exercise adhered to the ethical guidelines in Section IV-C, with purpose limitation and data minimization strictly observed.

F. Implications for Maritime Security

The case study validates that OSINT provides a low-cost, high-value layer of threat intelligence accessible to ports and maritime organizations of all sizes. Human factors remain the weakest link in maritime cybersecurity [75]. Continuous monitoring of an organization's own digital footprint is essential.

G. OSINT Integration Into Maritime Cybersecurity Governance and Operational Processes

Integration begins at the governance level, framing OSINT as a tool for fulfilling regulatory obligations such as IMO Resolution MSC.428(98) [5], NIS-2 Directive [73], and GDPR. A tiered integration model is proposed: Tier 1 (small operators) — semi-annual digital footprint audit; Tier 2 (mid-sized companies) — continuous monitoring via MSOC; Tier 3 (large ports) — dedicated threat intelligence function [23], [76], [77].

H. Limitations

OSINT relies on publicly accessible data, which may be outdated, incomplete, or intentionally misleading. The framework assumes a certain level of organizational maturity and resources. Smaller maritime entities may lack the expertise or budget to implement an OSINT program effectively. As OSINT methodologies become more widely adopted, threat actors may adapt to reduce their digital footprint.

VIII. Conclusion

The rapid and widespread digitalization of the maritime sector has dramatically expanded its cyber-attack surface. This research underscores the urgent need for proactive cybersecurity strategies. Through the development and application of a dedicated maritime OSINT framework, this paper demonstrates how publicly available information can be systematically leveraged to identify vulnerabilities, detect early-stage threats, and enhance situational awareness.

Key contributions include: (1) a structured, phase-based OSINT methodology tailored to maritime context; (2) a comprehensive taxonomy of maritime cyber threats; (3) a curated toolkit of over 100 OSINT resources; (4) an ethical and legal framework; and (5) practical guidance for organizational adoption with a tiered integration model.

Future research should prioritize integration with AI and machine learning to automate threat detection, the development of advanced sensor fusion platforms combining AIS, satellite imagery, and IoT data, and deeper exploration of human-centric OSINT including social media profiling and simulated social engineering attacks.