Most mid-market organizations have at least one location where nobody does IT. A plant, a clinic, a branch, or a fleet of laptops in people's homes. International Seaways has more than 80 of them, and they move.
Amit Basu is CIO and CISO of International Seaways, a NYSE-listed tanker operator and a Gradient Cyber customer for a number of years. On our podcast, he walked through what it takes to secure a fleet when the network is on the other side of an ocean. Watch the full episode here. His answers apply well beyond shipping.
Why is a ship harder to secure than an office?
An office has steady, high-bandwidth connectivity and a controlled environment. A ship has neither. Connectivity is intermittent, bandwidth is limited, and IT systems, operational technology and crew communications all share one link to shore. Basu described what that means in practice: they are all "sharing the same internet connection from the ship to the shore and that creating a significant risk as vulnerabilities in one system can potentially spread to the others."
Patching suffers too. He noted it "can take sometimes weeks or months before security patches reach the onboard systems."
The practical consequence: you have to assume vulnerable software stays in service longer than you would like. That makes detection the control that matters.
How do attackers get onto a vessel?
Basu named three routes:
- Phishing aimed at crews. AI-assisted social engineering targets crew credentials, and rotating crews get limited security training.
- Port calls. Large numbers of people board for services and inspections, which creates opportunities to tamper with devices or plant malware.
- Vendor remote access. Suppliers connect to shipboard systems for maintenance and troubleshooting. When those access points are poorly monitored, a breach can go unnoticed for a long time.
Of course, none of these is unique to shipping. Change out "port call" for "contractor visit" and "crew" for "front-line staff," and you have the same remote-site risk profiles for almost any organization.
Why can't the people on site handle detection?
Because detection isn't their job. Basu put it simply: "the ships don't sail with any dedicated cyber security expert." Crews are trained to run the ship and move cargo safely. Security awareness training helps, but it doesn't turn a crew into cyber analysts.
His summary of where that left him: "We often lack visibility of [the] onboard network and there is no cyber security specialist onboard ships. It was really difficult to detect an onboard breach in real time... by the time we get to know about a security breach it may be too late."
What does detection look like when you can't put anyone there?
He was blunt about the staffing option: "I cannot put a human there to do that."
What he looked for instead was continuous monitoring that learns what normal behavior looks like on each ship, flags deviations from that baseline, and alerts the shore-based security team. He described the result as "having an automated security expert onboard ships who is keeping eye on the entire shipboard computing environment, IT and OT, and detecting any anomalies."
The design choice that matters: monitoring runs all the time, even when a vessel is out of reach of shore-based resources. People engage when there is something worth acting on.
How does Gradient Cyber support International Seaways?
Each vessel carries a lightweight sensor that monitors mirrored network traffic passively, so nothing sits inline with vessel systems. Quorum AI learns normal behavior on each ship's network, across IT and OT traffic, and flags what deviates.
What reaches International Seaways' shore-side team is a SitRep, not a raw alert. Each SitRep carries the supporting evidence, a severity, and prioritized actions. The team works from one view across the fleet instead of treating every ship as a separate problem.
Does this apply if you don't run ships?
Certainly. A ship is an amplified version of a common problem. Branch offices, plants, clinics, and remote employees all create places where activity happens and nobody qualified is looking.
The questions are the same at each place:
- What share of the site's network, endpoint and identity activity can you actually see?
- How quickly would you know if something changed?
- Who acts on a finding, and how do they know what is safe to touch?
That last question depends on knowing the business. Which systems can be isolated without stopping operations is not a generic answer. It's why a provider has to learn your environment before it responds.
What should you prioritize for remote, always-moving operations?
Basu's advice to CISOs in similar environments was to adopt a resilience mindset. In his words, the focus "should not be on just preventing attacks but on ensuring the systems are prepared to quickly detect, respond and recover from incidents."
He then laid out where to start:
- Secure IT and OT through network segmentation and layered security
- Prioritize crew training to reduce human error
- Assess third-party vendor risk
- Maintain continuous monitoring and access to threat intelligence
Frequently asked questions
Can MXDR monitor OT on a vessel without disrupting it?
Yes, when monitoring is passive. At International Seaways, sensors analyze mirrored traffic rather than sitting inline, so vessel systems keep running exactly as before. Detection happens without adding a component that could interrupt operations.
Does MXDR replace onboard security tools?
No. Firewalls, endpoint protection and network segmentation still do the work of prevention. MXDR adds continuous detection and response across those controls, which matters most where patching lags and nobody on site is watching for anomalies.
Who acts on a finding?
The SitRep goes to the team responsible for the site, typically shore-side IT or an MSP, with prioritized actions. Depending on customer policy, Gradient Cyber can also carry out approved response actions directly.
What if my remote sites aren't ships?
The same model applies. Any location without qualified security staff on site needs continuous monitoring, a baseline of normal behavior, and a clear path from finding to action.
Basu's framing is worth borrowing for any location you can't staff. If you can't put a person there, decide what does the detecting instead, and who acts when it finds something.