Hanwha Ocean adopts Rakuten Maritime's cybersecurity-by-design across the vessel lifecycle

Security moves to the drawing board

Hanwha Ocean has signed a full commercial agreement with Rakuten Symphony to deploy the Rakuten Maritime cybersecurity platform across its vessel design, construction and operational activities — described by both companies as the first commercial implementation of the integrated system. According to Digital Ship and Rakuten Symphony’s own announcement, the South Korean shipbuilder will embed a “cybersecurity-by-design” framework into its shipbuilding process, using threat intelligence, threat modelling and onboard risk assessment tools from the earliest design stages through to delivery and operation.

The deployment also includes scanner technology for onboard equipment assessments, together with threat analysis and risk management modules for selected vessels under construction. The stated aim is to identify cyber vulnerabilities before construction progresses, reducing operational risk and avoiding costly remediation after a ship has been delivered.

Aligning with IACS E26 and E27

Ryan Son, who heads Rakuten Maritime, called the adoption by a global shipbuilder “a massive validation” of building security in “from the outset of design and construction rather than treating security as an afterthought.” Hanwha Ocean’s Merchant Ship Business Division said cybersecurity had become “a critical factor influencing safety, quality and regulatory compliance” as vessels incorporate more connected and software-driven systems.

The agreement also aligns Hanwha Ocean with the industry’s growing focus on the International Association of Classification Societies’ Unified Requirements E26 and E27, which place greater emphasis on cyber resilience in ship systems and are reshaping how newbuildings are specified.

Apeks view — Designing cyber resilience in at the shipyard is the right direction, and it is welcome to see it treated as an engineering discipline rather than a bolt-on. But the harder test comes once the ship is in service. In practice, much of the industry’s cyber protection still lives on paper, and when crews are under pressure a USB stick still finds its way into a bridge or engine-room PC. Resilience is won not by the framework specified at delivery, but by whether it is enforceable — and actually enforced — in daily operation.