A ship is the cleanest example of a network that is genuinely cut off, and then docks. The isolation is real. It is also scheduled.
In early September the LNG carrier Vivit Africa lost access to the systems its crew uses to monitor cargo parameters, held off the Italian coast without unloading, and sailed for Algeciras. The crew reported a suspected cyberattack; the Italian Coast Guard confirmed a malfunction and did not establish a cyber cause. It was the third tanker in a month with a control-system failure nobody aboard could explain.
Whether that one was an attack is not the point of this paper. The point is that nobody could say, because the layer that failed was the layer nobody was recording. A vessel at sea is disconnected by design, so the monitoring built for always-connected networks goes quiet there, and quiet reads like safety.
What RedEye puts on the vessel: air-gapped CAVER aboard, threat intelligence and AI updates sized for a satellite link, localized AI triage aboard, and RF threat intelligence with spectrum capture. The whole platform runs on the asset and keeps running when the link does not, decodes the automation protocols a marine engine room already speaks, and reaches a verdict where the data is rather than waiting for shore.
Every isolated network reconnects. What makes a ship worth studying is that its reconnection is on a timetable and everything arrives at once.
Alongside, the satellite or LEO link is shared by the business network, the equipment makers' remote service connections and, on many ships, the OT gateway itself. Chart and software updates come aboard on USB. The superintendent's laptop joins in port. A technician connects to the automation system to close out a job. None of that is unusual and all of it lands in the same few hours.
The same shape is everywhere once you look for it:
In every one of them the dangerous window is the reconnection, and the recording has to already be running when it opens. Instrumenting after the fact answers a different question: not what happened, but what is happening now that somebody is looking.
CAVER on the asset is the platform, not a sensor with a cloud dependency behind it.
That distinction decides what you have at sea. A sensor that forwards telemetry to a tenant ashore gives you nothing on the far side of a dropped link, which is precisely the interval in question. The search, the detections, the content and the evidence store are all local.
Air-gapped operation is a supported deployment shape rather than a configuration people improvise: the offline application path, the knowledge-object distribution model and the sealed deployment mode are all built for an installation that is never expected to reach the internet.
Ingest is durable or it says so: a sender is told 200 only after the record is safe, spools to disk when the store is busy, and replays on recovery. Local logins keep working from a sealed cache if the storage layer is down.
An air-gapped deployment goes stale unless updating it is a first-class operation. On a vessel it also has to fit a link that is metered, shared and sometimes absent.
Content arrives as signed offline bundles: detections, packs and intelligence, verified on arrival, applied without the platform reaching out for anything. The same mechanism serves a ship alongside, a site an engineer drives to with a drive in a bag, and a sealed network that will never have a route out. Threat intelligence arrives the same way, including offline STIX 2.1 bundles.
Releases carry a signed SBOM and attestations the vessel can verify offline, and a FIPS 140-3 mode build is available. Endpoint agent updates are signed, staged by percentage and roll back by themselves.
What this means for you: being offline stops being a reason to be out of date, and updating stops requiring the one thing an isolated asset does not have.
Marine automation is industrial automation. The integrated automation system, cargo control, and the power management system speak the same protocols as a plant ashore.
CAVER decodes more than a dozen industrial protocols: Modbus/TCP, DNP3, EtherNet/IP with CIP, S7comm, BACnet/IP, IEC 60870-5-104, OPC UA, PROFINET, IEC 61850 GOOSE and MMS, IEEE C37.118 synchrophasor and ANSI C12.22 metering, from a mirror of the traffic. The 61850 family is what power management and shore-power interfaces speak. CAVER then models the control conversation rather than matching known-bad packets: who talks to what, in what order, at what rhythm, and whether the exchange reads or writes.
It reads the values on the wire, not only who talked to whom: the register that moved, the tag that changed, the session that did it. A cargo pump setpoint written at 3 a.m. is a record with a value, a mode and a source.
The read-or-write distinction is the load-bearing one, because it separates watching a process from operating it.
CAVER also learns the envelope each process normally runs in and the crew pattern that normally runs it, and reports departures with the limiting setting named, for example a ballast or cargo pump schedule that cannot reach its target. A port-call service visit is a declared change window: the technician's work is attributed and de-weighted, and anything outside the window or the declared scope is not.
CAVER installs in one of two modes, whichever suits the vessel. Read-only mode is a passive sensor with no writes and no response actions. Interactive mode adds signed, audited response actions, and you choose per site. The network sensor stays passive in both, which matters on a vessel carrying a cryogenic cargo.
The ship's own network gear feeds the same store: the satellite terminal's firewall, the switches and the routers report through syslog, flow and SNMP. The cargo-control workstation and the loading computer report process, network and driver activity through the Carbide endpoint agent, with no per-endpoint charge.
AIS. The Maritime edition decodes AIS from a marine VHF receiver, keeps a vessel inventory and track history, and looks up voyage logs, so what the ship broadcasts and what the ship's own sensors report can be compared. NMEA 0183, IEC 61162 and ECDIS decoding are not part of the product. This paper is about the automation and cargo layer, which is the layer that failed on the Vivit Africa and on the VL Prosperity before it.
The things that reach a ship do not all arrive on the wire. A GNSS carrier that is not a satellite, a drone controller on the bridge wing and a rogue access point announcing the crew network are all radio.
CAVER RF is an add-on to the platform: a receive-only sensor set that streams sweeps and observations into your deployment around the clock, with a finding raised if the receiver stops. It is deployed first as an on-vessel assessment and then left in place. Early deployments are with design partners. The sensor only listens and never transmits, and the spectrum picture is a few megabytes a day per site, so a vessel keeps years of its own radio history on its own storage.
The Maritime edition packages the vessel layer on top of CAVER RF: AIS decode, vessel inventory, voyage log, deck layout, SATCOM exposure and GNSS rules, and the USCG evidence report. Port calls are drawn on the Early-Warning Timeline so arrivals line up with where the ship was. Seven new radios since the last port is the paper on it.
An alert that can only be triaged ashore is not an alert at sea. It is a queue entry waiting for internet.
AI triage runs on the vessel's own deployment. The analysis that would normally happen ashore happens where the data is: the notable is dispositioned locally, in the same interval the crew is living through, rather than queueing until the ship is alongside and the question has become historical.
Every verdict records whether it was produced on-box or with egress. That posture is part of the record rather than a claim about it, so an auditor can tell the two apart later and a customer running sealed can show that nothing left the asset.
The AI side updates the same way the intelligence does, in signed offline bundles sized for the link, so an air-gapped deployment is not frozen at the day it was installed. A readiness page states whether the on-board model is available, so a verdict is never silently missing.
Load the Safety Management System's cyber procedures and a finding arrives with the vessel's own procedure attached, not a generic playbook.
What this means for you: the window between an event and somebody deciding what it was stops being the length of the voyage.
CAVER charges a flat fee per deployment. There is no charge per gigabyte.
That is a pricing decision, but it only works because of how the system is built. On a storage lake, what a search costs depends on how many files it opens, not how many bytes you have kept. CAVER continuously merges small files into fewer, larger, sorted ones.
On a real production system running about 100GB a day, that change did two things:
Older data moves to a sealed tier that is simply a folder. Months outside your search window are never opened at all. There is no separate index to rebuild before a search or an alert can reach that folder: detections and dashboards query it directly, measured at 172 milliseconds for an alert and 76 milliseconds for a dashboard panel over a million events.
What this means for you: "how far back can I search" becomes a storage question, not a performance question. You stop choosing between logging the whole automation network and staying inside budget.
One product, not a different tool for every environment.
CAVER runs on Kubernetes, a virtual machine, an isolated network, or a single box. License activation does not need an internet connection, and a lapsed license gives you a 14-day grace period rather than shutting off mid-incident.
This is your risk decision. Both are real products. Neither is a discouraged version of the other.
SAML 2.0 and OpenID Connect are both configured in the product: paste or fetch your identity provider's SAML metadata, or point at your OIDC issuer for discovery, then map the attributes or claims to roles. Test against the live provider before you can turn it on: enable is refused without a successful test in the last 24 hours. A saved change or a disable takes effect on the next request, no restart, and local login stays reachable so an identity-provider outage cannot lock your operators out. An OIDC client secret is sealed in the product's credential vault, never stored in the clear.
SCIM provisioning is configured the same way: an operator mints a bearer token for the identity provider, shown once and stored only as a hash, revoked on the very next request rather than the next restart. Group membership from SAML, OIDC, or SCIM maps to roles by the same rule.
A fleet is managed as a fleet. Content and configuration roll to vessels in canary stages from a deployment server, each vessel is its own tenant, and the shore team searches across them when the link is up. A vessel that is offline picks up the change when it next syncs. A vessel's whole configuration can be one committed file with a drift hash, so a fleet can prove each ship runs what was approved. Available on request, typically delivered within 30 days of order.
When a casualty investigation, a class society or an insurer asks what the control system did, the answer has to hold up without trusting the vendor or the operator.
The Evidence Locker seals incident evidence on write-once storage, signs it and lets someone who trusts neither of us check it offline. CAVER produces a USCG maritime transportation system cybersecurity rule evidence report, signed, with unevidenced controls shown as unevidenced. It is the assessment and detection evidence for the plan; the plan and the cybersecurity officer remain yours.
The control conversation around an incident can be exported as a hash-chained bundle with redaction applied. For design partners, the recorded control conversation is kept on the vessel's own storage, tiered by age, and replayed or exported for any incident window.
Changes to controller logic on the power-management or cargo system are acquired, diffed and alerted on, so a modified program is a finding with a diff. Available on request, typically delivered within 30 days of order. Daily operating screens for the engine and cargo systems sit beside the security ones, so the chief engineer and the security officer read the same data, and weekly vessel posture reports are delivered to the shore office on a schedule, available on request.
Depth is not evenly available, and a paper that hides that costs more than it wins.
If a vessel-specific layer is what you need, that is a product conversation rather than a purchase, and it should start by saying so.