--- title: "When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security" description: The recent cyber attacks on Texas-bound tankers highlight the blurred lines between cyber and physical security, emphasising the need for enhanced OT security measures. image: https://csacyber.com/hubfs/Blog%20images%20%281%29.jpg --- [Skip to content](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search October 19, 2026 5 min read time # When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security For years, cyber security professionals have warned that the distinction between cyber and physical attacks is becoming increasingly difficult to define. ![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=48&height=48&name=1722023909652.jpg) [Written by: Nathan Long - Head of Soc Services](https://csacyber.com/blog/author/nathan-long) ![](https://csacyber.com/hubfs/Blog%20images%20%281%29.jpg) The recent cyber incidents involving two Texas-bound energy tankers may be one of the clearest examples of that problem. In August 2026, the US Coast Guard and FBI boarded two separate vessels in the Gulf of Mexico after identifying malicious cyber activity and indications that their networks had been compromised by foreign actors. One of those vessels, the VL Prosperity, was a 333-metre crude oil tanker carrying roughly 2.3 million barrels of oil towards Galveston, Texas. The second vessel has not been publicly named, although it has been reported to be a liquefied natural gas carrier. The incident has attracted particular attention because of reports that the attackers reached systems associated with the vessel's propulsion. Iranian state media, citing an unnamed crew member, claimed they interfered with engine cooling, engine speed and fuel systems, and knocked out communications for around 30 hours. In October, Bloomberg reported that US investigators had found evidence the attackers briefly accessed a digital system connected to the VL Prosperity's propulsion. How they got in, which functions they could control and who was responsible have not been established, and the investigation remains ongoing. While many cyber incidents result in data theft or business disruption, the concern here is that the compromise appears to have extended beyond traditional IT systems and into systems associated with vessel operations. For critical infrastructure operators, the more important question is not how attackers gained access, but how far they could move once inside. That distinction sits at the heart of many of today's OT security challenges. ## Beyond attribution Cyber security discussions often become heavily focused on identifying the threat actor. Was it Iran? A state-sponsored group? A politically motivated collective? Or another actor entirely? Investigators are still working to determine whether the two incidents are even connected, and some experts have cautioned that Iran-linked actors have a history of overstating their cyber capabilities. Attribution is obviously important, particularly for governments and intelligence organisations, but it can sometimes distract from the defensive questions that matter most to organisations operating critical infrastructure. The US Coast Guard has confirmed that its cyber teams and FBI personnel examined both the information technology and operational technology environments aboard the VL Prosperity after finding evidence of malicious cyber activity. The Coast Guard has not publicly disclosed the precise attack path or the full extent of the compromise, and has declined to comment on the more recent reports about the vessel's propulsion system. That uncertainty is important. It would be easy to take the reports about propulsion and engine systems at face value and assume that an attacker had effectively taken control of the vessel. Accessing a system connected to propulsion is not the same as controlling it, and the available evidence does not support making that conclusion. In fact, both the Coast Guard and the FBI have stated that there were no reports of operational disruption, vessel instability, physical danger to the crew or environmental impact after the threat was mitigated, and the vessel's manager has said the tanker was cleared by the Coast Guard for normal operations. What the incident does demonstrate, however, is how important it is to understand the relationship between traditional IT systems and operational technology during both incident response and security planning. In a normal enterprise environment, compromising a workstation or server might lead to credential theft, data loss or ransomware. In an operational environment, the same initial compromise could potentially provide a pathway towards systems that influence physical processes. That is the part that should concern organisations across critical infrastructure. ## The myth of the isolated ship Modern energy tankers are effectively floating industrial environments. They rely on interconnected digital systems for navigation, propulsion, steering, cargo management, communications, monitoring and diagnostics. As ships have become more connected to shore-based operations and external services, the number of systems that potentially need to communicate with one another has increased. There are obvious operational reasons for this. Remote monitoring can improve efficiency, shore-based teams need visibility of vessels, crews need reliable communications and vendors may require remote access to support equipment. The VL Prosperity incident highlights the importance of understanding both IT and OT environments during cyber investigations. How the attackers reached a propulsion-linked system has not been disclosed, and it should not be assumed that there was a direct route from a conventional IT system into a safety-critical control system. However, the fact that an intrusion appears to have reached that far at all demonstrates why understanding the relationship between those environments is so important. Nor does it appear to be an isolated case. By September, US government agencies were reportedly tracking cyber threats against nearly 20 shipping vessels around the world, and the Coast Guard had asked for advance notice if any of those ships planned to enter a US port. The same issue exists well beyond the maritime sector. Utilities are connecting substations and industrial equipment to networks that allow remote monitoring and management. Manufacturers are connecting production environments to corporate systems to improve visibility and efficiency. Water operators increasingly rely on digital monitoring and control, while transport organisations are integrating operational technology with wider enterprise infrastructure. None of this is inherently a bad thing. In fact, much of it is necessary for modern organisations to operate efficiently. However, a connection that looks relatively harmless from an IT perspective can become much more significant when it provides access to an environment responsible for controlling a physical process. ## What organisations should do now While the exact attack paths involved in these incidents are not publicly known, there are several practical areas that organisations operating OT environments should continue to focus on. **1. Strengthen IT/OT segmentation** Operational environments should be separated from corporate networks wherever possible, with connectivity limited to what is genuinely required. Organisations need to understand what traffic is permitted between those environments, why it is necessary and whether that access could provide an attacker with a route towards more sensitive systems. Segmentation is also one of the measures highlighted by the commander of US Coast Guard Cyber Command following this incident, alongside phishing awareness and basic cyber hygiene, with the reminder that attacks do not need to be sophisticated to succeed. **2. Improve visibility across OT assets** Maintaining an accurate inventory of OT assets, network connections, remote-access mechanisms and communications pathways is particularly important when systems have been deployed over many years. This becomes even more important during incident response. If defenders do not understand what a system is connected to, it becomes much harder to determine whether an intrusion has remained within IT or crossed into an operational environment. **3. Review remote access exposure** Remote administration and third-party access are increasingly common across critical infrastructure. Organisations should regularly review which vendors and personnel have remote access, what systems they can reach, how that access is authenticated and whether it is still required. Where remote access is necessary, it should be tightly controlled and monitored rather than treated as a permanent trust relationship. **Not who, but how far** The most important question coming out of these tanker incidents is not necessarily whether Iran was responsible. That is something investigators will need to establish through evidence, and publicly available information is currently not enough to make that determination. What is already clear, however, is that US authorities found malicious cyber activity affecting the networks of two Texas-bound energy tankers and considered the compromise serious enough to deploy specialist Coast Guard and FBI cyber teams to investigate the vessels. In the case of the VL Prosperity, investigators have reportedly found that the intrusion reached a system connected to the vessel's propulsion. As organisations connect more of their physical infrastructure to digital systems, the consequences of a successful intrusion can extend much further. The question becomes not only what information an attacker can access, but what they can influence, disrupt or potentially manipulate once they are inside. Maritime environments present a particularly challenging security problem because they combine traditional enterprise IT, satellite communications, third-party vendor access and operational technology within a single environment. Unlike many corporate networks, vessels often operate for extended periods with limited connectivity and restricted opportunities for maintenance, making vulnerability management and incident response more complicated. The same principle applies to energy, manufacturing, water, transportation and other critical infrastructure. The challenge for defenders is therefore not simply to keep attackers out. It is to understand what an attacker could reach if they succeed, how far they could move and whether existing controls would prevent a compromise of business systems from becoming an operational problem. How far could an attacker move inside your environment? Make that question part of your next security review. Examine the connections between IT and OT, challenge unnecessary remote access and check whether your segmentation protects the systems that matter most. To discuss your organisation’s OT security priorities, [get in touch](https://csacyber.com/contact-us) with CSA Cyber. Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images.jpg?width=624&height=427&name=Blog%20images.jpg)](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) October 16, 2026 14 min read ### [The attack surface has changed. The fundamentals have not.](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) Note from the author: Fair warning: this turned into a longer post than planned. I’m under no... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![](https://csacyber.com/hs-fs/hubfs/Untitled%20design.jpg?width=624&height=427&name=Untitled%20design.jpg)](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) August 20, 2026 9 min read ### [CSA Cyber and FluidOne named as suppliers on G-Cloud 15](https://csacyber.com/blog/csa-cyber-and-fluidone-named-as-suppliers-on-g-cloud-15) CSA Cyber (CSA), part of the FluidOne Group, has been named as a supplier on Government Commercial... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Nathan Long", "url" : "https://csacyber.com/blog/author/nathan-long" }, "dateModified" : "2026-10-19T13:18:08.972Z", "datePublished" : "2026-10-19T13:18:08.000Z", "headline" : "When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security", "image" : [ "https://csacyber.com/hubfs/Blog%20images%20%281%29.jpg" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```