A port can lose its ability to move cargo even when its cranes, roads and warehouses remain intact. If the digital systems that organize its operations fail, ships may face delays, trucks may wait outside the gates and businesses may lose access to essential goods. This gives port cybersecurity a wider significance. A failure inside one terminal can become a problem for an entire supply chain.
This is the central issue raised by Dr Sotiris Theofanis in his presentation on digital development and port security, prepared for an Arab Academy for Science, Technology and Maritime Transport forum in September 2026. His argument provides a useful starting point for a geopolitical assessment. As ports become digital networks, protecting them requires attention to the systems and relationships that allow trade to function.
The more connected the port, the wider the threat
For decades, port security focused mainly on physical protection. Fences, patrols, cameras and access controls helped protect facilities and cargo. These measures remain necessary. But a modern port also depends on software that manages container movements, exchanges shipping documents and connects terminal operators with customs, transport companies and shipping lines.
Theofanis highlights a basic tension in this development. Greater connectivity improves coordination but also creates more possible entry points for attackers. A port may protect its own systems well and still face risks through a supplier, a contractor or another organization connected to its network.
The consequences become more serious when business systems are linked to the technology that controls physical operations. Information technology handles data, documents and communications. Operational technology helps run equipment and industrial processes. When these systems are connected, a digital intrusion can potentially affect the movement of goods. The damage depends on where the attacker gains access and how effectively the networks are separated.
When a cyberattack stops cargo, not ships
The 2017 attack on Maersk showed how disruption could spread across a major maritime business. In its statement at the time, the company reported that IT systems were down across several sites and that APM Terminals was affected in a number of ports. It also confirmed that its vessels remained able to maneuver and communicate. This distinction matters. A cyberattack can cause serious commercial disruption without disabling ships or every part of a company’s operations.
For governments, the strategic concern is the dependence of the wider economy on these services. A prolonged interruption at an important gateway could delay industrial components, food shipments or energy supplies. It could also push cargo towards alternative ports, where additional traffic may create further pressure. The scale of the impact would depend on the affected cargo, the duration of the disruption and the available alternatives.
The geopolitical power of disruption without destruction
From a geopolitical perspective, this creates a possible means of applying pressure without physically destroying infrastructure. An attacker seeking disruption could target the information needed to release cargo, organize transport or coordinate a terminal. The strategic value lies in interrupting the flow of goods rather than damaging the facilities themselves.
However, the consequences of an attack do not establish who carried it out or why. Criminal groups may seek ransom payments, while other attackers may pursue espionage or political objectives. A commercially motivated incident can have strategic effects without being a state operation. Treating every port cyberattack as an act of geopolitical confrontation would obscure the evidence and make an appropriate response harder.
Many operators, one port, no room for confusion
The presentation also raises a difficult question about responsibility. A port is a community of organizations, often with different owners, budgets and security standards. The port authority, terminal operators, shipping companies, customs services and technology suppliers each control part of the system. Unless they agree on leadership and procedures, a shared emergency can produce a fragmented response.
This is why cybersecurity belongs at senior management level. Technical teams need resources and clear instructions, but management must decide which services are essential, how long an interruption can be tolerated and who has authority to isolate affected systems. Staff also need practical training. A convincing fraudulent message or the misuse of a legitimate account can undermine expensive technical safeguards.
Theofanis places particular emphasis on resilience, meaning the ability to withstand disruption and restore essential operations. Prevention alone cannot answer the whole problem. Ports also need protected backups, tested recovery procedures and workable alternatives when digital services are unavailable. Separating critical networks can help prevent an intrusion in one area from spreading across the facility.
From Rotterdam to Belgium: security beyond port boundaries
Cooperation offers another part of the answer. In December 2024, Dutch seaports announced the expansion of FERM, previously active in Rotterdam and Moerdijk, into a national cybersecurity platform. Its role includes sharing threat information, exchanging knowledge and training companies within port communities.
Belgium’s Port 2 Port Security Platform, launched in November 2025, takes a broader approach. It brings together sea and inland ports to address threats including drug smuggling, cyberattacks and drone misuse. The initiative reflects the overlap between physical access, organized crime and digital security.
These examples suggest a practical lesson for maritime countries, including Greece. Competition between ports does not remove their shared exposure to disruption. Common exercises, trusted communication channels and cooperation with public authorities can strengthen the transport network beyond the boundaries of an individual terminal.
The real test: can a port keep trading under attack?
Artificial intelligence may support this effort by identifying unusual activity and helping security teams assess threats. Its usefulness, however, depends on reliable data and effective procedures. It cannot resolve unclear responsibilities or replace decisions about how a port should operate during a crisis.
For policymakers, the measure of progress should therefore extend beyond new equipment and faster cargo handling. It should include evidence that essential services can survive an interruption and that recovery plans work in practice. A trade gateway’s strategic value rests partly on the confidence that it will remain usable when conditions deteriorate.
The next serious disruption may begin with a compromised account or a software connection far from the quay. Whether it remains a contained incident or becomes a wider economic crisis will depend on preparations made before the first system fails.
Source
Theofanis, Sotirios. The Impact of Digital Development on Port Security – From Physical Protection to Cybersecurity. Presented at the Arab Academy for Science, Technology and Maritime Transport (AASTMT) forum, Enhancing Strategic Port Security and Operations in an Era of Geopolitical Change, 13–17 September 2026.
About Dr Sotiris Theofanis
Dr Sotiris Theofanis is an academic and expert in port management, freight transport and logistics, with extensive executive and research experience in Greece and internationally. He currently serves as Adjunct Professor at Aristotle University of Thessaloniki and as Affiliated Faculty Member and Senior Research Associate at Rutgers University in New Jersey, USA. He has served as Chairman and CEO of the Piraeus Port Authority, CEO and subsequently Chairman and CEO of the Thessaloniki Port Authority, and Co-Director of the Freight and Maritime Programme at Rutgers University’s Center for Advanced Infrastructure and Transportation (CAIT).
George S. Skordilis is Editor-in-Chief of geo-trends.eu.