Artificial Intelligence in Maritime Cybersecurity: A Systematic Review of AI-Driven Threat Detection and Risk Mitigation Strategies

Abstract

The maritime industry is undergoing a digital transformation, integrating automation, artificial intelligence (AI), and the Internet of Things (IoT) to enhance operational efficiency and safety. However, this technological evolution has also increased cybersecurity vulnerabilities, exposing vessels, ports, and maritime communication networks to sophisticated cyber threats. This systematic review, conducted following the PRISMA guidelines, examines the current landscape of AI-driven cybersecurity solutions in maritime environments. By analyzing peer-reviewed studies and industry reports, this review identifies key AI methodologies, including machine-learning-based intrusion detection systems, anomaly detection mechanisms, predictive threat modeling, and AI-enhanced zero-trust architectures. This study assesses the effectiveness of these techniques in mitigating cyber risks, explores their implementation challenges, and highlights existing research gaps. The findings indicate that AI-powered solutions significantly enhance real-time threat detection and response capabilities in maritime networks, yet issues such as data scarcity, regulatory constraints, and adversarial attacks on AI models remain unresolved. Future research directions should focus on integrating AI with blockchain, federated learning, and quantum cryptographic techniques to strengthen maritime cybersecurity frameworks.

1. Introduction

The maritime industry, a cornerstone of global trade and logistics, is undergoing a profound digital transformation driven by artificial intelligence (AI), automation, and interconnected systems that redefine maritime operations. Technologies such as the Internet of Things (IoT) [1], autonomous ships, smart ports, and cloud-based fleet monitoring have significantly optimized operations such as shipping routes, cargo tracking, and fuel consumption. Yet, this digital evolution has simultaneously expanded the threat landscape, introducing unprecedented cybersecurity vulnerabilities that expose critical maritime infrastructure to cyberattacks capable of disrupting global supply chains, compromising navigational safety, and causing severe financial and environmental consequences [2].

Maritime networks rely on a complex ecosystem of satellite communications [3], ship-to-shore data exchanges, and remote monitoring systems [4]. The increased connectivity has widened the attack surface, making the sector vulnerable to ransomware, GPS spoofing, denial-of-service (DoS) attacks, and unauthorized intrusions targeting ship control systems. In particular, the integration of AI in maritime cybersecurity has emerged as both a critical safeguard—enabling automation and real-time threat detection—and a potential vulnerability due to its susceptibility to adversarial manipulation and data privacy risks. AI-driven cybersecurity solutions, including machine-learning-based intrusion detection systems (IDSs), anomaly detection frameworks [5], and predictive threat analytics, offer the potential to automate threat detection [6], improve response times, and reduce human intervention. However, these benefits are counterbalanced by challenges such as adversarial attacks on AI models, regulatory constraints, and limitations in maritime-specific datasets.

Despite the growing body of research on AI applications in cybersecurity, there is a lack of systematic analysis focused on how AI technologies are specifically applied in maritime environments. The existing literature has largely emphasized traditional cybersecurity measures, with limited exploration of AI-driven approaches tailored to the unique constraints of the maritime domain, such as unreliable network connectivity, operational latency, and the need for real-time decision making in dynamic conditions [5,6,7].

This study aims to address this gap by conducting a systematic review of AI-based cybersecurity strategies in maritime environments, following the PRISMA methodology. The primary objectives of this review are to (1) identify the key AI techniques employed in maritime cybersecurity, (2) assess their effectiveness in detecting and mitigating cyber threats, (3) examine the challenges associated with AI adoption in maritime security, and (4) propose future research directions for strengthening cybersecurity resilience in the maritime domain. These objectives structure the analysis and are directly addressed in the discussion section to ensure a clear alignment between research questions and findings.

2. Methods

This systematic review follows the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines to ensure a rigorous and transparent synthesis of the existing research on AI-driven cybersecurity solutions in the maritime sector. The methodology includes a structured approach to study selection, data extraction, and analysis to assess the effectiveness of AI-based cybersecurity solutions in maritime networks.

2.1. Study Design

A systematic literature review (SLR) approach was adopted to identify, evaluate, and synthesize the relevant studies on AI applications in maritime cybersecurity. The focus was placed on peer-reviewed journal articles, conference papers, and industry reports discussing AI-driven security measures, including intrusion detection, anomaly detection [8], zero-trust architectures, and predictive threat modeling in maritime environments [9]. This review aims to provide a comprehensive overview of the existing knowledge base while highlighting key research gaps.

2.2. Eligibility Criteria

The selection of studies was guided by specific inclusion and exclusion criteria. Studies were included if they explicitly discussed the use of AI for cybersecurity in maritime networks, focusing on AI-driven solutions such as machine learning, deep learning, reinforcement learning, or AI-enhanced blockchain security. Only papers published in peer-reviewed journals or high-quality conference proceedings between 2015 and 2025 were considered. Additionally, selected studies needed to provide empirical evaluations, case studies, or simulations of AI-driven cybersecurity mechanisms in maritime environments.

Studies were excluded if they did not specifically address maritime cybersecurity or if they focused solely on traditional, non-AI cybersecurity methods. Papers lacking a clear methodological framework, technical implementation details, or significant contributions to the field were not considered. Duplicate or low-quality publications were also omitted to maintain the review’s integrity.

2.3. Search Strategy

A systematic search was conducted using reputable academic databases, including IEEE Xplore, Scopus, Web of Science, and Google Scholar. The search strategy incorporated a combination of keywords and Boolean operators to ensure comprehensive coverage of the literature. Search queries included terms such as “artificial intelligence in maritime cybersecurity”, “AI-driven intrusion detection in maritime networks”, “machine learning for cyber threat detection in shipping”, and “blockchain-enhanced maritime cybersecurity”. The search was refined by applying filters for publication years, peer-reviewed sources, and subject areas related to AI, cybersecurity, and maritime studies.

To ensure a robust dataset, additional sources such as industry white papers, technical reports, and government publications were examined. Reference lists of key papers were manually screened to identify additional relevant studies that may not have surfaced through database searches.

2.4. Study Selection and Data Extraction

The study selection process followed a multi-step approach. First, an initial screening of titles and abstracts was conducted to eliminate irrelevant studies. The remaining papers were assessed in detail, with full-text reviews performed to determine their alignment with the inclusion criteria. Any discrepancies in the selection process were resolved through discussion among the reviewers to ensure consensus.

For data extraction, a standardized template was used to collect relevant information, including study objectives, AI techniques employed, datasets used, evaluation metrics, key findings, and identified challenges. Information on the methodological rigor and potential biases of each study was also documented.

2.5. Data Analysis

A qualitative synthesis of the extracted data was performed to identify common AI techniques used in maritime cybersecurity, assess their effectiveness, and highlight existing research gaps. Studies were categorized based on the specific AI methodologies employed, such as supervised learning for threat detection, unsupervised learning for anomaly detection, and reinforcement learning for adaptive cybersecurity measures. Additionally, an assessment of bias and study limitations was conducted to ensure the reliability of findings.

A PRISMA flow diagram (Figure 1) was generated to illustrate the study selection process, detailing the number of records identified, screened, included, and excluded at each stage. The final dataset was systematically analyzed to derive insights into the current state of AI-driven maritime cybersecurity and its future research directions.

3. Results

3.1. Study Selection Process

The systematic search across academic databases identified an initial set of 1069 articles. After applying document-type restrictions, focusing on conference papers and journal articles, and limiting the subject areas to computer science, engineering, and decision sciences, the dataset was refined to 695 articles. Further filtering based on specific cybersecurity and AI-related keywords, such as network security, anomaly detection, intrusion detection, blockchain, zero trust, and maritime cybersecurity, resulted in a more focused selection of articles. A thorough title and abstract screening followed by a full-text assessment led to the final selection of highly relevant studies investigating AI-driven cybersecurity applications within the maritime sector.

A citation analysis of the selected articles revealed a steady increase in research impact over the past decade, with a total citation count of 7006. Studies published before 2024 accounted for 6690 citations, while an additional 316 citations were recorded in 2024 alone. The growing citation trend reflects the increasing significance of AI-driven cybersecurity solutions in maritime environments as researchers and industry experts continue to address the rising threat landscape in digitalized maritime operations (Figure 2).

A closer examination of publication trends over time highlights the growing interest in AI-driven maritime cybersecurity research. Prior to 2014, no significant contributions were recorded, but from 2015 onward, the number of publications began to increase, with 21 articles that year, followed by 26 in 2016 and 36 in 2017. The research trajectory accelerated between 2018 and 2020, with 54, 77, and 78 publications, respectively, signaling an increasing recognition of cybersecurity risks in maritime communication and navigation systems. A noticeable surge occurred from 2021 onward, with 76 publications in that year, followed by a sharp increase to 106 in 2022. The number of publications peaked in 2023 with 167 articles, and early 2024 data indicate that this trend is continuing, with 167 publications already recorded. This sustained growth underscores the rising importance of AI-driven solutions in maritime cybersecurity, particularly in response to the increasing adoption of autonomous shipping, smart port infrastructures, and AI-powered threat mitigation systems (Figure 3).

The geographical distribution of research contributions reveals that China and the United States lead in terms of publication volume, with 157 and 107 articles, respectively. The United Kingdom follows with 59 publications, while India, Italy, Norway, and Germany also contribute significantly to the field. Norway’s involvement in maritime cybersecurity research stands out, likely due to its strong focus on autonomous shipping technologies and smart maritime infrastructure. Emerging research activity is also evident in Poland, which contributed 14 publications, reflecting its growing engagement in European maritime cybersecurity initiatives (Figure 4).

The format in which research is disseminated provides further insight into the field’s maturity. A substantial portion of the publications, totaling 401 documents, consists of conference papers, indicating that many studies in this area are still in the exploratory and experimental phase. The prominence of conference papers suggests that AI-driven cybersecurity for maritime applications is a rapidly evolving research domain, with new methodologies frequently being presented before undergoing full-scale validation. In contrast, 261 documents are peer-reviewed journal articles, demonstrating a more established body of knowledge and rigorous empirical contributions. The relatively lower number of journal publications compared to conference papers indicates that many AI-driven cybersecurity models are still in development and have yet to transition into large-scale, real-world implementations (Figure 5).

3.2. Overview of Selected Studies

The final dataset consists of research papers that investigate a wide range of AI-based techniques for cybersecurity in maritime environments. The studies cover methodologies such as machine learning [10], deep learning [11], reinforcement learning [12], blockchain security, and zero-trust architectures, with applications in autonomous ships [13,14], smart ports, maritime logistics [15], and ship-to-shore communications [16]. A significant portion of the literature focuses on anomaly detection in maritime networks [17], where AI models have been trained to identify cyber threats in automatic identification systems (AISs) [18,19], vessel communication channels, and satellite-based maritime navigation systems [20]. Deep learning techniques [21], including convolutional neural networks (CNNs) and recurrent neural networks (RNNs) [22], frequently appear in studies related to maritime threat prediction [23] and attack detection [24,25]. Several works introduce hybrid AI models that combine supervised [26] and unsupervised learning [27,28,29] approaches to enhance the accuracy and efficiency of intrusion detection in maritime cybersecurity frameworks [30,31].

Among the reviewed articles, research focusing on cyber risk assessment for autonomous ships has gained increasing attention. Many of these studies emphasize the vulnerabilities of unmanned maritime systems to cyberattacks [32,33,34] and propose AI-enhanced security models capable of continuously monitoring network activity, predicting potential security breaches [35], and autonomously initiating mitigation measures. The implementation of blockchain technology [36] for secure maritime transactions and ship authentication mechanisms is also emerging as a key research area, with several studies proposing AI-powered decentralized security protocols to safeguard maritime data integrity [37].

The selected studies explore multiple AI-driven cybersecurity mechanisms applied to maritime operations. The development of intrusion detection systems (IDSs) using machine learning classifiers [38], decision trees, and deep neural networks has been a dominant trend [39,40]. AI-based anomaly detection frameworks leveraging unsupervised learning techniques [41,42,43] have been used to flag deviations from normal ship network behavior [44,45], identifying potential cyberattacks before they escalate [46]. Several studies propose reinforcement-learning-based IDS models that dynamically adapt to new cyber threats in real time, improving maritime cybersecurity resilience [47,48,49].

A growing body of research focuses on risk assessment frameworks for autonomous vessels, where AI-driven predictive models assess cyber risks based on real-time data streams [50]. The integration of federated learning is also emerging as a viable solution to address privacy concerns in maritime cybersecurity [51,52], enabling distributed AI models to learn from multiple ship networks without requiring centralized data storage [53,54]. Studies discussing AI-enhanced blockchain security solutions propose using decentralized authentication mechanisms to protect maritime communication networks from cyber threats [55,56]. Several works present AI-powered zero-trust security architectures that continuously verify access credentials in maritime cloud systems, preventing unauthorized intrusions in ship-to-shore data exchanges [57,58].

The application of AI to maritime threat intelligence and cyberattack prediction is another major area of research [59,60]. Several studies employ natural language processing (NLP) models to analyze maritime cybersecurity incident reports, identifying patterns that improve cyber risk forecasting [61,62]. Graph-based AI techniques have also been used to model cyber threat propagation in maritime networks, allowing for early-stage attack detection and proactive defense strategies [63].

3.3. Bias Assessment and Threats to Validity

A comprehensive assessment of bias in the selected studies revealed several critical limitations that influence the reliability, robustness, and applicability of AI-driven cybersecurity solutions in maritime environments. These biases stem from multiple sources, including dataset selection, validation methodologies, model design, deployment gaps, and regulatory misalignment. Addressing these issues is essential for ensuring that AI-based security frameworks deliver trustworthy and actionable results in real-world maritime settings [64,65,66].

3.3.1. Selection Bias and Dataset Limitations

One of the most prominent sources of bias identified in this review is selection bias arising from the use of non-representative or synthetic datasets. Approximately 30% of the reviewed studies rely on small-scale or simulated datasets that fail to capture the full range of cyber threats encountered in operational maritime networks [67,68]. In many cases, AI models were trained using general-purpose cybersecurity datasets derived from traditional IT infrastructures [69,70], which significantly differ from maritime environments in terms of connectivity, latency, data structure, and operational context. The lack of high-quality, labeled, maritime-specific datasets—particularly for shipboard systems [68], port infrastructures, and vessel-to-shore communications—substantially limits model generalizability and may lead to overfitting or poor threat detection performance in real-world conditions [71].

3.3.2. Validation Bias from Simulations

Around 25% of the studies validated their AI models using simulation-based environments or synthetic attack scenarios [72]. While simulations are useful for prototyping and initial testing, they lack the complexity, unpredictability, and noise present in live maritime systems. Maritime cyberattacks often involve sophisticated [73,74], multi-stage infiltration strategies that are difficult to replicate artificially [75]. As a result, models validated solely through simulations may overstate their effectiveness and underperform when deployed in operational environments such as autonomous vessels, shipping fleets, or smart port infrastructures [72,76,77].

3.3.3. Algorithmic Bias and Explainability Gaps

Algorithmic bias represents another critical concern, particularly in studies using deep learning (e.g., DNNs [78]) or reinforcement learning frameworks [79]. Approximately 15% of the reviewed studies employed black-box models with little or no explainability mechanisms. This lack of transparency poses serious challenges in high-stakes maritime operations, where stakeholders—including ship operators, naval officers, and cybersecurity analysts—require understandable justifications for AI-generated alerts. In the absence of interpretability, these models risk mistrust, misdiagnosis of threats, and regulatory non-compliance [80], especially where legal auditability is required [81,82].

3.3.4. Deployment Bias and Limited Real-World Testing

A further limitation stems from the failure to test models in real-world maritime scenarios. Roughly 12% of the reviewed studies proposed AI frameworks that remained at the theoretical or proof-of-concept stage, without operational integration [83,84]. These models were neither piloted on operational vessels nor tested within existing maritime security infrastructure. This lack of live deployment impairs confidence in the models’ real-time adaptability, scalability, and usability under genuine cyber threat conditions—particularly in environments with limited connectivity or specialized onboard systems.

3.3.5. Adversarial Vulnerabilities

Adversarial bias is emerging as a serious risk in AI-based cybersecurity systems. Around 10% of the analyzed studies failed to account for adversarial attacks, in which malicious actors manipulate input data to deceive AI detection mechanisms [85,86]. Models that are not trained with adversarial robustness in mind can be easily misled, potentially classifying dangerous activity as benign or failing to flag sophisticated intrusion attempts. This vulnerability is especially critical in the maritime sector, where the consequences of an undetected cyberattack could be severe, including cargo loss, navigation failure, or port disruption.

3.3.6. Regulatory Blind Spots and Systemic Bias

Approximately 8% of studies did not address legal, ethical, or regulatory constraints related to AI deployment in maritime cybersecurity. Regulatory gaps can create systemic bias, particularly when AI systems require access to sensitive operational data without ensuring compliance with international frameworks such as the International Maritime Organization (IMO) cybersecurity guidelines or the European Union Maritime Security Directives [87]. Failure to account for these constraints may result in models that are technically sound but not legally deployable—thus limiting their practical use in commercial or naval maritime environments [88,89,90].

3.3.7. Implications and Recommendations for Reducing Bias

The presence of the aforementioned biases raises several critical challenges that must be addressed for AI-based cybersecurity solutions to become viable in maritime applications [91,92]. To improve the reliability and trustworthiness of AI systems in this domain, future research should adopt the following directions (Figure 6):

(1)

Development of real-world maritime cybersecurity datasets: The lack of maritime-specific data requires collaborative efforts between academia, industry, and regulatory bodies to build and share high-quality, labeled datasets. This will enable AI models to be trained on realistic maritime cyberattack patterns, rather than synthetic or general-purpose data [93].

(2)

Real-world testing and deployment pilots: To overcome the limitations of simulation-based validation, studies must move beyond controlled environments. Pilot implementations of AI frameworks on actual vessels, fleets, and port infrastructures are essential for understanding operational constraints and ensuring model robustness under real-world conditions [94].

(3)

Incorporation of explainable AI (XAI): Interpretability is a key requirement in high-risk, regulated environments such as maritime operations. Future systems should adopt XAI techniques that make decision-making processes transparent and comprehensible to human operators [95]. This fosters trust and enables security teams to act on AI-generated insights with confidence [96].

(4)

Adversarial robustness: As adversarial manipulation of input data is a growing threat, AI models must be hardened using adversarial training, defensive distillation, and anomaly-aware learning architectures [97]. Such measures ensure that models are resilient to deceptive inputs and can maintain detection accuracy in adversarial scenarios [98].

(5)

Integration of regulatory compliance: AI frameworks must be aligned with international cybersecurity standards and legal requirements, including data protection regulations, IMO cybersecurity guidelines, and operational safety protocols [99,100]. Compliance ensures that security models are not only technically feasible but also legally deployable across national and organizational borders [101,102].

3.4. Summary of Findings

This systematic review highlights the increasing role of AI in strengthening maritime cybersecurity. The analysis shows that AI-driven solutions significantly enhance intrusion detection, anomaly detection [2,102,103,104,105], cyber risk assessment, and the mitigation of cyberattacks in maritime systems. However, critical limitations remain in terms of the following:

• Dataset availability and specificity;
• Validation methods;
• Algorithm transparency;
• Resistance to adversarial threats;
• Alignment with legal and regulatory frameworks.

To address these challenges, future research should focus on the following:

• The development of large-scale, maritime-specific cybersecurity datasets;
• Improved interpretability and transparency of AI models;
• Real-world testing in operational settings;
• Integration of advanced technologies such as blockchain, federated learning, and quantum cryptography.

The findings confirm that AI-driven cybersecurity is a foundational component in securing the future of autonomous ships [106], smart ports, and global maritime trade networks [107].

4. Discussion

4.1. Summary of Main Findings

This systematic review underscores the growing importance of AI in enhancing maritime cybersecurity. The analysis of 278 studies reveals the integration of AI across various layers of maritime cybersecurity, including intrusion detection systems (IDSs) [108], anomaly detection frameworks [109,110], cyber risk assessment models, AI-driven encryption methods, and blockchain-supported authentication protocols [111]. These technologies demonstrate considerable precision in identifying threats, recognizing malicious patterns, predicting system vulnerabilities, and automating threat responses [91,112] (Figure 7).

Among the most frequent applications is machine-learning-based anomaly detection [113,114,115], which is employed in safeguarding ship trajectory monitoring systems [116,117,118], vessel communication networks, and AIS security [119,120]. Although AIS is vital for vessel tracking and navigational safety [121], it remains vulnerable to spoofing and manipulation [122]. Deep-learning-based models have shown promise in detecting navigation anomalies, unauthorized access, and irregular data transmissions [123,124,125,126], improving the real-time detection of maritime threats and reducing risks associated with AIS exploitation [127,128,129,130].

AI models have also been applied in securing satellite communications [131,132], shipboard networks, and software-defined communication systems [133,134]. The increased use of IoT sensors [135,136,137] and cloud-based tools [138] has improved maritime operational efficiency but introduced new attack vectors [139]. Reinforcement learning allows adaptive responses to evolving threats by refining security policies based on past attack data [140].

Blockchain integration supports secure identity management and data integrity [141,142,143], addressing vulnerabilities in data exchange across maritime stakeholders [144,145,146]. AI-enhanced decentralized systems help prevent unauthorized access, identity fraud, and data manipulation [147,148].

Federated learning has emerged as a strategy to maintain data privacy in distributed maritime networks [149,150,151,152,153]. It enables collaborative model training without sharing sensitive data, addressing jurisdictional and regulatory challenges [92,150].

Despite these advancements, limitations persist. Many models are trained on generic datasets lacking maritime-specific features [154,155,156]. Others remain susceptible to adversarial attacks [157,158,159,160,161,162,163] or lack real-world validation [164,165,166,167,168]. Regulatory challenges—including explainability requirements and liability ambiguities—further hinder adoption [82,163].

Future research must prioritize high-quality maritime datasets [169], explore quantum-resistant AI security [170], and develop standardized global governance frameworks [171,172,173,174,175,176,177,178].

4.2. Limitations of AI Approaches in Maritime Cybersecurity

Despite notable advancements, the deployment of AI-driven cybersecurity in maritime environments remains constrained by several technical, operational, and regulatory factors. These limitations must be addressed to enable large-scale, reliable, and secure integration of AI into maritime cybersecurity systems (Figure 8).

• Data Limitations and Training Bias

A fundamental limitation is the scarcity of high-quality, labeled datasets specifically tailored to maritime cyber threats. Most AI models are trained on generalized IT datasets [179,180,181,182], which fail to reflect the unique operational conditions of maritime networks—such as limited bandwidth, high latency, and isolated environments [183,184,185]. Additionally, real maritime cybersecurity incidents—like AIS spoofing [186], GPS jamming, or radar interference [187]—are rarely publicly reported due to privacy, security, or commercial concerns [188]. This leads to fragmented or simulated training data, causing biased predictions and weak model generalization [189,190,191].

• Adversarial Attacks and Model Vulnerabilities

AI models are vulnerable to adversarial attacks, where small, deliberately crafted perturbations in input data mislead the system [192,193]. Subtle changes in sensor readings, network traffic, or communication patterns can cause critical misclassifications—allowing hostile actors to evade detection [194,195,196,197,198,199,200,201]. In the maritime context, this could result in misidentifying a threat as benign or overlooking unauthorized access to vessel systems [202,203,204,205,206]. Furthermore, adversaries are increasingly leveraging AI themselves, escalating the sophistication of attack vectors [207,208,209,210]. Yet, adversarial training remains underexplored in most reviewed studies.

• Lack of Explainability and Interpretability

Many AI-driven security systems, especially those based on deep neural networks (DNNs) and reinforcement learning, operate as black boxes with limited transparency [211,212,213]. While these models may achieve high accuracy, they often fail to provide human-interpretable explanations for their decisions [214]. In high-stakes maritime scenarios, this poses serious risks—cybersecurity professionals and operators must understand why an alert was generated to assess its relevance and take appropriate action [215,216,217]. A lack of interpretability also complicates auditing and regulatory approval processes, particularly under international cybersecurity laws that require accountability and transparency [218,219,220,221,222,223,224,225,226].

• Regulatory and Legal Constraints

Strict maritime cybersecurity regulations enforced by international organizations such as the IMO and EMSA impose further limitations [227,228,229]. Many AI systems lack compliance mechanisms or clearly defined accountability structures. In particular, questions remain around liability—who is responsible if an AI model fails to detect a threat or issues a false alert that disrupts operations? [230,231,232,233,234]. Cross-border data governance and jurisdictional inconsistencies further complicate AI adoption in global maritime networks [235,236,237,238,239]. Moreover, ethical concerns—such as the potential misuse of AI for surveillance or profiling—necessitate stronger oversight and AI governance policies [240,241,242,243,244,245].

4.3. Future Research Directions

To fully realize the potential of AI in maritime cybersecurity, future research must address the current limitations and explore innovative pathways that enhance model robustness, transparency, and regulatory readiness [246,247,248,249,250,251,252,253,254,255,256].

• Quantum-Resilient AI Security

With the advent of quantum computing, traditional cryptographic methods face obsolescence. AI-based security frameworks should begin integrating quantum-resistant encryption algorithms, such as post-quantum cryptography (PQC) and quantum key distribution (QKD) [257,258,259,260]. These methods can fortify maritime communication systems and ensure long-term data integrity in autonomous ships and smart port infrastructures.

2.

Federated Learning for Privacy-Preserving Collaboration

The maritime sector spans multiple legal jurisdictions and involves stakeholders with diverse data privacy requirements. Federated learning offers a promising approach by allowing decentralized AI model training across fleets and port systems without transferring sensitive data [261,262,263]. This method reduces legal friction and enhances privacy compliance while enabling collaborative cyber threat detection. Future work should focus on optimizing federated learning for low-bandwidth, high-latency maritime environments and exploring its integration with blockchain for secure update propagation [264,265,266].

3.

Enhancing Explainable AI (XAI)

Improving explainability remains essential for trust and accountability in AI-driven security systems. Techniques such as SHAP (Shapley Additive Explanations), LIME (Local Interpretable Model-Agnostic Explanations), and graph-based interpretability can help maritime cybersecurity teams better understand model behavior and validate threat predictions [267,268,269,270]. Visual interpretability tools can also assist in illustrating attack paths and anomaly propagation in vessel networks [271,272].

4.

Development of AI-Specific Maritime Cybersecurity Standards

Current regulations primarily focus on conventional cybersecurity tools. There is a pressing need to develop AI-specific guidelines that address the following:

(a)

Accountability for AI-generated decisions;

(b)

Standardized metrics for evaluating AI performance in maritime contexts;

(c)

Frameworks for cross-border cyber risk governance;

(d)

Ethical safeguards against misuse of AI surveillance technologies [273,274,275].

Such standards will facilitate the certification and safe deployment of AI systems across international maritime infrastructures.

4.4. Policy and Regulatory Implications

The integration of AI into maritime cybersecurity systems brings forth not only technical opportunities but also substantial regulatory, legal, and ethical challenges. As AI-driven models take on increasingly autonomous roles in monitoring and defending maritime assets, existing governance frameworks must evolve to address issues of accountability, transparency, and international coordination.

• Legal Liability and Accountability

One of the most pressing concerns in AI deployment is the ambiguity surrounding responsibility when systems fail. Unlike traditional cybersecurity tools, AI models can autonomously generate decisions based on probabilistic reasoning and non-deterministic learning patterns [276,277,278,279,280]. If an AI-based system fails to detect a threat or issues a false alarm that disrupts operations, current legal frameworks provide little clarity on who is liable—shipowners, AI developers, cybersecurity vendors, or system integrators.

To address this, future policies must

• Define clear accountability structures for AI-related incidents;
• Establish audit mechanisms for reviewing AI-generated cybersecurity decisions;
• Promote human–AI collaboration guidelines, ensuring that AI serves as a decision-support system, not a fully autonomous actor.

• Need for International Coordination

Maritime cybersecurity is inherently global, with fleets, ports, and shipping operations operating across multiple legal jurisdictions. However, current cybersecurity regulations are fragmented, and few are tailored to AI technologies [281,282]. This inconsistency hampers the deployment of standardized AI security tools across borders and creates legal uncertainty.

Key policy priorities include the following:

• Creating internationally recognized compliance frameworks for AI in maritime cybersecurity;
• Developing shared threat intelligence platforms to enable real-time cooperation between national agencies, port authorities, and private operators;
• Launching certification programs for professionals working with AI-driven security systems to ensure competence in explainability, risk assessment, and adversarial defense.

• Ethical Oversight and AI Governance

The use of AI in maritime cybersecurity may unintentionally extend into surveillance and behavior profiling. As some systems incorporate facial recognition, trajectory prediction, or behavioral analytics, there is a growing concern about potential overreach, data misuse, and violations of privacy rights [240,241,242,243,244,245].

Ethical governance must therefore

1.

Define boundaries between cybersecurity and surveillance use cases;

2.

Enforce privacy-preserving AI design principles, especially for civilian vessels and commercial operations;

3.

Require transparency disclosures for AI systems involved in monitoring human or cargo movement.

4.5. Addressing the Research Questions

This systematic review was guided by four core research questions formulated in the introduction. Below, we provide concise answers to each, based on the analysis presented in Section 4.1, Section 4.2, Section 4.3 and Section 4.4

RQ1: What AI techniques are currently applied in maritime cybersecurity?

The literature demonstrates the application of a wide range of AI techniques, including the following:

(1)

Machine learning models (e.g., decision trees, SVMs, ensemble methods) for intrusion detection and anomaly detection [108,109,110,111,112,113,114,115];

(2)

Deep learning (e.g., DNNs, CNNs, RNNs) for behavioral pattern recognition and AIS spoofing detection [123,124,125,126];

(3)

Reinforcement learning for adaptive cybersecurity strategies [140];

(4)

Federated learning for decentralized, privacy-preserving collaboration across fleets and ports [149,150,151,152,153];

(5)

Blockchain-enhanced AI for tamper-proof identity verification and data integrity [141,142,143,144,145,146,147,148];

(6)

Early-stage applications of quantum-resilient AI and explainable AI (XAI) to address encryption and trust issues [257,258,259,260,267,268,269,270,271,272].

RQ2: How effective are these AI approaches in detecting and mitigating cyber threats?

AI-driven systems show promising performance in detecting a wide range of threats, including abnormal vessel behavior, spoofed AIS transmissions, unauthorized access attempts, and sensor data manipulation [116,117,118,119,120,121,122,123,124,125,126,127,128,129,130]. These models offer the following:

(1)

Improved detection accuracy, particularly in supervised learning contexts;

(2)

Faster response times, reducing the window of exposure;

(3)

Automation of threat mitigation strategies in dynamic environments.

However, their real-world effectiveness is limited by simulation-based testing, lack of maritime-specific datasets, and insufficient deployment validation [154,155,156,164,165,166,167,168].

RQ3: What are the major challenges in adopting AI in maritime cybersecurity?

The key challenges identified include the following:

(1)

Bias and data scarcity, especially due to limited access to operational maritime cybersecurity datasets [179,180,181,182,183,184,185,186,187,188,189,190,191];

(2)

Vulnerability to adversarial attacks, where minor input alterations can mislead AI systems [192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210];

(3)

Lack of explainability, hindering trust, operational use, and regulatory compliance [211,212,213,214,215,216,217,218,219,220,221,222];

(4)

Regulatory ambiguity, particularly around legal liability and cross-border data governance [227,228,229,230,231,232,233,234,235,236,237,238,239];

(5)

Ethical concerns related to surveillance and privacy risks in certain applications [240,241,242,243,244,245].

RQ4: What future directions should be pursued to enhance AI-based maritime cybersecurity?

Based on the reviewed studies, future research should focus on

(1)

Developing large-scale, maritime-specific datasets to train and validate AI models [246];

(2)

Enhancing adversarial robustness through dedicated training methods [247];

(3)

Advancing explainable AI frameworks, using tools such as SHAP, LIME, and graph-based visualization [248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270];

(4)

Establishing standardized AI governance and cybersecurity policies, including liability, compliance metrics, and ethical guidelines [273,274,275];

(5)

Integrating advanced technologies such as quantum cryptography and federated learning to enhance resilience and scalability [259,260,261,262,263,264,265,266].

5. Conclusions

This systematic review highlights the transformative role of AI in maritime cybersecurity [283], particularly in intrusion detection, anomaly detection, AI-enhanced blockchain security [284], and cyber risk assessment for autonomous vessels and port infrastructures. AI-driven cybersecurity solutions offer unprecedented capabilities in threat prediction, attack mitigation, and automated security monitoring, providing a proactive defense mechanism against increasingly sophisticated cyber threats targeting the maritime sector.

However, despite these advancements, several critical challenges persist. The lack of high-quality, maritime-specific cybersecurity datasets limits the accuracy and generalizability of AI models, while the vulnerability of AI-driven security frameworks to adversarial attacks raises concerns about AI reliability in high-stakes security operations. Furthermore, the black-box nature of deep learning models hinders explainability, creating trust issues among cybersecurity professionals [285], ship operators, and regulatory agencies. The absence of standardized AI cybersecurity policies and international regulatory alignment further complicates the large-scale deployment of AI-driven security solutions in global maritime operations [286,287].

Future research must focus on enhancing the resilience, interpretability, and adaptability of AI-driven cybersecurity frameworks [288,289]. The integration of quantum-resistant AI security models will be crucial in future-proofing maritime cybersecurity systems against emerging threats from quantum-computing-based attacks [290]. Federated learning architectures should be explored to enable collaborative AI training across multiple maritime networks while preserving data privacy and regulatory compliance. Additionally, the development of explainable AI (XAI) models will be essential to increase trust, transparency, and regulatory acceptance of AI-powered maritime cybersecurity systems.

From a policy perspective, urgent steps must be taken to establish globally standardized AI cybersecurity regulations, ensuring that AI-driven security solutions align with international legal, ethical, and operational frameworks [291]. Governments, maritime cybersecurity agencies, and AI researchers must collaborate to define liability structures, ethical AI principles, and AI governance policies for safe and responsible AI deployment in the maritime sector [292].

By addressing these technological, regulatory, and operational challenges, AI-driven cybersecurity solutions can be fully optimized, standardized, and deployed at scale, securing the future of global shipping, naval defense operations, and smart port infrastructures. The strategic approach of AI, blockchain, federated learning, and quantum cryptography will enable resilient, adaptive, and regulation-compliant cybersecurity frameworks, ensuring long-term maritime cybersecurity resilience in an increasingly digital and interconnected world.