Why high-speed connectivity introduces new attack surfaces

Starlink Maritime has solved the bandwidth problem at sea. A superyacht running Starlink can achieve 100 to 250 Mbps in open ocean — fast enough for video calls, 4K streaming and corporate application access without the limitations of conventional VSAT systems.

But speed and exposure come together. A high-capacity connection that isn’t properly segmented and secured is, from a security standpoint, a large and open entry point. On a superyacht, what travels across that network is far from trivial: financial documents, owner communications, VIP guest data, navigation logs and vessel control systems.

This article covers the practical measures that a captain or technical manager should understand and demand during installation.

The most common mistake: the flat network

A flat network is one where all devices share the same network segment with no logical separation. In practical terms, it means the smart refrigerator, the owner’s laptop and a newly hired deckhand’s phone are all on the same network with unrestricted lateral access between them.

On a superyacht without proper segmentation, a compromised device — a crew entertainment tablet, an outdated Android TV, an IoT speaker — can become the starting point for accessing documents stored on the owner’s NAS or intercepting vessel management communications.

The solution isn’t technically complex, but it has to be done right from the start.

Network segmentation: the foundation of everything

The primary protection measure is dividing the superyacht’s network into isolated segments using VLANs (Virtual Local Area Networks). A recommended scheme for superyachts:

SegmentDevicesInternet accessCross-segment access
Owner NetworkOwner’s laptops and phones, private NASYes, via VPNBlocked
Crew NetworkCrew devices, work tabletsYes, limitedBlocked
Guest Wi-FiGuest devices, entertainmentYesBlocked
IoT / AVAutomation, TVs, speakersYes, restrictedBlocked
Systems NetworkNMEA, AIS, navigation and controlNoFully isolated

The isolation of the navigation systems segment is critical. NMEA and AIS systems should never have direct internet access or share a segment with general-purpose devices.

VPN for the owner: privacy over a shared connection

Even with correct segmentation, traffic leaving the superyacht through Starlink travels across SpaceX’s infrastructure before reaching its destination. For owners managing financial assets or conducting confidential communications, a corporate or privately managed VPN adds an encryption layer that renders the traffic unreadable to any intermediary.

Common options on high-level superyachts:

  • Enterprise-managed VPN (Cisco, Palo Alto, Zscaler): suitable when the owner has a family office or corporate IT infrastructure.
  • Dedicated onboard VPN (pfSense or OPNsense on marine-grade hardware): the vessel router manages the VPN tunnel transparently for the owner’s devices.
  • SaaS solutions (Mullvad, ProtonVPN Business): simpler to manage, appropriate for owners without corporate IT backing.

The key detail: VPN must be configured at the network level for the owner’s segment — not as an application the user must remember to activate on each individual device.

Guest network: connectivity without exposure

Guests on board expect connectivity — it’s a baseline expectation in both the charter and private superyacht market. The mistake is giving them access to the main network.

A correctly configured guest network:

  1. Is isolated from all other segments via firewall rules
  2. Has a bandwidth cap to prevent one guest’s mass streaming from degrading the vessel’s operational connectivity
  3. Has a password that rotates at each change of guest party
  4. Logs traffic volume as a minimum (without content inspection, for privacy)

Some installers configure captive portals for guest Wi-Fi, where guests accept basic usage conditions before connecting. This is good practice, particularly on commercial charter.

Managing IoT devices on board

The automation, entertainment and monitoring systems on a modern superyacht include dozens of IP-connected devices: TVs, audio systems, security cameras, temperature sensors, KNX gateways, Crestron controllers. Each of these is a potential entry point if left unpatched and unsegmented.

Basic IoT security hygiene:

  • Update firmware on all devices before commissioning and at each extended port stay.
  • Change factory default credentials — an alarming proportion of marine security incidents trace back to routers and cameras still running factory usernames and passwords.
  • Segment IoT devices in their own VLAN with internet access restricted only to the services each device actually needs (a security camera only needs to reach its cloud server, not the entire internet).
  • Disable unnecessary services on routers and switches: UPnP, Telnet, unencrypted HTTP management interfaces.

When Maritlink installs Starlink Maritime on a superyacht, network configuration goes beyond connecting the hardware. The process includes:

  1. Audit of the existing onboard network architecture
  2. VLAN design based on the systems present and the owner’s usage profile
  3. Perimeter firewall configuration with segment-specific rules
  4. Guest network setup with bandwidth controls
  5. Full network documentation delivered to the captain and owner

Security is not a feature switched on at the end — it is an architectural decision made at design stage. A superyacht sailing with a flat network in 2025 is a real risk, not a theoretical one.

Can someone intercept my traffic through Starlink?
Traffic between your Starlink terminal and the satellites is encrypted. Once it exits to the internet, the same risks apply as on any internet connection. A VPN for the owner's sensitive devices is the most effective measure to add end-to-end encryption as an additional layer of protection.
Is a strong Wi-Fi password enough?
No. A strong password prevents unauthorized external access, but it does not protect against internal threats — a compromised device already on the network, or a crew member sharing the same network segment as the owner. VLAN segmentation is required for real isolation between users and systems.
How much does security configuration add to installation cost?
Basic segmentation with firewall and VLANs is part of Maritlink's standard installation process for superyachts. The required hardware — a marine-grade industrial firewall router — represents an additional cost over consumer-grade alternatives, but it's an investment that pays for itself the first time it prevents an incident.
How often should I review my vessel's network security?
An annual review is the minimum, ideally aligned with the seasonal commissioning. That review should cover: firmware updates on all devices, rotation of guest network passwords, review of anomalous traffic logs, and verification that all firewall rules remain relevant to the current configuration.
What about guest data privacy on charter?
Charter guests have reasonable privacy expectations regarding their browsing activity. The recommended configuration logs only traffic metadata (volume, timestamps), never content. In European jurisdictions, GDPR may apply even to vessels under EU flags when users are EU citizens. Consult your legal advisor if you operate commercial charter in European waters.