Maritime Is in the Risk Zone. The Fix Is Not Exotic.

In October I am speaking in Varna, a port city on the Black Sea. While preparing, I read ENISA's NIS360 report, and one observation stayed with me: maritime sits in the risk zone.

What NIS360 Measures

NIS2 is the EU directive on the resilience of the sectors our society depends on most. NIS360, which ENISA published in June, scores each of those sectors on two things: how critical it is, and how mature it is. A sector that is highly critical but not mature enough lands in the risk zone.

Banking, electricity and telecoms sit at the top. Maritime does not. Neither do rail, drinking water and wastewater, which all entered the risk zone this year.

Not Budget. Not Technology.

Banks have been regulated, audited and made to talk about their incidents for decades. Ports have not.

It is tempting to explain the gap with money or with technology. Neither explains it on its own. The difference lies in the habit of being examined, and of talking openly about what went wrong.

The clearest evidence is gas. Gas moved out of the risk zone this year, and ENISA attributes that to better information sharing and better risk management. Nothing exotic.

Compete Commercially, Cooperate on Resilience

Dutch seaports did something similar with FERM, a shared cyber platform that now covers Rotterdam, Amsterdam, Moerdijk, North Sea Port and Groningen Seaports. The principle behind it is simple:

I am not aware of an equivalent on the Black Sea. That looks like a gap worth closing, and a small enough one to actually start.

What This Does to My Own Argument

I have spent years arguing that trust is a business advantage rather than a compliance cost. I still believe that. But this report points to something less comfortable: for most sectors, regulation is what got the conversation started at all.

One more finding is worth noting. Trust services entered the high maturity band for the first time. In other words, the identity layer is now ahead of a good deal of the infrastructure it is meant to protect.