Maritime · Technical
Bridge, engine room and shore, rebuilt where you can break them.
Coldlight builds the twin from your architecture and asset inventory. It runs contained: nothing inside reaches the vessel or the internet unless you decide it should. Rebuild it exactly, as often as you need.
UR E26 already asks for inventories of hardware and software, and for the arrangement of networks that connect the ship’s computer-based systems. Those documents are where a twin starts.
From there, each system is represented at the fidelity the test needs. Where a test depends on real behaviour, the twin runs the vendor’s own software or appliance.
What you can test
- 01Test a patch or update against the vessel’s real configuration before it goes aboard.
- 02Check segmentation and remote-access paths after every change.
- 03Run attack scenarios against the twin, scripted or live.
- 04Rehearse the incident response and recovery plans, step by step.
- 05Evaluate new equipment and software against the systems it must work with.
- 06Evaluate AI tools and agents under containment, and see exactly what they did.
What the twin can represent
01
Bridge
Navigation and communication systems, and the networks between them.
- ECDIS
- Radar
- Communications
02
Machinery
Propulsion control, power management, and alarm and monitoring systems.
- Propulsion control
- Power management
- Alarm and monitoring
03
Cargo and ballast
Cargo handling and ballast control systems.
- Cargo handling
- Ballast control
04
Passenger and crew
Ticketing, payments, Wi-Fi and entertainment networks.
- Ticketing
- Payments
- Wi-Fi
05
Ship–shore links
Satellite and cellular connections, and remote access for vendors.
- Satellite
- Cellular
- Vendor access
06
Shore
Fleet operations, booking, maintenance and corporate IT.
- Fleet operations
- Booking
- Corporate IT
Fidelity
Level 1
Containers
Cost-efficient representations of hosts, services and networks.
Level 2
Virtual machines
The real operating systems and software that your systems run.
Level 3
Appliances
Real or virtual appliances, where the test depends on them.
Synthetic users, scripted or live adversary activity, and defensive tools or agents can run in the same environment.
Third-party software can run under licences you already hold, or we can arrange it as a cost of the engagement.
The rules
IACS UR E26, E27
UR E26 and E27 apply to ships contracted for construction on or after 1 July 2024.
IACS UR E26
E26 asks for an incident response plan, a recovery plan, backup and restore capability, and controlled shutdown, reset, roll-back and restart. It also asks for test plans through design and construction, commissioning and operational life.
IMO MSC-FAL.1/Circ.3/Rev.3
The IMO Guidelines on maritime cyber risk management were revised in April 2025.
NIS2
In the EU, NIS2 covers sea and coastal passenger and freight water transport companies, and port managing bodies.
Bill C-8
In Canada, Bill C-8 received Royal Assent in June 2026. Its Critical Cyber Systems Protection Act sets a framework for designated operators in the transportation, energy, finance and telecommunications sectors. It comes into force in phases.
Every environment
Contained by default
What runs inside an environment stays inside it unless you decide otherwise.
Rebuilt exactly
Environments are defined as code. Reset one, change one thing and run the test again.
A record of every run
Every run leaves a record you can review. Compare results across runs and configurations.
The fidelity each test needs
Use lightweight representations where they are enough, and real software and appliances where the test needs them.
Technology-neutral
Open-source, commercial, proprietary and customer-built technology can all be included.
Open formats
Environment definitions use an open, portable specification, so your work is not locked to us.
Where it runs
Hosted
Coldlight as a service. Hosted environments can run in Canada and other jurisdictions.
On-premises
Coldlight inside your own boundary, on infrastructure you control.
Air-gapped
Coldlight on networks with no outside connection.
We can also operate Coldlight for you, and help design environments, deliver exercises and support evaluations.
