Maritime Cybersecurity Workforce Development

The Stakes

Critical infrastructure under sustained attack, a workforce trained for a different job, and a federal mandate already on record.

~40 million attacks per month

A single major US port — Los Angeles — reports roughly 40 million cyberattacks per month against its environment (Fenwick, 2022). The maritime sector is a permanent target, not an occasional one.

72% prepared. 75% breached.

72% of port leaders say their organizations are very prepared to handle the cyber threat; 75% of those same respondents also report a breach in the previous 12 months (Kearns et al., 2022). Confidence and capability are not the same thing.

A workforce mandate already on the books

The White House's 2020 National Maritime Cybersecurity Plan explicitly calls for a public-private partnership to build a cybersecurity workforce for ports and vessels. The mandate is national. The execution is local.

Built for Two Audiences

One method — role-mapped, research-grounded, NICE-aligned — applied to either side of the workforce problem.

Primary audience

For Maritime Operators

Port authorities, shipping lines, terminal operators, offshore operators, and Navy/USCG contractors who need their cyber team trained on the roles they actually fill — not generic enterprise IT security.

• Role inventory mapped to the NICE Workforce Framework
• Gap analysis using CHRIS — semantic mapping of current training against required competencies
• Custom curriculum delivered in-team (in-person at your facility or virtual)
• Outcome measured against NICE Knowledge, Skill, and Task statements

Academic partners

For Universities & CAEs

Curriculum directors and academic leadership at universities, NSA-designated Centers of Academic Excellence, and degree programs preparing graduates for maritime cybersecurity roles.

• CHRIS-driven mapping of your current curriculum to maritime cyber NICE roles
• Identified gaps between your program and entry-level workforce requirements
• Recommended Open Education Resources (OERs) to close the gaps
• Custom modules built where OER coverage is insufficient

Custom Maritime Cybersecurity Training

Four deliverables in one engagement. Scoped to your roles, mapped to NICE, and grounded in the maritime cyber AI study research.

Role-Mapped Gap Analysis

CHRIS runs semantic analysis on your existing training materials, course content, or curriculum and maps them against the NICE Workforce Framework roles your team actually fills. The output: a scored gap report by role — what is covered, what is missing, and the priority of each gap.

Custom Curriculum Design

A training program built to your identified gaps — aligned to NICE Knowledge, Skill, and Task statements for the maritime cyber roles in scope (Maritime Cyber Security SME, CIO, Auditor, Project Manager, Network Engineer, and adjacent roles as needed).

Training Delivery

Instructor-led delivery — on-site at your facility, virtual, or hybrid — with hands-on labs, scenario-based exercises drawn from the maritime sector, and assessments tied to NICE competencies. Built for working professionals, not classroom audiences.

Outcome Measurement

Pre- and post-program assessment against the same NICE competency map. Documented progression by role, evidence of gap closure, and a recommended next-iteration program based on remaining deltas. Defensible to a workforce-development sponsor or a Center of Academic Excellence reviewer.

How It Works

Discovery, analysis, design, delivery, measurement — with human oversight at every step. A study finding, not a marketing line.

1. Discovery + Role Inventory

We work with your team to identify the maritime cyber roles in scope, the existing training and curriculum you already use, and the NICE Knowledge/Skill/Task statements that define competency for each role. Outputs feed CHRIS.

2. CHRIS-Driven Gap Analysis

CHRIS — the Cybersecurity Human Resource Intelligence System developed in the dissertation research — performs AI-based semantic analysis and natural language processing on your existing materials, mapping content to NICE Framework roles and surfacing measurable gaps. Subject-matter experts validate every mapping.

3. Custom Curriculum + Delivery

A scoped curriculum is designed to close the identified gaps — recommending Open Education Resources where coverage exists, and building custom modules where it does not. Delivery is instructor-led, in-team, and grounded in maritime scenarios.

4. Measurement + Iteration

Pre- and post-program assessment against the same NICE map produces evidence of gap closure and feeds the next iteration. The study identified a three-stage implementation model — immediate capacity, organizational integration, and sector-wide impact — and measurement is what moves an organization between stages.

Anchored in research: "Artificial-intelligence based semantic analysis can help address the maritime cybersecurity skills gap when properly implemented; however, success requires coordinated infrastructure and support at the organizational, individual, and interorganizational levels" (Simpson, 2026).

Research-Backed

The Maritime Cyber AI Study

This practice is built on Analyzing the Cybersecurity Skills Gap of Entry Level Employees in the Maritime Industry — a doctoral dissertation completed at National University, San Diego in February 2026. The research developed and evaluated CHRIS (Cybersecurity Human Resource Intelligence System) with eight participants drawn from academia and US port-facility maritime cybersecurity teams.

Findings include a three-stage implementation model linking immediate capacity benefits to transformative sector-wide impact, and a critical practitioner conclusion: AI-driven curriculum analysis works when paired with human oversight and quality source materials. Adoption operates as an integrated ecosystem across the organizational, individual, and interorganizational levels — not as an individual-centric technology decision.

CHRIS is live. Explore the analysis reports for the five maritime cyber roles studied — Maritime Cyber Security SME, CIO, Auditor, Project Manager, and Network Engineer — at the study site.

Explore the Study at maritimecyberai.study →

Scholar-Practitioner. Maritime-Grounded.

Led by Chris Simpson — PhD Cybersecurity (National University, February 2026, dissertation on this exact problem), Navy Lieutenant Commander, TOPGUN Instructor, CISSP, GPEN. Affiliated with an NSA-designated Center of Academic Excellence and the San Diego Cyber Clinic. 20+ years of defense and security operations, applied through a research-first methodology.

Maritime cybersecurity workforce development is not a side practice — it is the research focus and the operating background. Your training program is built on the NICE Workforce Framework, validated by the CHRIS system, and informed by published doctoral research on what actually moves a maritime organization from skills gap to operational capability.

Questions Worth Asking

Direct answers to what maritime operators and program directors ask before they sign.

"We already use a generic cybersecurity training vendor. Why a maritime-specific program?"

Generic vendors teach enterprise IT security against a generic role inventory. Your team is not generic — they protect terminal operating systems, AIS, port community systems, vessel networks, and the operational technology that moves cargo. The NICE Framework already defines these roles. CHRIS measures whether your current training actually covers them. In most cases, it does not.

"How does this work for a university or CAE — we are not an operator."

CHRIS was developed and evaluated with academic participants for exactly this case. We run your degree program or course catalog through CHRIS, map it against the NICE Workforce Framework for maritime cyber roles, and produce a gap report your curriculum committee can act on — including recommended OERs for coverage and where custom modules are needed. Defensible to your CAE designation review.

"What does an engagement look like in practice?"

Discovery and role inventory (week 1) → CHRIS-driven gap analysis with SME validation (weeks 2–3) → custom curriculum design (weeks 3–4) → instructor-led delivery (scheduled to your calendar) → post-program measurement against the same NICE map. Scope is set jointly; fee is fixed per program; outcome is documented.

"Can you work with the training materials we already have?"

Yes — that is the design. CHRIS analyzes what you already use, validates the mappings with human SME review, and identifies the delta. We add what is missing rather than replacing what is working. The study found that adoption succeeds when AI is paired with human oversight and quality source materials; we treat your existing program as the starting point, not as a problem to be replaced.

The skills gap will not close itself.

Book a Discovery Call.

Tell us about your maritime cyber workforce — operator or academic. We map your roles to the NICE Framework, run CHRIS against your current training or curriculum, and propose a custom program scoped to the gaps we find.

Book a Discovery Call

Close the maritime cyber skills gap — before the next port breach.