What happened
Between 21 and 24 August 2026, the U.S. Coast Guard, working with the FBI, boarded two tankers in the Gulf of Mexico. Reporting on the incident described onboard systems that had stopped responding to remote commands, prompting the boardings as a precaution while investigators worked out what had caused it. One of the vessels involved was identified in reporting as the VL Prosperity.
A separate incident, weeks earlier, involved an LNG carrier, Vivit Africa, in the Mediterranean. The crew reported that the ship's course had been altered without their command, and attributed it to a cyberattack. Italian Coast Guard authorities gave a more cautious account, describing the event as consistent with a system malfunction rather than confirming a hostile intrusion. As of this writing, the cause of that incident remains disputed between the crew's account and the official one; we treat it as unresolved rather than settled.
What is not in dispute is the direction of travel. Maritime and offshore security firms have said they are now monitoring a growing number of vessels, with figures reported around 20, for the same pattern: operational technology systems on ships, increasingly networked for efficiency and remote diagnostics, and increasingly exposed as a result.
The fix on the table
The response getting attention is a hardware one: a physical air gap that keeps a vessel's operational technology, engines, navigation, ballast, cargo control, disconnected from any network by default. Products in this category, including Goldilock's air-gap switch as marketed by TANDMM, work by making the disconnected state the default and requiring a deliberate, physical action to reconnect. Nothing on the other side of that switch is reachable until someone closes it.
This is a genuinely strong control, and it deserves to be taken seriously on its own terms. Software-only defences, firewalls, network segmentation, intrusion detection, all depend on the software staying uncompromised to do their job. An air gap does not have that dependency. If the switch is open, the system is unreachable, full stop, regardless of what has happened to the software stack sitting on either side of it. For operational technology on a moving vessel, where a compromise can mean a diverted course or a disabled engine rather than a stolen database, that property matters more than it does almost anywhere else in security.
What the air gap doesn't answer
An air gap is a control on the default state of the connection. It says: nothing gets through unless someone deliberately reconnects it. What it does not say, and was never designed to say, is who gets to be the someone who reconnects it, or whether this particular reconnection, right now, was actually wanted.
A vessel's systems do not stay disconnected forever. Software needs updating. Diagnostics need running remotely, particularly for a ship at sea without a technician aboard. Data needs syncing with shore-based operations. Each of those is a legitimate reason to close the switch, and each of those moments is also, by construction, the moment the air gap's protection stops applying. The control that governs the disconnected state has nothing to say about the reconnected one.
This is not a flaw in the air-gap approach. It's a boundary. Every control has one. A vault door is either the strongest part of a bank's security or entirely irrelevant, depending on whether it happens to be open when you check. The question that matters for a vessel operator is not whether the switch exists, but what governs the decision to close it.
The vessel operator question
This is where the two approaches are complementary rather than competing. An air gap governs whether a connection exists at all. GoFirm governs whether a specific action, once a connection exists, was actually authorised by someone with the standing to authorise it, out of band, biometrically confirmed, independent of whatever has already been compromised on the network side.
Put the two together and the model looks like this: the vessel's operational systems stay disconnected by default, exactly as the air-gap approach intends. When a legitimate need arises, a software update, a diagnostic session, a data sync, reconnection itself becomes a high-consequence action requiring confirmation from a named authority before the switch closes. If nobody with that standing confirms it, the switch does not close, whatever instruction, credential, or urgent-sounding request is presented to it. If it's a legitimate reconnection, the correct authority confirms it and the work proceeds. What the model removes is the scenario where a spoofed instruction or a compromised shoreside account gets treated as sufficient reason to reopen a vessel's critical systems on its own.
For an operator weighing this, the practical question is not air gap or authority confirmation. It's what happens the next time someone, or something, asks to close the switch.
GoFirm is The Authority Platform. Stop unauthorised action. Every time.
In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.
References
- U.S. Coast Guard and FBI boarding of tankers in the Gulf of Mexico, including the VL Prosperity, 21–24 August 2026 (widely reported in maritime and general news coverage).
- Vivit Africa LNG carrier diversion incident in the Mediterranean and disputed cyberattack/malfunction accounts (crew statements vs. Italian Coast Guard reporting).
- TANDMM / Goldilock air-gap maritime security coverage and LinkedIn positioning on vessel monitoring.