ClassNK endorses CYTUR-SBOM shipboard cybersecurity platform

ClassNK has granted its Innovation Endorsement for Products & Solutions to CYTUR-SBOM, a web-based cybersecurity management platform for shipboard computer-based systems — while explicitly stating the endorsement does not certify compliance with the industry's core cyber resilience requirements.

That caveat matters. The classification society confirmed the endorsement excludes Chapters 4 and 5 of Part X of its Rules for the Survey and Construction of Steel Ships, and does not certify compliance with IACS Unified Requirements UR E26 Rev.1 and UR E27 Rev.1 — the unified requirements that now govern cyber resilience for newbuild tonnage. In plain terms, shipowners who install the platform cannot treat it as evidence their vessels meet applicable cyber resilience rules. ClassNK itself said the endorsement should not be read as confirmation that the platform satisfies all such requirements.

What does the platform actually do?

CYTUR-SBOM gives shipping companies a central register of onboard computer-based systems. It records hardware, software, firmware and system configuration data, and maps the vessel's network topology so operators can see what is connected where.

The platform works through several concrete functions:

• It assesses individual assets against security capability checklists and stores results with supporting evidence.
• It uses standardised product identifiers to cross-check registered equipment against the US National Institute of Standards and Technology's National Vulnerability Database, flagging publicly known vulnerabilities tied to onboard hardware and software.
• It retains security assessment results, vulnerability identification records and document generation histories — an audit trail for cyber documentation.
• Access runs through defined user roles with separate read and write permissions.

The platform also pairs with CYTUR's SC-P portable network scanner, which identifies computer-based systems by scanning the vessel's onboard network directly — useful for operators whose asset inventories are incomplete or out of date.

For ship managers, the commercial value sits in consolidation: one dashboard for asset inventories, network visibility and known-vulnerability identification, rather than spreadsheets and per-vessel surveys. Whether that translates into fewer audit findings or faster port state inspections is a question the endorsement cannot answer.

What the endorsement does not say

ClassNK's Innovation Endorsement programme evaluates technologies with innovative functions through independent technical assessment — a support mechanism for maritime technology developers, not a regulatory pass.

The announcement carried no commercial detail. There is no information on the number of vessels using the platform, deployment milestones or contract value. CYTUR's market traction, fleet references and pricing remain undisclosed, so the endorsement signals technical review rather than proven adoption at scale.

The announcement also leaves open how the platform performs on operational vessels with legacy systems — the equipment most exposed to known vulnerabilities — since the endorsement covers functionality rather than real-world outcomes.

The recognition does confirm one thing precisely: ClassNK rates the platform's approach to asset inventories, network visibility and known vulnerability identification as credible under its innovation assessment. Whether CYTUR-SBOM gains fleet-wide adoption will depend less on the endorsement itself than on shipowners' own deadlines under tightening cyber resilience rules.