Höegh Autoliners is deploying a combined cybersecurity service from Marlink and NORMA Cyber across its entire car carrier fleet, linking an independent Security Operations Centre with hands-on incident response on board.

The rollout, which places the Norwegian deep-sea ro-ro operator among the first shipowners to adopt the joint service fleet-wide, ties NORMA Cyber's shore-based monitoring to Marlink's onboard security capabilities. When NORMA Cyber's analysts assess a detected threat and decide it requires action, the incident passes directly to Marlink for investigation and response.

The architecture works like this. Security data from the vessels' Unified Threat Management (UTM) and Endpoint Detection and Response (EDR) systems streams in real time to NORMA Cyber's Security Operations Centre. Specialists there analyse the information and determine whether further action is needed. If intervention is required, Marlink takes over the investigation, containment and remediation.

The handover is designed to be seamless. Because Marlink already knows the vessel's connectivity, network and security environment, its teams can respond within the operational context of the ship rather than starting from a blank page mid-incident.

For Höegh Autoliners, the commercial logic is straightforward: cargo-carrying schedules on deep-sea trade lanes cannot absorb downtime from a cyber event. The stated objective is to strengthen protection without disrupting day-to-day vessel operations.

"Maintaining uninterrupted operations is critical for us. This combined approach strengthens our ability to manage cyber risk effectively across the fleet," said Christian Hall, Head of Global Cargo Operations and Digital Projects at Höegh Autoliners.

The model also answers a governance question that has troubled shipowners building out cyber defences: who watches the watcher? The cooperation gives owners the option to keep monitoring and response structurally separate. NORMA Cyber acts as the independent monitoring partner, while Marlink remains responsible for securing the onboard environment and executing response when an incident demands it. That separation mirrors the pattern shipping companies have imported from shore-side industrial security, where an independent SOC provides an unconflicted view of the defences it oversees.

"Our work with NORMA enables faster, more effective response to cyber threats, helping customers reduce operational disruption and maintain continuity across their fleets," said Tore Morten Olsen, President of Marlink Maritime.

Lars Benjamin Vold of NORMA Cyber said the organisation will remain technology-agnostic and work with shipowners and their selected providers to strengthen maritime cyber resilience. That positioning matters for the wider market: it signals NORMA Cyber intends to sell monitoring as a standalone layer, not as a bundle tied to one connectivity or security vendor.

For shippers and vehicle manufacturers moving units with Höegh Autoliners, the deployment adds a layer of continuity assurance around cargo operations that are increasingly digitised, from loading plans to port calls. For carriers and operators watching from the sidelines, the deal sets a template for fleet-wide cyber defence that splits detection from response — a structure likely to spread as underwriters and regulators press the sector on cyber risk. With IMO and class societies tightening expectations on operational technology security, fleet-wide, independently monitored defence is moving from differentiator toward baseline requirement.