Höegh Autoliners has become one of the first operators to deploy a combined cybersecurity service from Marlink and the Nordic Maritime Cyber Resilience Centre (NORMA Cyber) across its entire car-carrier fleet, the partners announced.

The service links NORMA Cyber's independent security monitoring and initial analysis with Marlink's maritime cyber expertise and incident-response capabilities, giving shipowners a continuous path from onboard alert to shore-based containment.

How does the technical pipeline work?

At the core of the offering, Marlink's log-forwarding capability streams real-time security data from onboard Unified Threat Management (UTM) and Endpoint Detection and Response (EDR) systems to the NORMA Cyber Security Operations Centre. NORMA Cyber analysts triage each potential threat; when an incident requires action in the customer's onboard environment, the alert escalates to Marlink's cyber specialists for investigation, containment and remediation.

Because Marlink already manages each customer's connectivity, network and security environment, its experts can respond with the operational context needed to limit disruption.

What does the model change for shipowners?

The arrangement gives operators three structural options, the partners said:

• Retain an independent monitoring partner and rely on Marlink only for incident response.
• Bundle monitoring and response through Marlink's own managed security stack.
• Adopt the new joint model, which combines NORMA Cyber's member-derived threat intelligence with Marlink's onboard remediation bench.

Höegh has chosen the third path. The car carrier is rolling out the service across its fleet, including its Aurora Class newbuild programme, with onboard connectivity delivered through the Marlink Possibility Platform.

What are operators and partners saying?

Christian Hall, Head of Global Cargo Operations and Digital Projects at Höegh Autoliners, framed the deployment in operational terms: "Maintaining uninterrupted operations is critical for us. This combined approach strengthens our ability to manage cyber risk effectively across the fleet."

Tore Morten Olsen, President of Marlink Maritime, positioned the joint offering as a more flexible alternative to single-vendor managed security contracts: "Our work with NORMA enables faster, more effective response to cyber threats, helping customers reduce operational disruption and maintain continuity across their fleets. It also gives operators the flexibility to choose how they manage cyber security, while continuing to rely on Marlink to resolve incidents quickly and effectively."

Lars Benjamin Vold of NORMA Cyber underscored the centre's neutral position: "Working with Marlink allows us to deliver greater value to shipowners by combining advanced monitoring with proven response capabilities. NORMA Cyber remains a neutral and technology agnostic provider that aims to support all members and their operations in close cooperation with each member and their chosen providers."

What is the commercial logic?

Detection alone has limited value on a moving asset. A flagged anomaly on a vessel only matters if the operator can assess its operational impact and act before cargo handling, navigation or propulsion are affected. By moving the customer from alert to containment inside a single commercial and technical chain, the partners aim to shorten the window between intrusion and disruption.

The model also separates independent monitoring from the technology and operational support used to resolve an incident, while preserving a clear escalation path. Shipowners that already work with NORMA Cyber gain an additional operating model; those that do not can keep their existing SOC and still use Marlink to remediate.

Whether more car carriers and container lines adopt the dual-vendor pattern will depend on how quickly the maritime sector converges on a standard split between independent monitoring and provider-led response.