Contributed Article
By Ferris Adi, Chief Information Security Officer, Trans Americas Fiber System
Subsea cables have long been viewed as physical infrastructure, fiber on the ocean floor, landing stations, and cable ships. That view is no longer sufficient. Today’s subsea systems are defined less by steel and fiber, and more by the digital operating ecosystem that surrounds them. As these environments become more automated, remotely managed, and vendor-integrated, they are quietly transforming into critical cyber systems, and expanding the attack surface in ways many organizations have yet to fully recognize.
The risk has shifted, but the narrative hasn’t
Public discussion still focuses on physical risks: anchor dragging, fishing activity, and geopolitical disruption. These threats remain real and visible.
But the more immediate risk is less visible, and more scalable: What happens if the systems used to operate, monitor, or restore subsea infrastructure are compromised? In modern environments, the cable itself is no longer the most vulnerable point. The management plane is.
From passive asset to digital ecosystem
A subsea system is no longer a single asset. It is an interconnected service model that includes:
- Network operations platforms and control systems
- Vendor access and remote support pathways
- Identity, privileged access, and monitoring infrastructure
- Cloud-connected services and customer platforms
- Restoration, assurance, and operational workflows
This ecosystem drives performance, but it also defines the attack surface. A compromise in any one of these layers can escalate quickly from a technical issue into an operational, regulatory, or customer-impacting event.
The hidden critical layer: The management plane
The most important systems in subsea cybersecurity are often the least visible to executives. The management plane governs how infrastructure is configured, accessed, monitored, and restored. If compromised, it provides attackers not just with disruption capability, but with the ability to operate the network itself.
This risk is amplified in environments with:
- Heavy reliance on vendor support
- Weak identity controls or shared credentials
- Limited segmentation between IT, OT, and operational systems
- Unmonitored or poorly governed remote access
If the management plane is not secured, resilience is largely theoretical.
Why geographic diversity is not enough
The subsea industry has historically defined resilience through route and bare metal servers in a 1+1 config for the NMS, multiple paths, landings, and restoration options. That assumption no longer holds in a cyber context. Cyber threats are not constrained by geography. A globally distributed network can still fail in a correlated way if it shares:
- Identity vulnerabilities
- Common vendor access models
- Centralized management dependencies
- Untested recovery processes
Geographic diversity reduces physical risk. It does not address systemic cyber risk. True resilience requires design diversity, access control, and operational discipline.
The greenfield advantage, and responsibility
New subsea programs have a rare opportunity: the ability to build security before operations begin. This is the point where decisions are most impactful—and least expensive to implement. Organizations that succeed treat cybersecurity as a core design function, embedding it into:
- Architecture: Segmentation, controlled access pathways, separation of operational and corporate environments
- Supplier models: Clearly defined access controls, accountability, and oversight
- Operational readiness: Logging, monitoring, and validated recovery capabilities
- Emergency access: Structured, time-bound, and auditable “break-glass” processes
If these controls are not built early, they become significantly harder, and often incomplete, once operations are underway.
Supplier risk is now an operational risk
Subsea infrastructure depends on specialized suppliers. That dependency is unavoidable. What must change is how it is governed. Supplier assurance can no longer sit within procurement processes alone. It must be operationalized daily, through:
- Controlled and monitored remote access
- Session visibility and auditability
- Defined roles in incident response and recovery
- Clear ownership and accountability
If a supplier is critical to restoring service, they must be part of the resilience model before an incident, not during it.
Resilience is defined under pressure
The true test of subsea cybersecurity is not policy; it is behavior during disruption.
Marine repair events illustrate this clearly. Under pressure:
- Access controls are often relaxed
- External actors are introduced
- Decisions are accelerated
- Standard processes are bypassed
These conditions increase cyber risk at precisely the moment when operational dependency is highest.
Leading operators recognize that repair windows are also cyber events, and plan accordingly, with predefined access controls, approval mechanisms, and validation processes. Resilience is not theoretical. It is controlled execution under stress.
From compliance to operational readiness
Cybersecurity frameworks provide structure but they do not guarantee resilience.
Resilient organizations are defined by their ability to:
- Detect meaningful anomalies across identity, access, and management systems
- Make informed decisions quickly under pressure
- Coordinate effectively across internal teams and suppliers
- Restore services with confidence, and evidence
The shift required is from control presence to operational confidence.
The board-level question that matters
Executives do not need detailed technical expertise, but they do need clarity. The most important question is not whether controls exist, but whether they work when needed.
“If a critical management system or supplier access path were compromised today, how quickly would we know, and how confidently could we restore service?”
This question forces alignment across governance, technology, operations, and supplier management. It also exposes the difference between compliance and resilience.
The next decade will raise the stakes
Subsea infrastructure is becoming increasingly strategic and increasingly contested.
It underpins:
- Cloud and hyperscale platforms
- Financial and digital economies
- Government communications and national security
- AI-driven workloads and global data exchange
At the same time, advances in AI, automation, and supply chain complexity will accelerate both attacker capability and operational dependency.
Technology alone will not determine the outcome. The differentiator will be governance and operational discipline.
Redefining the asset
The future of subsea cybersecurity will not be secured by protecting the cable alone. It will be secured by protecting the operating model around it, identity, access, vendors, monitoring systems, and recovery processes. Subsea infrastructure has always connected continents. But in a digital-first world, the real challenge is no longer connectivity.
It is trust. And trust, in this context, is built on one thing: Proven resilience before it is needed.
The submarine cable industry is evolving rapidly. Join the industry in discussion at Submarine Networks EMEA 2027