A Co-Analysis Framework for Safety and Cybersecurity Assessment in Autonomous Maritime Operations

This paper presents the results of a co-analysis framework for the integrated assessment of safety and cybersecurity in autonomous maritime operations. Developed within the context of the EC-funded SEAMLESS project, the framework addresses the critical challenge of analysing cascading effects in which cybersecurity breaches induce safety hazards and, conversely, safety-related failures create or amplify cyber vulnerabilities. The proposed methodology relies on the parallel execution of the EBIOS Risk Manager and STPA-SafeSec methodologies, using a phase-by-phase alignment to combine attacker-centric threat profiling with controltheoretic hazard analysis. This co-analysis enables the production of unified, traceable artefacts linking business assets and control components to threat actors and causal mechanisms. The framework has been developed and applied within SEAMLESS across autonomous port-operation use cases, including autonomous mooring and autonomous cargo handling. The paper presents detailed results for the autonomous cargo-handling use case, demonstrating the framework's ability to identify safety- and cybersecurity-relevant risk mechanisms, reveal coupled vulnerabilities, and support safe-and-secure-by-design development while strengthening operational resilience.

Keywords: Autonomous maritime systems, safety-security co-analysis, cyber-physical systems, cascading cyberphysical risk, STPA-SafeSec, EBIOS Risk Manager..