Vigilant Maritime Surveillance of Critical Submarine Infrastructure

Project Information

VIGIMARE

Grant agreement ID: 101168016

DOI

10.3030/101168016

EC signature date 19 July 2024

Start date 1 September 2024

End date 31 August 2027

Funded under

• Civil Security for Society

Total cost

No data

EU contribution

€ 4 749 862,77

Coordinated by

LAUREA-AMMATTIKORKEAKOULU OY
Finland

Periodic Reporting for period 1 - VIGIMARE (Vigilant Maritime Surveillance of Critical Submarine Infrastructure)

Reporting period: 2024-09-01 to 2026-02-28

Summary of the context and overall objectives of the project

Europe’s submarine infrastructure is foundational to how the continent functions.

Strategic importance and evolving threat landscape
Submarine telecommunication cables carry almost all of Europe’s international internet traffic, while offshore gas pipelines and undersea power cables are central to energy security. Despite this, they have received limited policy attention due to their invisibility and unclear governance. The Nord Stream pipeline sabotage and subsequent incidents affecting telecom, power, and gas infrastructure in the Baltic Sea (2023–2025) exposed their vulnerability. Hybrid threats, combined with accidental damage from anchoring and fishing, create risks that current, largely reactive monitoring systems cannot address.

VIGIMARE concept and approach
VIGIMARE was designed to close this gap. Funded under Horizon Europe Cluster 3, it brings together 19 partners from eight European countries—research institutes, technology providers, and five major CI operators—to develop and demonstrate an integrated maritime surveillance platform. Built around a Virtual Control Room (VCR), the platform combines satellite imagery, fibre-optic sensing, AIS tracking, and AI-based anomaly detection to provide a shared, near-real-time operational picture for operators and authorities.

Core objectives
Four objectives guide the project: establishing structured information sharing between operators and authorities; improving resilience through evidence-based physical and cyber risk assessment; enhancing situational awareness via integrated data for earlier threat detection and response; and supporting compliance with the Critical Entities Resilience Directive and NIS2 Directive.

Use cases across European sea areas
The project addresses four use cases: a Mediterranean hybrid threat scenario involving gas pipelines and power cables; Irish Sea gas interconnectors; the Baltic Pipe and onshore gas network; and Baltic Sea telecommunication cables. Together, these cover both energy and digital infrastructure and the European regions of highest current concern.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

The first eighteen months of VIGIMARE established the analytical and technical foundations for the remainder of the project.

WP1 — Project management and coordination (completed)
The project management framework was established and operated without deviations.

Threat and risk assessment (WP3 — completed)
A comprehensive threat landscape analysis was completed across all CI categories and pilot sites. Deliverable D3.1 mapped the geopolitical and financial environment, highlighting hybrid tactics, attribution challenges, and blurred civilian-military boundaries, alongside evolving EU policy (including the 2025 Commission Recommendation and proposed EU Cable Security Toolbox). Physical threat analysis (D3.2) produced a Damage-Risk Analysis methodology quantifying annual damage probability per site. Cyber threat analysis (D3.3) used a motivation-based taxonomy (espionage, terrorism, sabotage, warfare), identifying vendor vulnerabilities and ransomware as highest risk. A multi-risk dynamic assessment (D3.4) integrated physical and cyber risks, while operational preparedness and societal impact analysis (D3.5) identified landing station security and subcontractor management as the most critical measures.

System engineering (WP4 — completed)
The VIGIMARE system architecture, data model, and information-sharing network were designed and initiated. The data model is a CISE-compatible extension, ensuring future integration with European maritime systems. The architecture uses microservices and Apache Kafka for scalable, real-time exchange. Requirements (D4.1) were defined with CI operators. Initial data collection covered AIS, satellite imagery (Sentinel-1, Cosmo-SkyMed, Sentinel-2, WorldView), fibre-optic and vibro-acoustic sensors, DAS data, and cyber/network data.

Platform and analysis services development (WP5, WP6 — ongoing)
Platform development is on schedule, with the information-sharing network deployed. Adaptor components are being built using Kafka, REST APIs, and WebSockets. AI-based physical threat detection includes vessel anomaly detection and satellite-based dark vessel/change detection. The cyber framework applies a Cyber-Physical Anomaly Detection approach with unsupervised learning and a two-level fusion framework for OT and SCADA systems.

Demonstration preparation (WP7 — ongoing)
Planning is underway for four use cases: Mediterranean hybrid threats, Irish Sea gas interconnectors, Baltic gas pipeline, and Baltic telecom cable. Each includes defined scenarios, services, data needs, and evaluation criteria. Demonstrations will use historical and real-time data, including areas near the C-Lion1 cable. An evaluation framework with KPIs is being developed with CI operators to reflect real-world conditions.

Exploitation and dissemination (WP8 — completed)
Key Exploitable Results were identified, including data sharing, pre-warning services, monitoring concepts, cybersecurity assessment, vibroacoustic monitoring, and risk tools. An insurance market analysis highlighted coverage gaps and proposed EU-level mechanisms. The project conducted 22 dissemination activities, including events with EMSA, Security Research Europe, the European Commission, the Finnish Parliament, and other CI security forums.

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

VIGIMARE advances the field in several directions.

Integrated, proactive surveillance
VIGIMARE delivers an integrated, near-real-time operational picture combining satellite, fibre-optic, acoustic, cyber, and vessel tracking data. Current monitoring is fragmented—fibre systems detect damage after it occurs, AIS only tracks cooperative vessels, and pressure sensors signal breaches post-event. VIGIMARE shifts the state of the art from reactive damage detection to proactive threat awareness.

Standardised data exchange
The project’s CISE-compatible data model establishes a reusable standard for multi-domain submarine CI data exchange, which currently does not exist. Its adoption would enable direct integration with European maritime surveillance systems without bespoke solutions.

Commercial exploitation potential
The most mature exploitable result is the pre-warning service concept. Insurance analysis indicates that reduced premiums for operators using certified monitoring solutions could significantly offset adoption costs.