Maritime Security: Piracy Risk, Armed Escorts, and Security Planning for High-Risk Waters

Maritime security covers a distinct set of risks from land-based executive protection, but the analytical approach is the same: understand the threat environment, assess your specific exposure, and implement proportionate controls.

This guide covers piracy and maritime armed robbery risk in current high-risk waters, the legal framework for armed security personnel on vessels, and the security planning requirements for vessels and personnel operating in elevated-risk maritime environments.

The Current Threat Picture

The International Maritime Bureau (IMB), which tracks piracy and maritime armed robbery globally, published 120 incidents in its 2024 Annual Piracy and Armed Robbery Report. The Gulf of Guinea — covering waters off Nigeria, Benin, Togo, Ivory Coast, Ghana, Cameroon, and Gabon — accounted for the largest share of crew kidnapping incidents, with Nigerian waters remaining the primary concern.

Somali piracy, which dominated the threat picture between 2008 and 2012 and prompted the deployment of the EU Naval Force (EUNAVFOR) Operation Atalanta and other international naval task forces, has reduced significantly. However, the underlying conditions that produced the Somali piracy surge (coastal poverty, failed state governance, weak law enforcement) have not changed materially, and the threat has not been eliminated.

The Bab-el-Mandeb strait and Red Sea have seen a serious escalation in maritime security incidents since late 2023, with Houthi attacks on commercial shipping creating a new high-risk corridor that has caused major rerouting of global container traffic around the Cape of Good Hope.

The Strait of Malacca and the Sulu Sea in the southern Philippines carry persistent armed robbery and low-level kidnapping risk. Indonesian waters see the highest volume of low-level theft incidents in the Asia-Pacific region, typically opportunistic boarding of vessels at anchor.

Crew Kidnapping: The Gulf of Guinea Risk

The Gulf of Guinea threat model is distinct from the classic Somali piracy model. Somali pirates historically seized vessels and held them for ransom (cargo and vessel). Gulf of Guinea attackers typically board the vessel, take crew members off the ship, and hold the crew for ransom while the vessel continues or is recovered. Crew members are taken to onshore locations in Nigeria or nearby countries.

This makes crew kidnapping a fundamentally different security problem from vessel-focused piracy. The ransom negotiation involves private parties (the vessel owner, the crewing company, K&R insurers) rather than the flag state or naval authorities. Response consultants from firms specialising in maritime K&R — including Control Risks and the broader Lloyd’s of London response network — have substantial experience in Gulf of Guinea crew kidnapping cases.

Prevention focuses on making boarding difficult, reducing transit time in high-risk corridors, and using armed guard vessels (patrol boat escorts) rather than embarked armed guards in Nigerian territorial waters, where the legal and practical framework differs from open-water deployments.

Armed Maritime Security: How It Works

For vessels transiting high-risk areas in international waters, the standard model is embarked armed security personnel — a team of typically 3-4 armed guards who join the vessel at a transit port and disembark at the next port after the high-risk passage. They carry approved firearms (typically non-automatic rifles and pistols) in a locked container that only they have access to.

ISO 28007 provides the international standard for companies providing privately contracted armed security personnel at sea. Reputable maritime security companies are ISO 28007 certified. P&I clubs — the mutual insurance associations that cover most commercial shipping — typically require the use of ISO 28007-certified providers for armed escort deployments.

The rules for use of force are specific and governed by the law of the flag state. Maritime security officers are not entitled to use lethal force against pirates in the way that might be assumed from the terminology. The rules of engagement are defined in the security plan and must comply with applicable law. A security company that cannot provide a clear, legally reviewed rules of engagement document should not be operating in this space.

Private Yachts and Superyachts

The security planning requirements for private vessels and superyachts in high-risk waters are different from commercial shipping in several respects. The owner and their guests are aboard, not a professional crew operating under a company security programme. The vessel is identifiable as a high-value asset. And the owner’s ability to make route decisions is not constrained by charter contracts or commercial schedules.

For private vessels, the primary security measure in most cases is route planning — avoiding high-risk corridors rather than transiting them with armed guards. For superyacht owners who require access to specific destinations in or near high-risk waters (East Africa, the Gulf, Southeast Asia), a destination-specific security assessment covering port security, anchoring protocols, crew shore leave procedures, and contingency planning should precede the voyage.

The Connection to Land-Based Security

Maritime security does not exist in isolation from the broader threat picture. A vessel calling at Lagos, Nairobi (Mombasa), or Manila is operating in the same risk environment as the land-based operations in those cities. The port and its surroundings carry the same crime and security characteristics as the city.

Crew going ashore in Lagos need the same security briefing as any business traveller to Lagos. Personnel transferring from vessel to shore accommodation and back require the same transport security planning as any ground movement in a P1 city.

For the land-based security picture in our P1 cities with major port activity, see Lagos, Jakarta, Manila, Mumbai, and Karachi. For our executive protection and security driver services covering port cities, see executive protection and security drivers. For the port facility security framework – ISPS Code compliance, port-specific threat categories, executive visit protocols, and the security environment at major P1 city ports including Lagos/Apapa, Karachi, Manila, and Mombasa – see our port security and maritime infrastructure guide. For the security framework specific to large private yachts and superyachts – crew vetting to the residential staff standard, Red Sea and Gulf of Guinea piracy assessment, AIS location privacy, anchorage counter-surveillance and offshore MEDEVAC planning – see our superyacht and luxury yacht security guide. For HNWI passengers and close protection teams operating aboard luxury cruise lines – ISPS Code vessel security obligations, Houthi Red Sea rerouting, port security in P1 cities, and personal security discipline in a shared passenger environment – see our security for luxury cruise passengers guide.