This study reviews ship security assessment. The objectives are to explore the possibilities for quantifying and performing a more thorough ship security risk analysis than that described in the International Ship and Port Facility Security code and to evaluate to what extent this more detailed analysis increases ship security and facilitate the effective selection of risk control options. The study focuses on Somali-based maritime piracy, using piracy on the Indian Ocean as a case study. Data are collected using questionnaires and interviews with civilian and military security experts who possess firsthand experience of piracy off the coast of Somalia. The data are collected specifically for this study and describe and quantify the threat’s capability, intent and likelihood of exploiting a ship’s vulnerability. Based on the collected description of the threat, the study analyzes and describes: probability of detection by pirates, probability of successful approach, and probability of successful boarding. The performed work shows good agreement between calculated probabilities and frequencies in the cited incident reports. Also, the developed scenarios describe the most important influences on the analyzed areas. The research therefore shows that the proposed risk-based approach, which uses structurally collected and documented information on the threat, can increase ship security by assisting in selecting risk control options. The approach also allows for a better understanding of the causal relationship between threat and risk than that provided in today’s security analysis by ship owners, for example. This understanding is crucial to choosing effective and robust risk control options.