This study reviews ship security assessment. The objectives are to explore the possibilities for quantifying and performing a more thorough ship security risk analysis than that described in the International Ship and Port Facility Security code and to evaluate to what extent this more detailed analysis increases ship security and facilitate the effective selection of risk control options. The study focuses on Somali-based maritime piracy, using piracy on the Indian Ocean as a case study. Data are collected using questionnaires and interviews with civilian and military security experts who possess firsthand experience of piracy off the coast of Somalia. The data are collected specifically for this study and describe and quantify the threat’s capability, intent and likelihood of exploiting a ship’s vulnerability. Based on the collected description of the threat, the study analyzes and describes: probability of detection by pirates, probability of successful approach, and probability of successful boarding. The performed work shows good agreement between calculated probabilities and frequencies in the cited incident reports. Also, the developed scenarios describe the most important influences on the analyzed areas. The research therefore shows that the proposed risk-based approach, which uses structurally collected and documented information on the threat, can increase ship security by assisting in selecting risk control options. The approach also allows for a better understanding of the causal relationship between threat and risk than that provided in today’s security analysis by ship owners, for example. This understanding is crucial to choosing effective and robust risk control options.

The demands on maritime operations today are increasingly higher in terms of control, efficiency and cost. The margins for accidents and security incidents are therefore decreasing. In the area of ship safety the regulations, guidelines and methods have a history and culture of systematic research, development and implementation. In contrast, international security is highly politicized and therefore not as transparent. The result is that a tradition of ship security is not as well established. The overall aim of this thesis is to propose a method for ship security analysis that increases the overall safety of the crew and the ship. The objective is to develop a method that is systematic in order to ensure that assessment and response are complete and effective, and that the process is documented to provide evidence of decision-making. The method used is probabilistic risk assessment where quantitative analysis is central. The proposed approach is consistent with the requirements of maritime safety work. However, in the work here, the proposed methods are specifically tested for security cases. This is because hazards (without intent) and threats (with intent) evolve in different ways into risk. Therefore, they must be analysed differently in order to capture the causal relationship. The proposed approach consists of three steps: the first step consists of a threat description that documents qualitative and quantitative aspects that together describe how the threat most likely will act in relation to the ship’s vulnerability; the second step uses the threat description to define the system studied as well as the scenarios that collectively describe the harmful consequences; the third step evaluates the risk with tools from probabilistic risk assessment. The overall conclusion is that the proposed method brings the procedure and results of ship security analysis into the open and therefore allows for criticism, improvements and shared risk knowledge, not possible with less structured methods. The results also show that the calculated probabilities agree with available statistics, which indicates that the analysis succeeds in describing the central causal relationships of the scenarios modelled.