Maritime Domain Awareness in the Era of Hybrid Warfare: Why Europe Needs AI at Sea
Subsea cables cut in the Baltic, dark ships loitering over pipelines, drones launched from merchant decks. Europe's most vulnerable infrastructure is under water and under-watched. Here is what AI-driven maritime domain awareness changes, how a platform like BlueShadow works, and why we believe it is one of the most important dual-use projects we have engineered.
By Solomiia Kots
CEO at Mirko
Over the last three years Europe has learned a hard lesson about the sea. Gas pipelines, power interconnectors and the telecom cables that carry most of the continent's data run across seabeds that nobody watches continuously. The vessels that damage them are rarely warships. They are tankers and bulk carriers with transponders switched off, flags of convenience and anchors that drag for tens of kilometres. By the time a cable operator notices a fault, the ship is in international waters.
This is hybrid warfare in its purest form: deniable, cheap for the attacker and expensive for the defender. Responding to it with more patrol boats does not scale. Responding to it with better data does.
What maritime domain awareness actually requires
Maritime domain awareness means knowing, at any moment, what is on the water, what it is doing and whether it matters. The raw material exists: AIS transponder data, coastal and ship radar, electro-optical and infrared cameras, synthetic-aperture radar from satellites, signals intelligence, port records and open sources. The problem is that each source sees a fragment, each has its own blind spots, and the most dangerous vessels deliberately break the picture by switching off AIS or spoofing their position.
The gaps that matter most
- Dark ships: vessels that disable or falsify AIS, invisible to the systems most operators rely on.
- Correlation: a radar blip, a satellite image and a signal intercept describing the same ship are three records in three systems.
- Scale: a national coastline generates thousands of contacts a day; humans cannot score them all.
- Response: when something is wrong at three in the morning, the operator needs a plan, not a dashboard.
How BlueShadow approaches it
BlueShadow, the Copenhagen-based platform Mirko engineers and where our Tech Lead Maksym Hrebinnyk serves as CTO, treats these gaps as a pipeline of three AI engines. The Contact Correlation Engine fuses AIS, radar, ELINT, SIGINT, electro-optical, SAR, infrared, port data and OSINT into one data lake and produces a wide-area Common Operating Picture, with an Enhanced Operating Picture around critical infrastructure. Cross-source correlation is what illuminates dark ships: a vessel can hide from one sensor, not from nine.
The Threat Assessment Engine keeps a threat score on every vessel from its behaviour and history, and a risk score on every critical asset from its exposure. Instead of a thousand equal dots, the operator sees the twelve that matter, ranked, with reasons. Alerts go out by SMS, call, operator pop-up or drone deployment depending on severity.
The Event Response Engine turns an alert into action: a virtual event room opens, stakeholders are notified, in-situation data streams live and drones can be deployed as first responders according to jurisdiction and response plans. The platform was built by marine security specialists, data engineers and environmental analysts, and its founder is a former U.S. Navy submarine commander. Our job is to make the engineering as serious as the mission.
Why this is a European priority
Europe's energy transition moves generation offshore: wind farms, interconnectors and the cables that tie them together. Its digital economy runs on subsea fibre. Its northern flank, from the Baltic to the North Sea, is exactly where recent incidents have clustered. NATO's Baltic Sentry mission and national initiatives have increased patrols, but persistent awareness across thousands of kilometres of sea cannot come from hulls alone. It has to come from software that fuses what every sensor already sees and tells a human what to do about it.
A platform like BlueShadow serves navies and coast guards, but also the civilian owners of the infrastructure at risk: cable operators, wind farm developers, oil and gas companies, ports and the insurers who carry the exposure. That dual-use character is what makes it viable: the same operating picture that protects a cable also prevents an outage and validates a claim.
The engineering standards it demands
Building for this domain changed how we think about reliability. Scores must be explainable, because an operator will be asked to justify a response. Irreversible actions, such as deploying a drone, keep a human in the loop. Data stays inside national or allied boundaries, which means private-cloud and on-premises deployment rather than convenient hosted services. And every model change runs through an evaluation suite before it reaches an operations centre, the same eval-driven discipline we apply to every AI system we ship.
