Cybersecurity in aquaculture: Risks, governance, and future directions across production systems

Abstract

Aquaculture is becoming increasingly dependent on connected sensors, remote monitoring, edge and cloud analytics, automation, and digital traceability; however, the cybersecurity evidence base remains fragmented and low‐trophic systems are markedly underrepresented. This systematic review synthesizes the literature on cyber risks, governance, and mitigation in aquaculture. The evidence shows that digitized aquaculture is primarily exposed through environmental sensor networks, wireless communications, cloud platforms, blockchain traceability systems, and emerging digital twins. The most recurrent threat families were data‐integrity attacks, network‐based attacks, authentication and access‐control failures, ransomware, and supply‐chain compromise. Mitigation strategies centered on lightweight encryption and mutual authentication for resource‐constrained devices, intrusion detection and monitoring, network segmentation, permissioned blockchain architectures, and privacy‐preserving edge or federated learning. However, only one study directly addressed mussel farming and no study focused specifically on seaweed farming. This gap is consequential because low‐trophic aquaculture is increasingly promoted for nutrient removal, climate adaptation, and food‐system resilience. We argue that aquaculture cybersecurity should be treated as a cyber‐physical and socio‐ecological problem: cyber incidents can distort environmental data, disrupt certification and traceability, and undermine both farm operations and ecosystem‐service claims. NIST risk‐management practices and ENISA/NIS 2‐aligned governance offer useful starting points, but they require aquaculture‐specific adaptation to remote marine operations and to the capacities of smaller producers. Future work should prioritize sector‐specific threat models, field validation, incident reporting, and secure‐by‐design architectures for low‐trophic farms.