Cybersecurity, drone management, energy infrastructure and critical-infrastructure protection are converging into a single security architecture

Geopolitical crises, cyberattacks and increasingly fragile supply chains are fundamentally changing the security requirements facing Europe’s seaports. The temporary closure of the Strait of Hormuz, volatile energy markets and the growing digitalisation of critical processes demonstrate that modern ports are no longer merely cargo-handling locations. They have become highly interconnected critical infrastructures whose disruption can directly affect economic stability, energy security and national resilience.
The Port of Rotterdam provides a particularly clear example of how this transformation is affecting Europe’s largest maritime infrastructure. Its latest half-year results indicate stable cargo volumes and robust economic performance. More significant from a security perspective, however, is the strategy supporting this stability.
Rotterdam is investing systematically in cyber resilience, drone management, energy infrastructure and digital cooperation. In doing so, the port is increasingly emerging as a European reference model for the protection of interconnected critical infrastructure.

Why Rotterdam is strategically important to European security

The Port of Rotterdam is far more than Europe’s largest seaport. It is one of the continent’s most important energy, industrial and logistics hubs.
Crude oil, liquefied natural gas, chemicals, containers and bulk commodities move through Rotterdam on their way to markets across Europe. At the same time, the port is developing into a major hydrogen hub and is closely connected to the energy and logistics networks of Germany, Belgium and other European countries.
Its strategic importance therefore extends far beyond cargo throughput. As critical infrastructure, Rotterdam has major economic and security-policy relevance. The port’s resilience directly influences Europe’s security of supply, industrial competitiveness and ability to withstand crises.
Investment in physical protection, cybersecurity and resilient supply chains is consequently becoming a matter of strategic European importance rather than a purely local operational concern.

Resilience becomes the new benchmark

With cargo throughput of 212 million tonnes during the first half of 2026, Rotterdam remained remarkably stable despite geopolitical tensions. Liquid bulk volumes increased, while container throughput remained close to the previous year’s level.
The development was influenced, among other factors, by the temporary closure of the Strait of Hormuz, changing commodity flows and higher refining margins in Europe.
Rotterdam’s performance illustrates that resilience can no longer be measured solely through financial stability or cargo volumes. Supply chains must remain operational even under geopolitical pressure, disrupted trade routes and volatile energy conditions.
For operators of critical infrastructure, resilience is therefore becoming a strategic security requirement. The decisive question is no longer whether individual disruptions can be prevented entirely, but whether the system can absorb shocks, adapt its operations and continue delivering essential services.

The port as critical infrastructure

Rotterdam simultaneously functions as an energy hub, a chemical-industry cluster, a hydrogen centre and a logistical backbone for Europe. This combination significantly expands the scope of its security architecture.
The implementation of the European NIS2 and Critical Entities Resilience, or CER, directives is bringing physical security and cybersecurity into a common regulatory framework.
From 15 August 2026, hundreds of companies operating in the port are expected to fall under the relevant Dutch implementing legislation. They will face new registration, risk-management, due-diligence and incident-reporting requirements.
Operators will consequently have to demonstrate more than the protection of individual IT systems. They will be required to show that their organisations can withstand, respond to and recover from a broad range of digital, physical and operational disruptions.
This represents a fundamental shift. The focus is moving away from the isolated protection of individual companies and towards the resilience of the port ecosystem as a whole.

Cybersecurity becomes shared infrastructure

Ferm Zeehavens, the cybersecurity platform for Dutch seaports, demonstrates how this collective approach can work in practice.
Together with a Dutch start-up, the organisation has developed a digital “Cyber Shield” that continuously monitors internet-connected systems and identifies both known and emerging vulnerabilities at an early stage.
More than 15 critical organisations and thousands of IT and operational-technology systems are already subject to continuous monitoring. A protected information-sharing platform has also been established, allowing port companies to exchange information proactively about cyber incidents, vulnerabilities and current threats.
This approach reflects a broader change in cybersecurity strategy. Individual organisations can no longer defend themselves effectively through isolated technical measures alone.
Instead, shared security networks are emerging in which participants exchange threat intelligence, assess risks collectively and identify attacks before they spread across interconnected supply chains and operational systems.
In a port environment, this collaborative model is particularly important. A cyber incident affecting one terminal operator, logistics provider or energy company can rapidly affect other businesses that depend on the same data flows, transport systems or infrastructure.

Operational-technology security moves into focus

The digitalisation of port operations is also making operational technology a central security concern.
Container terminals, locks, tank farms, pipelines, process-control systems, energy installations and traffic-management systems form the operational foundation of the port. Many of these assets were originally designed primarily for reliability and availability rather than exposure to modern cyber threats.
As these systems become increasingly connected to corporate networks, remote-maintenance platforms and external service providers, their potential attack surface grows.
Traditional IT security is therefore no longer sufficient. Operators must establish a detailed inventory of their operational assets, understand dependencies between systems and continuously assess vulnerabilities.
Network segmentation, secure remote access, monitoring of industrial-control systems, incident-response planning and strict identity and access management are becoming essential components of modern critical-infrastructure protection.
The objective is not only to prevent data loss. A successful attack on operational technology could interrupt cargo handling, manipulate industrial processes, disrupt energy supply or compromise safety-critical equipment.

The lower airspace becomes part of the security architecture

The port’s physical security environment is also changing.
Drones are already being used in Rotterdam for inspections, environmental monitoring, surveying, security tasks and emergency-response support. Their ability to access difficult or hazardous areas can improve efficiency and reduce risks to personnel.
However, the increasing number of unmanned aircraft also creates a need for structured management of the lower airspace. Legitimate commercial and operational flights must be distinguished from unauthorised, unsafe or potentially hostile drone activity.
The Port of Rotterdam Authority has therefore applied to the Dutch Ministry of Infrastructure and Water Management for the establishment of a Pre-U-space.
This preliminary stage of a fully regulated U-space environment is intended to create binding procedures for registering, authorising and approving drone operations. It will provide a foundation for the safe integration of future autonomous and remotely operated aerial systems into the port environment.
The initiative illustrates a significant development in critical-infrastructure protection. Airspace management can no longer be treated as separate from perimeter security, cyber defence and operational control.
A drone may be a legitimate inspection tool, an accidental safety hazard, a platform for surveillance or a means of delivering a malicious payload. Effective security therefore requires both the facilitation of approved operations and the rapid identification of unauthorised activity.

Energy infrastructure becomes a security responsibility

The energy transition is creating further security requirements.
Several important projects were implemented during the first half of the year. These included the commissioning of the first section of the Dutch hydrogen network between Maasvlakte and Pernis, new shore-power installations for ships and the first bunkering of a seagoing vessel with an ethanol-methanol fuel blend.
Such projects support the decarbonisation of shipping and industrial activity. At the same time, they create new categories of critical energy infrastructure.
Every hydrogen pipeline, digitally controlled energy facility and intelligent supply network introduces additional physical, cyber and operational dependencies.
Hydrogen infrastructure, for example, requires reliable process control, leak detection, emergency planning and protection against unauthorised access. Digitally managed shore-power systems must be secured against manipulation and operational failure. New fuel-handling systems require adapted safety and security procedures.
The transition to a low-carbon port therefore cannot be separated from resilience planning. Sustainability projects must be designed from the outset with cybersecurity, physical protection, business continuity and incident response in mind.

The investment climate is also a security factor

The Port of Rotterdam Authority has also highlighted structural risks that extend beyond individual technologies.
High energy costs, grid congestion, lengthy approval procedures, nitrogen-emission restrictions and the need to modernise Dutch transport and logistics infrastructure may weaken the port’s long-term competitiveness.
These issues are also relevant from a security perspective. Economic strength and resilience are closely connected.
Companies that face prolonged uncertainty or insufficient infrastructure may postpone investment in modern facilities, digitalisation and security. Network congestion can delay energy-transition projects. Ageing transport links can create operational bottlenecks and reduce the system’s ability to respond flexibly during disruptions.
For Rotterdam, investment in infrastructure and energy capacity is therefore not solely an economic-policy matter. It is also a prerequisite for maintaining an effective and sustainable security architecture.
Security measures can only remain effective if the underlying physical, digital and energy infrastructure is adequately funded, maintained and modernised.

The future of port security is convergent

The Port of Rotterdam demonstrates the direction in which critical-infrastructure security is developing.
Physical security, cybersecurity, operational technology, drone management, energy supply, emergency planning and regulatory compliance are no longer separate disciplines. They are becoming components of an integrated resilience system.
For operators of ports, industrial parks, energy facilities and other critical infrastructure, this creates a central strategic requirement: risks must be assessed across organisational and technological boundaries.
A cyberattack may cause physical disruption. A power failure may disable digital monitoring. A drone may be used to inspect infrastructure or to conduct hostile reconnaissance. A disruption affecting one company may spread across an entire supply chain.
Effective protection therefore requires shared situational awareness, clearly defined responsibilities, interoperable systems and cooperation between public authorities, infrastructure operators, technology providers and private security organisations.
The ability to exchange information rapidly is particularly important. Each organisation may see only one part of an emerging threat. A terminal operator may detect unusual network traffic, an energy company may identify abnormal process behaviour and a security unit may observe unauthorised drone activity. Only by combining these indicators can the wider risk become visible.

A European blueprint for resilient infrastructure

Rotterdam’s development provides more than an example of stable port operations during geopolitical uncertainty. It shows how security, digitalisation and infrastructure policy are beginning to converge.
The port’s approach does not suggest that every risk can be eliminated. Nor does it rely on one technology or regulatory measure. Instead, it treats resilience as the result of continuous cooperation between technical systems, organisational processes, legal obligations and human expertise.
This is the central lesson for Europe’s critical-infrastructure operators.
Resilience is no longer a standalone security measure. It is the capacity of an entire ecosystem to anticipate threats, absorb disruption, maintain essential functions and recover without creating wider economic or societal damage.
Europe’s largest seaport is therefore becoming a blueprint for a broader transformation. Rotterdam demonstrates that the future of critical-infrastructure security lies not in the isolated protection of facilities, networks or organisations, but in an integrated architecture capable of connecting cybersecurity, physical protection, operational technology, energy resilience and cross-sector cooperation.