Intruder Alert: Ports Face a Range of Underwater Threats

On December 15, 2025, footage from a hacked security camera at Russia’s Novorossiysk Naval Base captured a powerful underwater explosion rocking a berthed Kilo-class submarine. The Ukrainian Security Service (SBU) subsequently took responsibility for the attack, claiming that it had been carried out by a previously undisclosed uncrewed underwater vehicle (UUV), “Sub Sea Baby.” While Ukraine has been quite open about its efforts to deploy combat UUVs (an armed “Marichka” may have been used in an underwater strike on the Kerch bridge in June of 2025), the Novorossiysk attack represents the first known instance of a UUV conducting a submerged strike inside a defended naval port.

Beyond the implications for Russia’s Black Sea Fleet, the episode highlights a broader, urgent reality: ports and harbors are increasingly vulnerable to hostile underwater uncrewed systems. Advances in autonomy, navigation, and energy storage have enabled relatively small underwater platforms to operate at ranges and with precision that would have been difficult to achieve only a decade ago. At the same time, the lines separating mines, torpedoes, and UUVs are blurring as these systems increasingly converge in both capabilities and mission sets. For ports and naval facilities, where ships, logistics infrastructure, and critical undersea assets are concentrated in confined areas, this convergence introduces new vulnerabilities. Even as many ports have implemented robust security measures against air and surface threats, and cybersecurity has received increasing attention in recent years, the underwater environment remains comparatively difficult to monitor and defend.

A Subsea Threat Matrix

Ports and naval bases face a diverse set of potential underwater threats, each with distinct operational characteristics and detection challenges. Combat divers represent the most traditional of these. Operating either with open-circuit scuba equipment or closed-circuit rebreathers, divers can deploy from outside the harbor perimeter, approach a target covertly, and emplace limpet mines or other explosive devices on hulls, piers, or subsea infrastructure.

Diver propulsion vehicles (DPVs) are small battery-powered scooters that allow divers to travel faster and with less fatigue than swimming alone. DPVs extend the operational range of combat swimmers and support covert reconnaissance, mine placement, or infrastructure sabotage. A larger and more capable variant of this concept is the swimmer delivery vehicle (SDV). SDVs are small submersibles enabling special operations forces to covertly infiltrate defended areas from stand-off range, often launching from submarines or surface vessels operating well outside a harbor’s surveillance perimeter.

Increasingly, however, the most consequential threat may come from UUVs. Advances in autonomy, navigation, and battery technology have enabled relatively compact UUVs to operate with considerable range and precision. These vehicles can carry sensors for reconnaissance or payloads designed to damage ships or infrastructure, all without risking human life. Their low acoustic signatures make them difficult to detect in the acoustically cluttered environments typical of busy ports, and they can infiltrate harbors autonomously using advanced navigation systems. And the growing affordability and accessibility of UUV technologies means underwater strike capabilities are no longer limited to specialized military units, and may increasingly enter the toolkit of both state and non-state actors.

As these risks grow, coastal installations are increasingly adopting layered security approaches combining deterrence, surveillance, and response.

Deterrence: Barriers to Entry

The first layer of port security is highly visible deterrence measures that signal to potential adversaries that an area is actively monitored and defended, increasing the perceived risk of detection and interdiction. Crewed patrol vessels remain an important component of this deterrent posture, providing a visible presence that discourages unauthorized activity, as well as a rapid response capability. Surface operations may also contribute to underwater surveillance, as radar, EO/IR sensors, or human observers might detect UUV wakes or communications masts, particularly during calm water conditions.

Physical barriers provide another important deterrent. Floating security booms are widely used to restrict access to sensitive areas of ports and naval bases. These systems typically consist of surface pontoons connected by cables with mesh netting or fencing that extends downward to the seabed. Several companies market integrated surface and underwater security barrier systems to naval bases, offshore facilities, and commercial ports, such as RBtec Perimeter Security Systems, Halo Arabia, JF Brennan, and Ultrasea. Notably, a floating barrier was likely disengaged during the Novorossiysk attack. Whether due to port operations, maintenance, or complacency remains unclear, but it highlights how gaps in barrier coverage can easily be exploited by a tech savvy and motivated adversary.

Beyond physical barriers, ports could explore the use of acoustic countermeasures to disrupt malicious UUVs. Bubble curtains, for example - commonly used in offshore construction to dampen sound emissions - create dense walls of air bubbles that scatter and attenuate acoustic energy. (The U.S. Navy’s Prairie-Masker radiated noise reduction system, which releases air along a ship’s hull to obscure its acoustic signature from sonar, is an example of bubble curtain tech.) In theory, such a system might degrade acoustic navigation systems by scattering soundwaves transmitted by echosounders, Doppler velocity logs, or obstacle-avoidance sonars. Bubble curtains may also introduce optical turbulence that complicates the operation of underwater cameras and other optical sensors.

Surveillance: The Unblinking Eye

While deterrence measures and physical barriers form the outer layer of port security, underwater surveillance systems provide the means to detect and track intrusions beneath the surface. The most widely deployed technology for this purpose is the intruder detection system (IDS), which uses high-frequency active sonar to detect the presence of divers, SDVs, and increasingly small UUVs. Products such as the Forcys Sentinel, AquaShield from DSIT Solutions, and Norbit’s GuardPoint offer integrated solutions that combine sonar sensors, signal processing software, command-and-control interfaces, and even underwater loudhailers.

These systems are typically arranged as networks of sonar nodes positioned along harbor entrances, piers, and critical infrastructure. Each sonar head scans a defined sector of the underwater environment, with overlapping coverage from multiple sensors allowing operators to detect, classify, localize, and track targets, creating a persistent, real-time, multistatic surveillance perimeter. The Forcys Sentinel IDS integrates passive sonar as well, and can detect divers, AUVs, or SDVs at ranges of up to 1.5 kilometers.

Imaging sonar also plays a role. Many ports conduct routine inspections using high-resolution imaging sonar similar to those used in mine countermeasures (MCM) operations. These surveys establish a baseline map of the seabed and enable operators to detect new objects, such as mines or improvised explosive devices.

Norbit’s GuardPoint solution. Credit: Norbit

Response: The Pointy End of the Spear

If deterrence fails and an intruder is detected, port security must quickly investigate and, if necessary, engage the threat using kinetic or non-kinetic effects.

Non-kinetic effects could involve the use of “soft kill” capture systems to disable threats, such as the Stingray intruder interception net from Oceanetics. This system deploys a rapidly expanding net across the path of an underwater vehicle, entangling and immobilizing it. Other non-kinetic effects could involve activating prepositioned acoustic countermeasures to disrupt or spoof the navigation systems of an inbound UUV.

Kinetic effects could be delivered by interceptor vehicles such as the Skelmir S6 Compact Modular Underwater Effector from Vatn Systems, a small, hard-kill UUV that can be deployed from crewed or uncrewed surface vessels. Or the Leonardo Black Scorpion, a 20kg mini-torpedo that can deliver a 2.8kg warhead from a variety of surface, air, and underwater platforms. For static threats located during seabed survey operations, ROVs such as the VideoRay Defender can be deployed from patrol vessels or dockside launch points to investigate, or in the case of the Atlas Electronic Seafox, provide a single-sortie inspection, identification, and neutralization capability.

VideoRay Defender. Credit: VideoRay

Vatn’s Skelmir S6 Compact Modular Underwater Effector. Credit: Vatn Systems

A layered defense solution featuring Oceanetics’ products, including the Stingray net. Credit: Oceanetics

A Wake-Up Call

The lesson of Novorossiysk is clear: as underwater technologies continue to evolve, so too must the systems designed to protect the ships, infrastructure, and personnel that depend on secure harbors. While coastal facilities have sought to identify and mitigate threats from the air, surface, and cyber domains, the undersea domain is increasingly a viable attack vector as well. Advances in autonomy, navigation, and endurance are democratizing underwater capabilities once limited to major naval powers, making them accessible to a wider range of actors. In an era of proliferating underwater technologies, the next major challenge in maritime security may not come from above the waterline, but from below.