Mission Area Monitoring: Maintaining Maritime Operational Awareness

In Q2 2026, Windward recorded 3,667 loitering events lasting more than 12 hours above subsea cables, 3,137 prolonged dark activity events involving 2,157 unique cargo ships and tankers over 10,000 DWT, and 171,286 distinct vessels affected by GPS jamming at least once.

None of those figures describe a list of vessels. They describe conditions inside specific stretches of water.

That distinction is the operational problem of 2026. Maritime risk management was built target-first, on the assumption that the dangerous vessels could be named in advance and then watched. Mission responsibility does not work that way. A naval force is accountable for a transit corridor. A cable operator is accountable for a protection zone. A coastal state is accountable for an exclusive economic zone. A commodity trader is accountable for flows through a set of terminals. In every case, the boundary is fixed, and the traffic inside it is not chosen.

The requirement that follows is control of that boundary. Not visibility into it, and not periodic reporting on it. Control means the organization defines the area, selects the sensors it demands, sees everything operating inside it continuously, and adjusts the boundary as the mission moves. Nobody else decides what the operational team is permitted to see.

Sustaining that level of control across open ocean has historically been hard to justify. That has changed, and the gap between organizations working area-first and organizations still working from target lists is widening quarter by quarter.

Maritime Risk Is Located, Not Listed

GPS jamming is an area condition. Vessels do not carry it with them. They enter regions where positioning is being manipulated, and their reported position stops corresponding to their actual one. Since Operation Epic Fury began on February 28, 2026, Windward has detected 3.35 million false ship-to-ship meetings globally, in which spoofed positions made vessels appear to rendezvous when no meeting took place. Spoofing peaked on March 20 at 356,773 false meetings in a single day. Any organization screening vessels rather than watching water inherits that distortion without seeing it.

Dark activity is a gap in a place. The 3,137 prolonged dark activity events recorded in Q2 represent a sevenfold increase over the 451 events recorded in Q1. One in four extended events took place off Saudi Arabia, Oman, Iran, or the UAE. A prolonged dark period is a window during which the vessel stopped self-reporting, and it is only meaningful in relation to where the vessel was when the reporting stopped.

Identity manipulation dissolves the list itself. Some 275 internationally trading tankers were broadcasting the flag of a fraudulent registry in Q2, across 22 fraudulent registries Windward has now identified. Around 90% of tankers using fraudulent registries were Western-sanctioned. When declared identity is unreliable for a growing share of the fleet, a monitoring approach organized around declared identity degrades in step.

The common structure is that the risk sits in the area and the identity is negotiable. 

A target list is only as good as the naming that produced it, and adversaries control the naming. Nobody controls the water except the organization responsible for it.

Target Lists Answered a Constraint That Has Since Eased

Maritime organizations did not choose target lists over area coverage arbitrarily. They chose them because sustained coverage of the open ocean was difficult to justify at scale.

Land and air domains support fixed collection infrastructure. The ocean largely does not. Tasked satellite imagery was expensive enough that it was generally reserved for named vessels of interest, which meant collection had to be requested, justified, and weighed against competing priorities. The layer that was continuous and global, AIS, is cooperative by design. It reports what the vessel chooses to report, and any operator with a reason to stay unseen has always been able to opt out.

Working from watchlists, screening counterparties, and querying individual vessels when a question arose was a reasonable response to those conditions. It worked while its assumptions were true: vessels broadcast honestly for the most part, declared identity usually matched actual identity, and single-source coverage produced pictures adequate to the questions organizations were asking.

Both sides of that equation have moved. The assumptions have weakened, as the concealment figures above show. At the same time, denser satellite constellations, radio frequency detections, and behavioral models trained on more than a decade of global maritime activity have made sustained coverage of a defined area considerably more practical than it was even a few years ago. The tradeoff that made target lists the sensible default has shifted.

The Same Failure in Three Different Waters

The organizations facing this environment differ completely in mandate, register, and consequence. The requirement underneath is identical.

A Naval Force Cannot Query Its Way Backward

The Somali piracy resurgence has produced the highest attack tempo since 2013. At least 15 attacks have been logged in 2026, with eight occurring since May. Six commercial vessels have been hijacked since April 21, 2026, and attacks are occurring increasingly far from the Somali coastline.

The reason for the extended reach is the analytical center of the case. SWARD (IMO 8324713), hijacked on April 26, 2026, has been dark on AIS since seizure. It was last observed underway towing a small vessel, a signature consistent with hijacked commercial tonnage being used to stage attacks further offshore than skiff-based operations permit.

That finding changes what the vessel is. SWARD stopped being a victim and became infrastructure. No screening process produces that conclusion, because SWARD is not a suspicious vessel by any list-based measure. It is a hijacked cement carrier. The finding exists only because the corridor was under continuous coverage across months, with AIS gaps cross-referenced against satellite imagery, radio frequency emissions, and prior activity baselines.

A query run at the moment of the next hijacking cannot recover this. The mothership was operating dark for weeks before it mattered, and there was no name to query. Continuous coverage of the corridor holds the observation until it becomes actionable. Request-based collection does not, because nobody knew to request it.

A Cable Operator Has No Watchlist to Work From

Subsea infrastructure protection is the clearest commercial case, because the operator starts with no list at all.

Windward recorded 3,667 loitering events exceeding 12 hours above subsea cables in Q2 2026, involving 2,206 cargo and tanker vessels. The Red Sea and Gulf of Aden alone accounted for 784 events, 21% of the total and nearly double the next-largest zone. Almost all of that activity is legitimate. A trawler working its traditional grounds and a vessel conducting a route survey can look identical in a single snapshot.

In August 2026, two of Australia’s subsea internet cables, Indigo West and Indigo Central, were damaged inside the Submarine Cable Protection Zone off Perth.

The vessel whose activity intersected that window had entered Australia’s Exclusive Economic Zone on July 28, 2026, and anchored off Perth for nearly two weeks. On July 31, it altered its declared ETA to a January 2027 placeholder value, typical of vessels with no genuine port call intent. Through August 8 and 9, its track showed repeated erratic crossings over the cable corridor. 

Any single one of those signals has an innocent explanation. Anchoring is routine. ETA fields are frequently inaccurate. A vessel crossing a cable corridor is crossing a line on a chart that thousands of vessels cross every day. What produced the picture was the accumulation of independent observations against the same hull inside the same boundary over a defined period, with imagery confirming position when the reported track alone would not have carried the weight.

The operator did not need to know which vessel to watch. The zone was the mission, and the zone was covered.

A Chokepoint Picture Breaks Exactly Where It Matters

Hormuz is the case where both audiences share the same problem.

AIS-visible monthly transits through the Strait totaled 3,750 ships in February 2026, then fell to 450 in March, 630 in April, 450 in May, and 640 in June. June transits ran at roughly one-sixth of pre-war traffic. The quarter ended with the Strait split into two politically controlled corridors, a permissions-based northern route through Iranian waters and a U.S.-supported southern corridor through Omani waters. Many vessels are transiting with AIS turned off, in some cases with owner and flag state consent for security reasons.

The analytical difficulty is structural. A vessel approaches from the Arabian Gulf, disables AIS as it enters the chokepoint, and resumes broadcasting in the Gulf of Oman after transit. The dark window is precisely the period when identity, position, direction, and cargo matter most. The picture fails at the point of maximum consequence, and it fails for the naval planner assessing corridor security and the trader pricing a cargo at the same moment, for the same reason.

Continuous coverage of the chokepoint closes that window from the outside, drawing on whatever the area requires rather than whatever happens to be broadcasting. Pre-transit AIS establishes who entered. Through the dark period, imagery, radio frequency emissions, open-source reporting, terminal and port activity, ownership and commercial records, and the organization’s own data all remain available, and any source that answers a question the others cannot is a source worth pulling into the picture. Behavioral history sets what normal looks like for that hull on that route, so a transit that deviates registers as a deviation rather than a gap. The mission determines the collection, not the reverse. The output is a transit picture assembled while the transit is happening rather than reconstructed afterward.

The Same Structure Holds Across Other Missions

The pattern repeats wherever an organization owns an area rather than a list. Gray-zone monitoring in the Baltic and the South China Sea requires distinguishing between commercial and state-directed behavior inside the same waters, with Ukraine now classifying more than 700 Russia-trading tankers as military-affiliated assets. Sanctions and shadow fleet exposure shifts continuously rather than at review cycles, and Windward’s tracked dark fleet expanded to 2,186 vessels in Q2, of which 1,106 are sanctioned. Commodity flow analysis depends on watching origin terminals, transit corridors, and destination behavior together rather than querying any one of them.

Different mandates. An identical requirement.

All-Source Coverage Is What Makes the Area Legible

Continuous coverage of an area only produces intelligence if the collection is resilient to the manipulation happening inside it.

Every mission above breaks on a single-source picture. The naval case breaks because the mothership is dark. The cable case breaks because AIS alone cannot confirm a vessel was on the route rather than near it. The chokepoint case breaks because AIS is switched off during the transit. Each failure is a single-source failure, and in each case a different sensor covers the gap.

Fusing AIS, satellite imagery, radio frequency signals, digital presence signals, open-source reporting, behavioral history, the organization’s own data, and any additional sources required into one continuously updated picture means a gap in any single source is not a gap in the operational picture. In an environment where 171,286 vessels were jammed at least once in a single quarter, that redundancy is the difference between an area you are monitoring and an area you actually control.

What Control of a Mission Area Requires

Four characteristics separate this from the static, single-source monitoring of the past decade.

Collection is organized around the mission, not around fixed coordinates. The operational team defines the area and changes it as the mission changes. A naval force extends a corridor. A cable operator adds a protection zone. A trader adjusts a terminal portfolio. None of that should require a rebuild or a new procurement.

Historical baseline is present from day one. A mission area is not a fresh slate. Assessing whether activity is anomalous requires knowing what normal looks like for that water and that vessel class, which means historical coverage has to arrive with the first day of monitoring rather than accumulating over the following year.

Collection is persistent and does not require a specialist to operate. Coverage builds continuously across every source in the mission, correlated as it arrives, with no manual request cycle. Organizations should not have to staff a collection management function to keep their own monitoring running.

Coverage is all-source by default. Every available sensor and any additional source the mission requires, including the organization’s own data, feed one picture rather than several that have to be reconciled by hand.

Mission Area Monitoring

Windward’s Mission Area Monitoring is built to these requirements. All-source data fusion across AIS, satellite imagery, radio frequency signals, digital presence, open-source intelligence, and customer-supplied data through the platform’s bring-your-own-data architecture. Mission-based collection that adapts as priorities move. Continuous correlated output, delivered within hours of collection, without specialist collection expertise. Historical context included from the first day of coverage.

For naval forces, coastal states, cable operators, chokepoint monitors, compliance functions, and commercial trade teams, the architecture is the same and the mission scope is not. That is the point. The area is whatever the organization is responsible for, and the sensors are whatever that area demands.

See What Continuous Coverage of Your Mission Area Delivers