Report

How AI is Transforming Maritime Security in APAC

Request a demo

APAC’s Emerging Threats

Real-time intelligence to stay ahead of emerging threats is critical for government and security agencies in the Asia-Pacific (APAC) region. With thousands of kilometers of coastline, critical sea lanes, and vast exclusive economic zones (EEZs), APAC countries have always been under pressure to safeguard their maritime domains.

Things have gotten more challenging due to rising geopolitical tensions – including the great power competition and illegal, unreported, and unregulated (IUU) fishing – the growing threat to critical undersea infrastructure, and illicit smuggling operations.

National security agencies and maritime authorities require precise, real-time intelligence to stay ahead of emerging threats.

This report presents a series of brief, real-world case studies demonstrating how Windward’s Maritime AI™ platform facilitates maritime security in APAC. It is organized into three key sections:

Proactive threat identification – Windward Early Detection uncovers suspicious patterns and behaviors before they escalate into incidents.
Protection of critical infrastructure – Windward helps monitor and secure vital undersea assets, including data cables, energy pipelines, and offshore facilities.
Smuggling detection and prevention – authorities use the platform to expose and interdict illegal activities, from contraband trafficking, to fuel smuggling.

Identifying Emerging Maritime Threats and Geopolitical Trends

By harnessing advanced machine learning, behavioral analytics, and deep maritime domain expertise, Windward provides actionable insights that empower APAC authorities to detect risks earlier, respond faster, and protect their sovereignty more effectively.

Early Detection is a proactive intelligence tool designed to surface anomalous maritime behaviors in near-real time, even when the vessel has no previous risk history.

Unlike traditional risk scoring methods that rely heavily on past behavior, Early Detection uses the AI algorithm to identify emerging threats, smuggling attempts, or deceptive practices as they occur. This empowers analysts and enforcement units to act earlier, increasing the chances of interdiction and successful outcomes.

Early Detection monitors global maritime traffic continuously and detects vessels exhibiting behavioral red flags, such as:

AIS gaps or manipulation
Suspicious rise of loitering or drifting activities
Unusual port call patterns
Transshipment activity in high-risk zones

These behaviors are assessed and prioritized based on threat relevance, ensuring that analysts focus on what matters most.

How It Works for APAC

Windward Early Detection supports authorities in identifying emerging maritime threats before they escalate. Rather than relying solely on static watchlists or manual monitoring, the system continuously analyzes vessel behavior across regions, detecting anomalies such as dark activity, ship-to-ship (STS) meetings, or slow-speed sailing.

Filters embedded into the solution allow users to select the anomalies they care about, based on location, type of activity, or specific vessel indicators.

There have been 39 behavioral anomalies in the South China Sea, the Philippine Sea, and the Bay of Bengal (see the image below) over a 30-day period (March 27-April 27, 2025).

apac — *Behavioral anomalies by area. Source: Windward Early Detection.*

A different approach is to look for anomalies conducted by vessel populations of interest. The image below shows 276 anomalies conducted by Chinese-flagged or Chinese-owned vessels globally.

*Behavioral anomalies by Chinese-owned/flagged vessels. Source: Windward Early Detection.*

Each anomaly spotlights a deviation from the expected baseline that could be a one-off reaction to an event or disruption, or, possibly, indicate an emerging trend or threat. A cluster of anomalies often tells a bigger story about something brewing in the maritime or geopolitical arena.

Let’s dive in…

Case Study #1: the Strengthened China-Iran Relationship Affects APAC

China and Iran have significantly deepened their trade and geopolitical ties, leveraging mutual interests to counterbalance Western influence and sanctions. China remains Iran’s primary trading partner, with bilateral non-oil trade reaching $34.1 billion between March 2024 and March 2025. Iranian oil exports to China have surged, with March 2025 imports exceeding 1.8 million barrels per day, accounting for 16% of China’s seaborne crude imports.

The two nations have strengthened their strategic partnership, exemplified by the 25-year cooperation agreement signed in 2021, encompassing investments in Iran’s energy and infrastructure sectors. Military ties have also expanded, with China allegedly supplying missile components to Iran, enhancing its ballistic missile capabilities. Joint naval exercises with Russia in the Gulf of Oman further demonstrate their growing military cooperation.

The maritime route between Iran and China inevitably passes through the EEZs of many countries in APAC. It is within these waters that we can detect and learn about the behavioral trademarks of the Iran-China relationship.

Iran-Affiliated Vessels Conducting Meetings in Indonesia and India

There was a 153% increase in vessel meetings in Indonesian waters between March 9-16, 2025, with 11 vessels conducting meetings with other ships, compared to the expected baseline of 4-5 vessels. The vessels involved are specifically identified as being affiliated with the Iranian regime.

*Risky Iran-affiliated vessels with Iran sanctions compliance risks conducting ship-to-ship meetings in Indonesia’s EEZ. Source: Windward Early Detection.*

This surge in activity appears to be a direct response to the U.S. administration’s March 6 announcement of plans to halt and inspect Iranian oil tankers. The timing and location of these meetings suggest Iranian vessels are likely conducting ship-to-ship transfers or other activities to preempt the announced enforcement actions targeting Iranian oil tankers.

Indonesian waters were a hub of activity in the weeks leading up to this anomaly. There was a 278% increase in the presence of Russian-affiliated vessels in Indonesia’s EEZ (Madura Straits) and a 30% rise in visits by Chinese-affiliated vessels (Karimata Straits).

Indonesia is located between the two largest countries being targeted for sanctions – Iran and the Russian East Coast – and the largest consumer of their products, China. This makes its waters a perfect spot for vessels from both sides to engage in transshipments to blur the origins of the sanctioned commodities.

Iranian-Flagged Vessels in Singapore

An unusual surge in Iranian-flagged vessels was detected in Singapore’s EEZ from March 30 to April 6, 2025. Twenty vessels were observed compared to the expected average of 11 vessels – an 88% increase. Most of the vessels were heading west, with most reporting China as their previous destination.

This increase also appears linked to the intensification of Iran’s operations, as vessels seek alternative routes and transfer locations following increased scrutiny of Iranian oil shipments. Like Indonesia, the Singapore area has also become a key hub for ship-to-ship transfers of Iranian oil, particularly as traditional routes face growing enforcement actions.

*Iranian-flagged vessels conducting area visits in Singapore’s EEZ. Source: Windward Early Detection.*

*The Iranian-flagged vessels sailing towards Iran from China, through Singapore. Source: Windward Early Detection.*

Critical Maritime Infrastructure

Submarine cables, gas pipelines, and offshore energy infrastructure are not just economic assets – they are potential targets for espionage and sabotage.

To prevent such events, authorities must detect vessels exhibiting suspicious behavior near critical infrastructure, such as hovering, loitering, or slow-speed sailing. These behaviors, especially when combined with AIS gaps or route manipulation, may indicate unauthorized surveillance, mapping, or even preparation for interference.

The South China Sea is one of the world’s busiest maritime regions, with numerous commercial, cargo, and military vessels traversing its waters daily. This increases the likelihood of incidents involving undersea cables, whether deliberate or unintentional.

Many vessels suspected of causing damage are registered in foreign territories, complicating investigations and providing plausible deniability to state actors. This makes accountability challenging. In a single day (April 15, 2025), 18,840 vessels conducted slow-speed sailing that lasted more than two hours in the South China Sea!

*Slow-speed sailing for over two hours in the South China Sea on April 15, 2025. Source: Windward Maritime AI™ Platform.*

But when narrowing the search to vessels sailing above a specific cable – in this case, the Sistem Kabel Rakyat 1Malaydia (SKR1M), a submarine fiber optic cable system designed to enhance connectivity between Peninsular Malaysia and East Malaysia – only 22 vessels are identified (in a seven-day period).

*Vessels conducting slow-speed sailing above the cable (April 8-15, 2025). Source: Windward Maritime AI™ platform.*

Our technology automatically detects vessels conducting prolonged loitering over undersea cables, or hovering above it in a suspicious manner, and cross-references the vessel’s activity with its characteristics (vessel type, ownership, risk indicators, and past behavior). This critical infrastructure monitoring transforms agencies and organizations from reactive to proactive regarding their maritime and critical infrastructure security.

Case Study #2: Chinese-Flagged Vessels Loiter Near Undersea Cables

Research and survey vessels are specialized ships designed to collect data from the ocean or seafloor. They often conduct legitimate subsea infrastructure inspections and geophysical/geological surveys – they sail slowly and in deliberate patterns, in specific locations.

But not all research/survey vessels carry out legitimate operations. Some vessels operate under the guise of being research ships to conduct mapping operations of undersea cables. The way to distinguish between a legitimate research or survey operation and a suspect one is by asking three questions:

What is the vessel doing?
Where is it doing it?
What exactly is this vessel?

A Chinese-flagged research/survey vessel was observed in September 2024 performing a series of deliberate turns and maneuvers directly above the route of the Pacific Light Cable Network (PLCN) – one of the critical trans-Pacific submarine cable systems.

*Chinese research vessel performing sharp turns and survey-like maneuvers directly over the route of the Pacific Light Cable Network (PLCN). Source: Windward Maritime AI™ platform.*

The vessel’s classification as a research/survey vessel and its pattern of repetitive track deviations over sensitive infrastructure raises concerns about potential undersea mapping, surveillance, or cable-interference activity.

The vessel’s behavior is buttressed by its profile – the vessel is owned and managed by the Chinese government and has made a significant number of visits to military areas in the South China Sea.

The vessel appears to be a government-owned and operated research/survey vessel with a focus on the South China Sea region, potentially conducting activities related to China’s military and maritime interests in the area.

Another Chinese-flagged research/survey vessel – with no direct affiliation to the Chinese government, but with a history of dark activities in the South China Sea Shoal area and visits to military areas – was spotted engaging in questionable activities over critical undersea infrastructure.

*A Chinese research vessel conducting mapping activity over a cable. Source: Windward Maritime AI™ platform.*

The vessel was mentioned in news articles due to unauthorized entry into Palau’s EEZ in May, 2023. The vessel entered Palau’s waters without permission or notifying the Palau government. This incident raised concerns about unauthorized research and questionable activities in the region’s waters.

DSP — *Another Chinese research vessel conducting mapping activity over a cable.*
*Source: Windward Maritime AI™ platform.*

Smuggling and Deceptive Shipping Practices

The effective mitigation of smuggling attempts involves two main challenges: prioritizing high-risk vessels across an endless sea of traffic and identifying commonly used behavioral patterns to identify targets for tracking and monitoring.

The image below shows all vessels flagged by Windward’s AI models as high border security risk due to various behavioral indicators: identity and location manipulation, multiple identity changes, and dark activity, to name a few. Two thousand and five (2,005) vessels are marked as high risk worldwide. The image below shows the ones currently sailing in and around APAC. Fifty-two (52) are reporting their destination as Singapore.

*High-risk vessels and their current locations as of April 14, 2025. Source: Windward Maritime AI™ platform.*

The image below shows another search refinement. Only vessels that have conducted a port call in China in the past 30 days and then went dark are shown. Eleven vessels engaged in this sequence.

China port calls, then went dark — *11 high-risk vessels that conducted port calls in China and then went dark in the past 30 days, as of April 14, 2025. Source: Windward Maritime AI™ platform.*

Case Study #3: Illicit Oil Transfers in East Asia

Philippine authorities have uncovered multiple cases of illicit oil smuggling in recent years involving tanker vessels that load petroleum products in Taiwan and then offload them covertly at sea to other vessels, often very close to EEZs borders. These operations frequently involve dark activity to conceal part of the voyage and the transfer location.

Windward can be used to identify vessels conducting this known pattern. The image below shows a Palau-flagged moderate risk tanker vessel departing from Taiwan and going dark right as it enters South Korea’s EEZ.

*The tanker going dark right as it crosses into South Korea following a visit to Taiwan. Source: Windward Maritime AI™ platform.*

The vessel remains dark for nine hours and reappears again right as it exits South Korea’s waters. The vessel remained untracked during this time, when any number of events could have taken place, such as a ship-to-ship transfer. Following the dark activity period, the vessel returned to Taiwan without reporting any cargo offload.

This behavioral pattern, tankers with dark activity and suspicious STS behavior, is a common modus operandi for oil products or crude oil smuggling. Common red flags in such cases include the following behaviors after lading at Taiwanese oil terminals:

Entering EEZs of nearby nations without port calls
Prolonged dark activity near known STS corridors
Returning to the origin port without full voyage disclosure

A search for this pattern in the past 60 days reveals it has been performed by three additional tankers. One of these, a moderate-risk vessel, performed the pattern twenty different times.

Case Study #4: A Chinese Fishing Vessel Raises Concern

Over 1,500 Chinese-flagged fishing vessels exhibited a series of suspicious behaviors that raised concern about their intent and transparency. A search for such vessels conducting a port call in China and then beginning a period of dark activity in South Korea’s EEZ shows this to be a prevalent pattern of operation – with most vessels performing it multiple times. One vessel exemplifies this pattern.

Dark Activity in the Korean EEZ

After departing Chinese waters, one fishing vessel crossed into South Korea’s EEZ and soon after, turned off its AIS transponder, going dark and evading tracking. The vessel did so on four separate occasions during the time in question, with the longest period being eight days.

Operating in foreign EEZs while dark is highly suspicious, as this behavior is often associated with illegal fishing, sanctions evasion, or unreported transshipment. The duration and location of the dark period suggest that the vessel intentionally concealed its presence in a sensitive maritime zone.

*The fishing vessel going dark in South Korea’s EEZ (the yellow triangles indicate the start and end of its dark activity). Source: Windward Maritime AI™ platform.*

Port Calls in Lvsi Harbor

Before crossing into South Korea’s EEZ and going dark, the vessel called port at Lvsi Harbor, located in Jiangsu Province, China.

Although officially designated a fishing port, Lvsi has been linked to operations involving China’s distant-water fishing fleet (DWF) and potentially dual-use maritime assets. The port’s infrastructure and proximity to naval development zones increase the risk profile of vessels departing from it – particularly those that then conduct concealed activity abroad.

*The fishing vessel departing from Lusi Fishing Port. Source: Windward Maritime AI™ platform.*

Identity Manipulation

On April 11, 2025, one day after its last dark activity, the vessel changed its name (it has been alternating between three names for years, sometimes going back and forth in a matter of hours) and size (from 228m to 32m). It also gained beneficial and registered owners, both Chinese companies.

Frequent or unexplained identity changes are of course associated with deceptive or covert activity, such as masking IUU fishing behavior, avoiding enforcement actions, and misrepresenting vessel ownership or flag state.

4 Key Takeaways

The Asia-Pacific maritime domain is undergoing profound transformation, marked by threats ranging from state-linked vessel behavior and illicit oil transfers, to sabotage of critical undersea infrastructure.

As demonstrated across multiple case studies, these activities are no longer isolated incidents, but often part of broader geopolitical patterns — with Chinese, Iranian, and Russian-linked vessels repeatedly engaging in deceptive behaviors across the region.

Windward’s platform is instrumental for surfacing these trends before they escalate into operational or strategic threats. By detecting early behavioral anomalies — such as AIS manipulation, dark activity, unauthorized ship-to-ship transfers, or loitering over sensitive areas — Windward equips APAC authorities with a predictive lens into maritime activity that would otherwise go unnoticed until damage is done.

This transformation from reactive enforcement to predictive intelligence is a game-changer. The key takeaways from this report include:

Proactive threat identification: Early Detection empowers agencies to focus attention on emerging threats in real time, even when vessels have no prior risk history.
Smuggling disruption: repeated patterns of illegal transshipment, oil smuggling, and IUU fishing are revealed through behavioral analytics, aiding interdiction and policy enforcement.
Infrastructure protection: critical subsea assets, such as fiber optic cables and energy pipelines, can now be continuously monitored for potentially hostile activity – closing the gap between awareness and response.
Vessel profiling: risk doesn’t always reside in behavior alone, but in who is behaving that way. Windward’s ability to layer vessel ownership, history, and affiliations onto real-time behavior enables deeper context and prioritization.

Predictive intelligence and real-time early detection are not just nice-to-haves in APAC, they are foundational capabilities for governments and maritime stakeholders seeking to defend sovereignty, uphold law, and mitigate risk in some of the world’s most contested waters.

Request a demo