The Q2 2026 TSO Submarine Cables Risk Report

The Quarter That Kept the Board Awake

On April 9, 2026, UK Defence Secretary John Healey stood at Downing Street and revealed that British forces, working with Norway, had spent more than a month tracking three Russian submarines conducting a covert surveillance operation over UK undersea cables and pipelines. Two were specialist vessels from Russia’s Main Directorate of Deep Sea Research. The third, an Akula-class attack submarine, was assessed as a decoy. Healey addressed Putin directly, saying “We see you, we see your activity over our underwater infrastructure.”

For any Transmission System Operator sitting on a board that quarter, that press conference set the tone.

It also framed a picture that had been building for two and a half years. Since October 2023, at least 11 submarine cables in the Baltic Sea have been damaged or cut. NEWNEW POLAR BEAR, YI PENG 3, EAGLE S, and most recently, FITBURG, which Finland’s National Bureau of Investigation confirmed in March 2026 had dragged its anchor across the Elisa cable connecting Finland and Estonia on the last day of 2025. The submarine surveillance revealed in April 2026 was not the start of a threat picture. It was a new phase of one TSOs have been operating inside for years.

What follows is what that data says about the environment TSOs are actually operating in.

The Threat Picture Is Not What the Headlines Suggest

The most operationally significant finding from Q2 is that trawler activity is up.

The UK submarine operation revealed by Healey fits inside this pattern. Small number of high-consequence surveys. Deniable. Timed to periods of international distraction.

What All-Source Detection Caught

The clearest illustration of what CER Directive’s detection requires operationally comes from a single vessel and a single day in Q2.

On May 11, 2026, Windward tracked the tanker SAGA (IMO 9318553), a Russian-flagged product tanker sanctioned by the EU, Switzerland, U.S., Canada, UK, and Ukraine for transporting Russian crude oil and refined products in violation of sanctions, loitering directly above a Mediterranean submarine cable network near Crete. The detection was corroborated by two independent sensor systems roughly seven hours apart: an Electro-Optical (EO) satellite pass at 09:21 UTC and a Synthetic Aperture Radar (SAR) pass at 16:30 UTC. Same vessel. Same position. Same day.

The vessel’s behavior in the months leading up to that observation is what makes the case matter for TSO monitoring. SAGA reflagged to Russia in February 2026 after operating under fraudulent registries, and reissued its MMSI in the process. The reflagging followed a roughly two-month AIS-dark period that began in the Russian EEZ and ended in the Turkish EEZ. Windward has flagged SAGA as High Risk for Border Security since June 26, 2024.

The vessel was engineered to be invisible to AIS-only monitoring. A monitoring posture built on the assumption that AIS transponders can be trusted, or that flag state is a reliable identity signal, or that a vessel’s declared route matches its actual movements, would not have caught this. The fusion of satellite imagery (EO and SAR), sanctions and ownership records, and identity-history tracking is what surfaced it.

The EU Action Plan on Cable Security references this capability — detecting abnormal vessel behavior when AIS is off or spoofed — as an example of the kind of project Connecting Europe Facility (CEF) Digital funds. The €347 million subsea cable package announced by the European Commission on February 5, 2026 includes €327 million through CEF, supporting operators building the multi-source capability that a case like SAGA demonstrates.

Not every vessel of interest this quarter matched SAGA‘s profile. The most persistent State-of-Concern service vessel by event count was a Chinese-flagged dredger conducting 14 short slow-speed events in Malaysian waters between April and June, each lasting 1.7 to 6.9 hours (33.2 cumulative hours). Frequent, short, geographically fixed events consistent with routine channel maintenance dredging. A lower-intensity risk profile that the same analytical framework correctly identified as maintenance behavior rather than surveillance. The point of a behavioral risk model is not to escalate every anomaly. It is to escalate the right ones.

The Corridors That Matter Most for European TSOs

Two corridors carry the operational weight for European TSOs this quarter, and the data reflects the reality that European interconnector density concentrates there.

The Atlantic recorded 2,599 service-vessel activities in Q2 (27.7% of global total) and 4,694 fishing-vessel activities (19.0%). State-of-Concern service-vessel activity was minimal (6 events, 0.2% of the region). What matters is what surrounds that number. Flag-of-Convenience penetration reached 30.6% for service vessels (794 events), concentrated in Cyprus (295), Panama (261), and San Marino (137) registries. Confirmed trawler activity in the Atlantic reached 912 events, the highest of any region.

The interpretive point for TSO monitoring is that FoC activity is not automatically illicit. It is the vessel population where ownership opacity, identity manipulation, and post-arrival flag changes concentrate. A monitoring posture that stops at the current declared flag will miss the identity-history layer that surfaces vessels of concern within that population. SAGA fits that description precisely.

Outside European corridors, the Pacific carries the broadest combined exposure globally (53.0% of service-vessel activity, 45.3% of fishing-vessel activity, the highest extended-presence rate of any region). China-flagged fishing activity concentrates around Kiribati, Solomon Islands, and Fiji — cable-landing geography relevant to U.S.-connected infrastructure. The Indian Ocean carries the highest State-of-Concern rate for fishing activity (22.2%) and is where nearly all of Iran’s service-vessel State-of-Concern activity concentrates.

The behavioral patterns that appear in the Pacific and Indian Ocean at higher volumes are the same patterns Windward tracked in the Mediterranean and North Atlantic at lower ones.

What This Means for TSOs Inside the CER Window

Q2 2026 tells a story a TSO monitoring posture is now expected to catch, reconstruct, and act on. The CER Directive designations arrived on July 17, 2026, and the notifications reach most operators by mid-August. Ten months to compliance. The framework the EU set out in February 2025 for how a TSO monitoring posture is structured breaks into four stages, and each of them has a Q2 finding attached.

On prevention, trawler activity in the Atlantic and Mediterranean is the single largest operational risk to European interconnector infrastructure. Preventive maintenance planning informed by historical vessel-density data across cable corridors, not just current AIS positions, is what turns accidental-damage exposure into a scheduled resilience investment rather than a reactive repair cycle. ESCA’s June 4 Fishing Liaison Guidelines are the industry-level move in this direction. The TSO-level move is data-informed maintenance planning that draws on years of trawler activity, not months.

On detection, the SAGA case is the working definition of what CER requires. Identifying a vessel of concern near critical infrastructure. Corroborating the detection across multiple independent sensors. Producing the evidence base within a reporting window a member-state authority will accept. That standard is not met by AIS alone. Transponder data remains foundational input, but a posture built on it alone is one a vessel can defeat by switching off its signal, a technique that adversaries have already demonstrated at scale in the Baltic. Multi-sensor fusion is what closes that gap.

On response and repair, the median cable repair time of approximately 40 days is the number that matters most. What a TSO can do in the meantime is post-incident reconstruction. Replaying a vessel’s activity timeline, its identity history, its ownership structure, and any AIS gaps or spoofing patterns across a defined window is what turns a response into evidence-grade reporting that can be shared with authorities and, where relevant, with insurers. The finding that European officials increasingly assess Baltic breaks as accidental matters here. It is the reconstruction, not the initial suspicion, that supports that assessment. The same intelligence tooling supports both attribution of sabotage and confirmation of accident.

On deterrence, the UK’s June 1 legislation and the EU’s €347 million package are the deterrent policy layer. TSOs feed the intelligence that makes deterrent action possible. The May 11 SAGA detection is the template. Sanctioned vessel. Active AIS-manipulation pattern. Corroborated across two independent satellite sensors. Positioned directly over cable infrastructure at a specific time. That is the evidence density that makes a designation, a penalty, or a diplomatic protest actionable.

The Q2 Numbers a TSO Decision-Maker Should Take Away

• 34,081 slow-speed vessel activities tracked in proximity to global submarine cable infrastructure in Q2 2026 (−2.4% vs. Q1).
• Combined State-of-Concern activity down 57.8%, but confirmed High-IUU-risk events up 80.6%. Fewer flagged vessels. Higher-risk composition among those that remain.
• Trawler activity up 11.8% (1,594 confirmed events). Atlantic (912) and Mediterranean (776) carry the concentration.
• Iran’s service-vessel average dwell time doubled (11.1 to 23.3 hours). Fewer, longer events.
• The May 11 SAGA case: a sanctioned Russian-flagged tanker corroborated by EO and SAR over a Mediterranean cable corridor, in a single day. Multi-source detection at the standard CER requires.

Discover How Windward Equips TSOs for CER Compliance