## 5 Results and Discussion
### RQ1: What Cyber-Attacks in the MSCN Have Been Reported in the Academic Literature?
#### 5.1.3 Taxonomy  
To improve the comprehension of cyber-attacks in the MSCN, we created a classification system using 110 research publications. This taxonomy specifically focuses on the distinct issues faced by the maritime sector in contrast to more general cyber threats. A taxonomy, as defined by ref. [88], systematically classifies concepts and, in this context, categorizes cyber-attacks according to various distinct factors (Figure 7). Our taxonomy includes seven key factors: (1) the hacker group, (2) the type of attack, (3) compromised elements of the availability, integrity, and confidentiality (AIC) triad, (4) the affected MSCN agent, (5) systems and technologies affected, (6) geopolitical impact, and (7) potential consequences. Each factor aids in understanding the nuances of cyber-attacks specific to the maritime industry. Hacker group: Research identifies a range of potential adversaries, including criminals, terrorists, hacktivists, competitors, and state actors, each with distinct motivations, ranging from financial gain to geopolitical influence [7; 89]. Type of attack: Attacks vary from untargeted attacks exploiting common vulnerabilities to targeted, sophisticated attacks aimed at specific entities within the supply chain [90; 91]. AIC triad compromise: This classification focuses on threats to data availability, integrity, and confidentiality, which are essential for maintaining operational trust and security across maritime systems [49; 62]. Affected agents: This taxonomy identifies which MSCN agents are impacted, including freight forwarders, shipping lines, and port terminal operators, to tailor cybersecurity measures accordingly. Systems and technologies affected: This study examined the impact on navigation, communication, and control systems within the MSCN. Special attention is given to systems such as satellite communications and terminal operating systems, which are integral to all maritime actors [69; 92]. Geopolitical impact: Cyber-attacks are categorized by their scope (local, national, or international), highlighting the breadth of their impact and the scale of required response measures [16]. Figure 7: Cyber-attack Taxonomy for the MSCN. Potential consequences: The taxonomy explores the broad consequences of attacks, ranging from ecological harm to financial setbacks and loss of human life, emphasizing the urgent requirement for strong defenses [93]. While our proposed taxonomy is customized to address the specific challenges of the maritime sector, we acknowledge that it is not the only possible approach for categorizing cyber risks. Other frameworks, such as the MITRE ATT&CK framework, focus primarily on attack techniques and the specific tactics and procedures used by attackers. This framework provides a valuable and technical breakdown of the methods used in cyber-attacks, offering deep insights into specific tactics [94]. However, it does not fully address the multi-dimensional risks in the MSCN, such as geopolitical considerations and the operational impacts on maritime agents. Incident-based taxonomies, such as the one presented in ref. [7], provide insights into real-world cyber-attacks affecting onboard systems, ports, and communication infrastructures, offering a historical perspective by categorizing incidents based on the system affected. Similarly, the work in ref. [50] focuses on technological vulnerabilities that are integrated into technologies in the maritime sector, highlighting technical risks. However, both approaches share common limitations: they fail to capture the broader geopolitical dimensions, hacker group motivations, and global consequences of cyber-risks--key elements necessary for understanding and mitigating the full scope of risks in the MSCN.