Royal Caribbean's Icon-class ships are the largest cruise ships ever built, each carrying more than 5,600 guests and running systems that rival a small city's. Together with the rest of the 31-ship fleet, the company's shore-side data centers and a growing cloud footprint, they make up one of the most demanding hybrid environments in enterprise security. Today I'm glad to share that Royal Caribbean has selected Astelia for its exposure management program.
Together, we're focused on the vulnerabilities attackers can actually reach.
Why severity alone can't set priorities for a fleet
Frontier AI models can now turn a published CVE into a working exploit in hours, so "hard to exploit" can no longer be taken for granted. Ranking findings by CVSS score, severity or presumed exploitability stops being a reliable guide. Across an environment that spans a fleet of ships, shore sites and cloud environments, the list of findings marked critical is also far too long to work through on severity alone.
One question still holds up: can an attacker actually reach it? For any vulnerable service on a ship, at a shore site or in the cloud, that question has a provable answer, and the answer tells Royal Caribbean's team which exposures to close now and which findings can be set aside, with evidence.
Why scale makes prioritization hard
Royal Caribbean's environment spans ships, shore-side data centers and the cloud, and each part has its own systems, owners and maintenance windows. Protecting the data centers is a top priority for the security team, and the right remediation can differ from one operating system or platform to the next. A network of this size and complexity also produces an enormous volume of scanner findings, many of them rated high or critical. That volume comes with operating at Royal Caribbean's scale, and it makes deciding what to address first the central challenge.
Royal Caribbean's security team set out to make that call with evidence, getting a clear answer for every finding on whether it could actually be reached. They also wanted to bring asset and vulnerability data from several tools into one view, route findings to the right owners automatically, and hand each owner priorities backed by proof, with remediation options that fit their systems.
With hundreds of thousands of assets across the environment, all of this had to happen without mapping anything by hand.
What tipped the evaluation
Royal Caribbean looked at several platforms before choosing Astelia. From our conversations with the team, three things stood out.
Reachability mapped from the live network. Astelia builds a live map of Royal Caribbean's network from read-only integrations with tools the team already runs. Agentic AI works out what each exploit needs to succeed and checks that against the topology, including compensating controls, so every finding comes with evidence, including the full attack path for anything reachable and the exact point where the path breaks for the rest.
Built for on-prem and hybrid environments. Ships and shore-side data centers run heavily on on-prem infrastructure, where many cloud-native tools have limited visibility. Astelia was built for on-prem and hybrid environments and covers the cloud in the same platform, so the team works from one view.
Remediation that eliminates exposure. For each reachable vulnerability, Astelia drives remediation or network mitigation to eliminate the exposure. It lays out an upgrade path where a patch exists, and a network change that closes the attack path where a patch can't ship quickly. Findings go to the right owners through the team's existing ticketing and CMDB workflows.
99.9% out of reach
Astelia's analysis starts with every finding and its CVSS score, then keeps only vulnerabilities that can be exploited remotely. Network analysis narrows those to assets exposed in each attack scenario. Runtime analysis then checks whether the vulnerable service is actually running and listening.
Across Royal Caribbean's environment, more than 99.9% of findings tagged as “high” and “critical” turned out to be unreachable. At this scale, that turns an endless queue into a list the team can act on.
Each finding Astelia sets aside comes with network evidence explaining why it can't be reached. Asset owners get a short list they can verify, with remediation options suited to each system, and the time from discovery to fix gets shorter.
Keeping pace with machine-speed attacks
Royal Caribbean is using Astelia in production today, and our shared goal is for every hour of remediation work to go to an exposure an attacker could actually reach. As the fleet grows, that takes a current, evidence-based picture of reachability across ships, shore sites and the cloud, along with a way to close each real exposure with a patch or a network change before anyone can use it.
Attacks will keep getting faster as frontier AI matures, and manual triage can't keep up with machine-speed attacks. That's why we're adding more autonomous capabilities to Astelia, so new reachable exposures can be found and closed just as quickly, while Royal Caribbean stays in full control of its environment.
We founded Astelia after years of leading Israel's National Red Team, where every operation began with the same question: what can we reach, and where does it lead? Today, we're proud that the same question helps Royal Caribbean and some of the world's most prominent companies defend against the wave of AI-driven breaches.
Book a demo to identify and eliminate reachable vulnerabilities in your environment.
