1. Introduction
Digitally-driven changes in maritime logistics have created a network of modernized ports, referred to as ‘smart ports’, that harness the Internet of Things (IoT), big data, artificial intelligence (AI) and automation to optimise port operations, and improve safety and sustainability. Considering that roughly 80% of global trade by volume is transported by sea, ports are pivotal to the economy and their cyber functionality (or lack thereof) has macroeconomic implications (UNCTAD, 2023). However, the interoperability of operational technology (OT) with information technology (IT) in terminals, vessel–shore interfaces and in the hinterland network allows for the rapid expansion of the ‘attack surface’, increasing the risk of operational disruption, data destruction and leakages, and downstream physical damages. Compilations of past incidents, and port-focused threat and mitigation guidance documents also exemplify these weaknesses (ENISA, 2019; Senarak, Reference Senarak2024).
Digital transformation remains a fundamental activity within the logistics sector and has subsequently developed the concept of the ‘smart port’, as part of the Port 4.0 framework. Technologies such as IoT connected devices, automation, AI and big data are enabling more effective, efficient and sustainable cargo handling and operational activities within ports (Belmoukari et al., Reference Belmoukari, Audy and Forget2023). The evolution of port facilities to the ‘smart port’ model is as a result of globalisation, the environment, competitive pressures and the demand for integration of supply chains. The ‘smart port’ is defined (rather broadly, given the varying levels of digital sophistication and automation within ports) as a ‘highly digitalised, connected and automated port’ which has cultivated a ‘smart’ infrastructure, data systems and personnel to enhance efficiency and service, meet customer expectations, and improve the port’s environmental performance. The smart port is, to put it succinctly, a digital integration of diverse business units – operations, energy, environment, safety and security, amongst others – and provides real-time data to all stakeholders to facilitate the intelligent management of port operations. The digital integration of activities means that smart ports are designed to exceed the efficiencies and customer orientation of a traditional port, while also being safer and more sustainable (Belmoukari et al., Reference Belmoukari, Audy and Forget2023).
Port operations are undergoing a major digital transformation, with all the potential rewards and the new cyber vulnerabilities (Bolbot et al., Reference Bolbot, Kulkarni, Brunou, Valdez Banda and Musharraf2022; Razmjooei et al., Reference Razmjooei, Alimohammadlou, Kordshouli and Askarifar2023; Sharma et al., Reference Sharma, Mittal, Sekhar, Shah and Renz2023; Peng et al., Reference Peng, Xie, Claramunt, Lu, Gong and Yan2025). New smart ports with cyber–physical systems, i.e. the integration and interaction of inside operational technology (OT) and traditional IT systems, can lead to new possible couplings of cyber and physical systems (Tombak et al., Reference Tombak, Zetterman and Tapaninen2025). New cyber–physical systems, including control technology (e.g. cranes, gates*, and terminal operating systems power grids), lead to the potential for an expanded attack surface to cyber intrusions, ransomware, unauthorised remote control, malware and distributed denial-of-service (DDoS) attacks. Assessment and digital exploitation recently show ports still face a myriad of potential ransomware risks/losses in operational port control systems (DDoS) and other cyber-infected breaches (Tombak et al., Reference Tombak, Zetterman and Tapaninen2025). All these cyber incidents threaten port design and operational control systems, and can have real, tangible and costly consequences. A successful attack could lead to safety risks and prolonged disruptions in international supply chains due to the incapacity to handle cargo and the loss of essential services at ports (Li et al., Reference Li, Zhou, Chattopadhyay and Goh2024). Ports as gateways to international trade, and handling an estimated 80% of trade by volume and with the capacity of translating losses to other sectors of the economy, they can cause cyber disruptions in connected transportation systems (Adams et al., Reference Adams, Chisnall, Pickering, Schauer, Company Peris and Papagiannopoulos2021). This has resulted in the industry raising concerns and calls for the expected situation to be countered with the expected situation in mind (e.g. purposeful preparation). Completely overlooking the possibility of underdeveloped sectors affecting the overall architecture of the value chain, industry analysts have highlighted the need to ‘raise awareness’ of issues in port cybersecurity, as these issues have been, and continue to be, relatively underappreciated with regards to their potential impact. In sum, the increase in the ‘smart’ and interlinked nature of the ports also increases the likelihood of more sophisticated cyber attacks in terms of the overall digital and physical security of the ports.
The policy settings and their accompanying frameworks have also shifted in response to these changes, with the international maritime organisation (IMO), in the Guidelines on Maritime Cyber Risk Management (MSC FAL.1/Circ.3/Rev.3, 2025), reiterating the need for ongoing, risk-based and sustainable targeted policies, in line with the ISM Code. Within the NIS2 Directive (Directive EU 2022/2555), the Introductory Chapter, the European Union aims to add more comprehensive and stringent cyber security policies to the ‘Essential’ as well as the ‘Important’ entities, and ports in particular. In the USA, USCG NVIC 01-20 recommends how facilities regulated by the Maritime Transportation Security Act (MTSA) should evaluate and mitigate cyber risks within their facility security assessments and plans as part of their guidance (IMO, 2025; European Union, 2022; U.S. Coast Guard, 2020). In combination, these regulations provide the minimum threshold requirements for governance, reporting and security, and the adoption of other technical and organisational measures, within and throughout the port ecosystem.
Concurrently, the academic literature has expanded significantly. Recent studies offer overviews of the maritime cybersecurity domain, while also acknowledging the need for more detailed studies of vulnerabilities and defences for smart ports (Bolbot et al., Reference Bolbot, Kulkarni, Brunou, Valdez Banda and Musharraf2022; Peng et al., Reference Peng, Xie, Claramunt, Lu, Gong and Yan2025). More general bibliometric studies in the field of cybersecurity and digital forensics also recognise the importance of intrusion detection, threat intelligence and governance in guiding the direction of research, and are hence important for shaping the documents in the field (Sharma et al., Reference Sharma, Mittal, Sekhar, Shah and Renz2023). Within the context of maritime digitalisation, the social and technical aspects of the digital transformation of ports and the resulting changes in the exposure to potential cyber risks has also been the focus of scholars (Kechagias et al., Reference Kechagias, Chatzistelios, Papadopoulos and Apostolou2022). However, despite the increasing interest in smart port cybersecurity, no bibliometric study to date has examined the publications, the collaborative networks and the field’s bankruptcy.
In the context of the development of cyber port security systems, the fields of computer science, marine engineering, logistics, risk management and public policy, all contribute to a growing area of research that has quickly gained popularity. Studies have examined intrusion detection and network defence in port settings, cyber-risk assessment for operational technology/industrial control systems (OT/ICS), governance and compliance regimes, and the use of AI/ML for anomaly detection. Prior bibliometric overviews map parts of the maritime cybersecurity landscape (Bolbot et al., Reference Bolbot, Kulkarni, Brunou, Valdez Banda and Musharraf2022; Razmjooei et al., Reference Razmjooei, Alimohammadlou, Kordshouli and Askarifar2023; Peng et al., Reference Peng, Xie, Claramunt, Lu, Gong and Yan2025) and document rising attention to cyber forensics and security analytics (Sharma et al., Reference Sharma, Mittal, Sekhar, Shah and Renz2023). Additionally, a recent bibliometric study of maritime cybersecurity literature (covering both ships and ports) found that while the field is ‘undergoing significant development’, the bulk of publications cluster around a few technical themes and originate from a handful of regions. The same study observed that the topic has ‘not yet received adequate attention’ given the importance of the subject, indicating a need for broader and deeper investigation (Adams et al., Reference Adams, Chisnall, Pickering, Schauer, Company Peris and Papagiannopoulos2021). Smart ports, due to the particular combination of systems that make up the port infrastructure, supply chain interfaces and port authorities, merit particular attention. The systematic evaluation of research output, collaboration patterns and the conceptual structure of smart port cybersecurity research remains limited.
Multi-criteria and spatial analyses developed within the context of port state control inspections also provide valuable insights into maritime systems, revealing how professional judgment, human factors and regulatory priorities are shaped within such inspection regimes (Akyurek and Bolat, Reference Akyurek and Bolat2021). In this context, the literature increasingly points to the need for borrowing quantitative and dynamic tools from maritime performance studies. When combined with bibliometric approaches, integrating these methods would offer a much richer and more complete picture (Uygur and Bolat, Reference Uygur and Bolat2021).
This paper aims to partially address that deficiency by performing an initial structured bibliometric analysis that attempts to understand the literature on smart port cyber security. Scopus corpus from the years 2010 to 2025 is gathered, exported in BibTex and analysed using Bibliometrix/Biblioshiny to quantify and visualise the performance and structure of the field. The dataset is composed of 460 documents that were published over 344 different sources. The dataset shows an average of 11.02% annual growth over that time period and an average of 9.967 citations per document. The output of the documents appears to increase sharply after the year 2017 and 2024 is projected to be the year with the highest output. This appears to correlate with the increased digitisation of this field after the global pandemic. The collaboration maps show there are strong international connections, particularly led by the USA, China, India and the UK. The structures of the keywords and titles are indicative of a focus on various technical topics like intrusion detection, network security, denial of service, IoT and ML. The thematic and factor analyses reveal that there exists a central core around security, detection and ports, while also pointing to a few AI enabled emergent thematic niches.
While the existing literature provides valuable insights into maritime cybersecurity and port digitalisation, these research streams largely remain fragmented. In particular, bibliometric studies that jointly examine smart ports and cybersecurity are scarce, leaving the evolution of the field, its collaboration patterns and its conceptual structure insufficiently explored. By addressing this gap, the present study offers a structured overview of smart port cybersecurity research, and supports the identification of key themes and future research directions.
Steered by the motivations and the preliminary patterns described above, the following research questions are pursued in the current study.
-
• RQ1: How has the scientific production and influence through citation in smart port cybersecurity changed over the years (2010–2025)?
-
• RQ2: What are the countries and cross-national ties structuring the field’s collaboration network, and how concentrated are these interactions?
-
• RQ3: What are the dominant and emergent themes, and how are they arranged thematically within the co-occurrence and factorial (conceptual structure) spaces?
-
• RQ4: What patterns of collaboration and conceptual structure, with respect to the performance of the research, suggest research voids and the directions to pursue in the future?
Through these questions, this study provides a replicable and discipline specific smart port cybersecurity map with (i) a quantitative baseline of output and its influence, (ii) a collaboration network architecture, and (iii) a conceptual/framework structure towards an agenda refinement. The methodology clarifies the convergence in the literature, i.e. detection security and AI-assisted defence research, and indicates the need for broader investigation in some areas.
2. Literature review
In light of the few studies focusing on the cyber security of smart ports, the literature review had to adopt a more generalised approach as in Table 1. In contrast, bibliometric studies on cyber security at sea appear to be quite abundant in the literature. In addition, there have been studies aimed at the newly emerging features of smart ports, which have been increasing recently. Within this broader context, several bibliometric studies have examined maritime cybersecurity and digitalisation from different, but often disconnected perspectives. Peng et al. (Reference Peng, Xie, Claramunt, Lu, Gong and Yan2025), for instance, provide a bibliometric analysis of maritime cybersecurity, outlining its status, focus areas and research perspectives. Their findings indicate that existing studies largely concentrate on AIS, autonomous vessels and maritime communication systems. However, the authors also highlight that digitalisation at sea and its cybersecurity implications remain comparatively underrepresented in the literature.
Key focus areas in the literature on smart port cybersecurity.
A complementary perspective is offered by Razmjooei et al. (Reference Razmjooei, Alimohammadlou, Kordshouli and Askarifar2023) in their bibliometric study on Maritime Industry 4.0. Their work focuses on fully digital processes and technologies, and identifies five dominant research themes: digitalisation, methods and techniques, management, security, and environmental issues. By explicitly including terms such as ‘smart manufacturing’, ‘smart factory’, and ‘smart port’, the study positions smart ports as an integral component of the broader digitalisation theme, rather than as a standalone research domain.
Similarly, Jovic et al. (Reference Jović, Tijan, Brčić and Pucihar2022) analyse digitalisation in maritime transport and seaports through bibliometric, content and thematic analysis. While their study provides valuable insights into digital transformation processes, cybersecurity is not examined as a primary research focus, reinforcing the observation that security aspects are often treated indirectly within digitalisation-oriented studies. In contrast, Bolbot et al. (Reference Bolbot, Kulkarni, Brunou, Valdez Banda and Musharraf2022) directly address cybersecurity in the maritime domain through a combined systematic literature review and bibliometric analysis. Their results show that research predominantly focuses on risk assessment techniques and cyber-attack detection tools. Nevertheless, this work addresses maritime cybersecurity in a general sense and does not specifically examine smart ports as a distinct cyber–physical system.
Studies focusing explicitly on smart ports further emphasise this gap. Pham (Reference Pham2023) conducts a bibliometric analysis of smart port development and demonstrates that existing research largely centres on digitalisation, operational efficiency, sustainability and security. Likewise, Li et al. (Reference Li, Li, Zhu, Yuen, Tong and Zhou2023) review and conceptualise smart ports while identifying research gaps and future directions. Although port performance is analysed from multiple perspectives, both studies acknowledge that cybersecurity within smart port performance remains highly underexplored, particularly in relation to its multi-dimensional impacts.
Broader bibliometric overviews of maritime research also reflect similar limitations. Dragović et al. (Reference Dragović, Zrnić, Dragović and Dulebenets2024) provide a comprehensive review of maritime bibliometric studies, mapping core research structures and trends across the sector. Due to its broad scope, however, the study does not allow for an in-depth examination of smart port cybersecurity. Likewise, Yılmaz (Reference Yilmaz2025) investigates increasing cybersecurity risks in the maritime industry using bibliometric methods and highlights digitalisation as a key risk driver. Although ports are included in the analysis, smart ports are not evaluated as a distinct category.
Recent bibliometric studies have also examined smart ports from sustainability and automation perspectives. Dağıstan et al. (Reference Dağıstan, Atalay, Aydın Ünal and Aydın2025) analyse the sustainability performance of smart ports and reveal an imbalance among environmental, social and cybersecurity dimensions, emphasising the need for more integrated approaches. Zou et al. (Reference Zou, Xiao, Li and Biancardo2025) focus on smart maritime shipping and port automation, identifying gaps in systems integration, cyber-physical systems and data management. However, neither study specifically addresses the cybersecurity of smart ports through a dedicated bibliometric lens. To the best of our knowledge, our study is the first case of the bibliometric analysis of the cybersecurity of the smart ports. In the literature, we found analyses focusing on general notions of maritime cybersecurity, and the smart ports cybersecurity performance and sustainability. This research analyses the smart ports system from an exclusive cybersecurity perspective. This is the first step to define the gaps within the literature. Hence, the research aims to provide the basis for further research dealing with the smart port systems.
3. Methodology
3.1. Bibliometric analysis
The academic literature on the cybersecurity position of smart ports was the focus of this study, undertaken through bibliometric analysis. The impact of research in a given area is ascertained through the use of bibliometric techniques, which allows scholars to assess academic contributions via various indicators. The analysis of the performances of articles and journals, the patterns and models of collaboration, and the relationships and structures of research are but a few of the objectives that this analysis attempts to fulfil (Donthu et al., Reference Donthu, Kumar, Mukherjee, Pandey and Lim2021).
Quantitative and qualitative techniques focused on the structure of a scientific field are enhanced through the use of bibliometrics. This methodology rationalises subjective indicators, such as the number of times a work is cited or the frequency of a core theme appearing in a work. The overarching structure of a field, the identification of unexplored knowledge and ideation in research are among the objectives that the methodology accomplishes. Furthermore, it evaluates the contributions of a researcher based on the analysis of a significant volume of data (Donthu et al., Reference Donthu, Kumar, Mukherjee, Pandey and Lim2021).
Nowadays, the scope of bibliometric analysis is as broad as the academic fields that are the focus of research, and that is considerable. Indeed, bibliometric techniques as an analytical instrument in academia is numerous, as in research in health (Sweileh et al., Reference Sweileh, Al-Jabi, AbuTaha, Zyoud, Anayah and Sawalha2017), economics (Ertz and Leblanc-Proulx, Reference Ertz and Leblanc-Proulx2018), education (Türktekin, Reference Türktekin2024), disaster management (Kaptanoğlu, Reference Kaptanoğlu2024) and in the maritime field (Razmjooei et al., Reference Razmjooei, Alimohammadlou, Kordshouli and Askarifar2023). In step with this trend, recent studies have placed a stronger emphasis on digital optimisation to drive energy efficiency. This shift reflects a maritime industry that is becoming more technologically sophisticated and deeply integrated with digital systems (Tian et al., Reference Tian, Zhou, Bolat, Zhang and Gao2024). This digital shift has also brought cybersecurity to the forefront. As a result, recent research has increasingly turned towards systematic and analytical methods to better understand cyber risks, especially in environments where advanced technology and human operations are deeply intertwined (Çınar et al., Reference Çınar, Sezer, Akyüz, Demirel, Bolat and Gardoni2025). Moreover, studies within the maritime domain have established that secure user behaviour is deeply rooted in a person’s education and hands-on experience. Such findings reinforce the human factor as a pivotal element in managing maritime cyber risks successfully (Bolat and Kayişoğlu, Reference Bolat and Kayişoğlu2019). However, human-centric cybersecurity dimensions remain underrepresented in the emerging smart port literature, highlighting the need for systematic bibliometric investigations. In this regard, recent maritime cybersecurity studies emphasise the need for analytical frameworks that address evolving cyber threats to critical navigation systems. In particular, Kayişoğlu et al. (Reference Kayişoğlu, Güneş and Bolat2024) present an example of such approaches by systematically ranking cybersecurity dynamics, reflecting the increasing emphasis on methodological rigour in maritime cyber risk analysis.
3.2. Dataset and search strategy
This bibliometric analysis dataset was methodically built during a systematic literature review process considering the following three keywords: ‘smart port information security’, ‘port information security’, and ‘port cyber security’. Given the evolving landscape of the smart port concept and the limited volume of directly related studies, the broader concept of ‘port’ was also considered during data selection. The publication period was set between 2010 and 2025. The Scopus database was queried using the following exact search string applied to titles, abstracts, and keywords: (TITLE-ABS-KEY (‘smart port information security’ OR ‘port information security’ OR ‘port cyber security’)). The methodology is illustrated in Figure 1.
Research procedure.
The previously mentioned keywords and data while using the Scopus literature search were downloaded in a BibTex file and then prepared for further processing. The data were analysed using Biblioshiny, which is part of the R programming environment and is integrated with the Bibliometrix package. The applied analyses included: number of annual scientific production, number of average citations of articles, co-occurrence network diagram, the most central and most frequently mentioned authors, and the most frequently used terms. These analyses allowed a comprehensive evaluation of the scientific studies conducted in the field of smart ports.
The retrieved records were manually reviewed prior to the analyses. At this stage, irrelevant publications were removed and only publications deemed relevant were exported for analysis. During this screening process, only peer-reviewed journal articles were included in the final dataset. Subsequently, no further exclusions were conducted. The final dataset covers literature addressing ports, maritime infrastructure, and cybersecurity topics (including OT/ICS, network defence and AI-based detection) as reflected in the titles, abstracts and keywords. The dataset was analysed in Bibliometrix and Biblioshiny within the R environment according to the science mapping methods reported in the literature (Aria and Cuccurullo, Reference Aria and Cuccurullo2017; Donthu et al., Reference Donthu, Kumar, Mukherjee, Pandey and Lim2021). Standard dataset cleaning steps included the following. (i) Matching spelling variants of terms (e.g. cybersecurity and versus cyber security) and others.
The keywords were standardised globally by data (including the keywords as the word was formed to-cybersecurity). (ii) Singular–plural consolidation for keywords with the high frequency. (iii) Taking off the stop words (\text{generics}). (iv) The keywords of the authors and Keywords Plus reconciled to fragmentation for reduction of co–occurrence in discordancy. Based on this, a bibliometric dataset was formed in total of 460 bibliometric dataset articles like the one in Figure 2 provided for the analysis in this study. These bibliometrics data are the basis of this study to indicate the data geography, time and theme on the basis of bibliometrics.
Data process.
To support the bibliometric analysis with some visual aids, some clarity was improved in the bibliometric analyses. The analyses results were provided by the Biblioshiny framework with maps, diagrams of networks and graphs to improve data readability. The performance and collaboration metrics were evaluated to this end in the framework of: (i) productivity per year (scientific); (ii) growth rate average (in citations per document); (iii) authors and (iv) co-authorship (international). To indicate the structure of the field, the following outputs in particular were developed.
-
• Co-occurrence networks (title words and author/Keywords Plus).
-
• Thematic maps (centrality × density) to classify motor, basic, niche and emerging/declining themes.
-
• Conceptual structure (factorial) analysis using multiple correspondence analysis (MCA) to identify latent clusters.
Default settings in Biblioshiny were preserved for thresholds and normalisation (e.g. association strength) unless indicated otherwise. Methodological reporting follows the best practices for transparency and reproducibility in bibliometrics (Aria and Cuccurullo, Reference Aria and Cuccurullo2017; Donthu et al., Reference Donthu, Kumar, Mukherjee, Pandey and Lim2021). This method of visualisation has made it possible to interpret the captured data in a more straightforward manner and inform the audiences of the specific scientific trends in the area of smart port cybersecurity.
4. Analysis results
4.1. Main information about the data
Table 2 outlines the most relevant bibliometric characteristics of the describing characteristics of the size bibliometric details of the dataset detailing the size, temporal coverage, impact and the collaboration patterns of the research conducted on smart port cybersecurity. The period of the research spanned the years of 2010 until 2025 and during the period, a total of 460 documents were published and distributed across 344 different sources (journals, books, conference, papers, etc.). Such a spread across a fairly large number of outlets indicates that the topic is not yet pigeonholed to a small number of very niche specialised journals, but rather is still spread across wider outlets in the maritime studies, information security, transportation and engineering fields.
Main information about data.
An annual growth rate of 11.02% suggests that the volume of publication is increasing consistently over the years. In bibliometric terms, this rate is indicative of a research front that is expanding and consolidating rather than a field that is saturated or declining. The average document age of four years shows that the literature is comparatively recent. A substantial share of contributions has been published in the last few years. This trend is consistent with the acceleration of digitalisation and the emergence of smart ports as a policy and industry priority.
In terms of impact, the average of 9.967 citations per document points to a moderate citation footprint. This level is typical for a young but active field: earlier, more general or foundational papers accumulate higher citation counts over longer periods, while a growing set of newer articles has not yet had sufficient time to be cited extensively. As a result, the mean citation value reflects both the presence of influential contributions and the recency of much of the literature.
Authorship indicators further characterise the social structure of the field. The 1,472 authors contributing to the 460 articles with an average of 3.54 co-authors per paper suggest that research on smart port cybersecurity is primarily conducted in collaborative teams rather than by individual researchers. At the same time, the presence of 63 single-authored documents (by 51 single-authored authors) shows that individual contributions still play a role, particularly for conceptual or review-type papers. An international co-authorship rate of 18.7% indicates a meaningful, though not yet dominant, level of cross-border collaboration. While international partnerships are clearly present, there remains scope to further strengthen global research networks. This is especially true for collaborations between regions with different levels of port digitalisation and cybersecurity maturity.
Finally, the lexical indicators, including 2,862 Keywords Plus (ID) and 1,407 Authors’ Keywords (DE), highlight the conceptual richness and diversity of the literature. The relatively large number of distinct keywords suggests that the literature spans multiple sub-topics (e.g. intrusion detection, IoT, ML, OT/ICS security, risk assessment, governance), which is typical for an emerging, multidisciplinary field that has not yet fully converged on a narrow, standardised vocabulary. These keyword sets provide the basis for the co-occurrence, thematic and conceptual structure analyses presented in the subsequent sections.
Taken together, the indicators in Table 2 depict a young, rapidly growing, and conceptually diverse research domain with moderate impact and collaboration, and with clear signs of ongoing maturation in both volume and structure.
4.2. Annual scientific production and average article citation
Figure 3 illustrates a steady growth in scientific publications on ‘smart port information security’, ‘port information security’, and ‘port cybersecurity’ between 2010 and 2025. Although publication numbers remained limited until 2016, a clear upward trend emerged after 2017, accelerating post-2020 and reaching a peak in 2024. This increase is closely associated with the adoption of smart port technologies and intensified digitalisation, particularly during the COVID-19 pandemic. The apparent decline in 2025 is likely due to incomplete data, as the analysis covers only the early months of the year.
Annual scientific production and average citation trend.
The graph also seeks to estimate the total average citation counts of the studies published between 2010 and 2025. Concerning the average citations, it is noted that earlier publications have a higher number of citations. This suggests that the early studies in the field have served as the primary and only references in the area. Certainly, the peak in 2010 can be explained by the article ‘Cybersecurity for Critical Infrastructures: Attack and Defense Modeling’, as it has been extensively cited in the field and in OT studies later. Ten et al. (Reference Ten, Manimaran and Liu2010) provided major contributions to the field of cybersecurity through the development of a detailed security framework. It is also noted that a steep decline is observed between 2011 and 2014, after which average citations increased steadily and peaked in 2020. This is attributed to research in the area that has been propelled by the increased digitalisation as a result of the pandemic. It is noted that the decline after 2021 is due to the fact that the studies published in this period have not been cited extensively. In sum, the evidence collected thus far suggests the subject has generated interest on an ebbs and flows basis over the years. Overall, Figure 3 illustrates the parallel evolution of annual scientific production and average citations per article. Publication output increases rapidly after 2017, while average citation levels gradually decline in recent years due to the cumulative nature of citations.
4.3. Country collaboration
Figure 4 shows collaboration activity amongst countries, illustrates how the USA, China and India are among the most developed and technologically advanced countries, and the centres of collaboration, and are therefore able to participate in significant and strong relations of collaboration globally. In the map, countries that are darker in colour exhibit higher levels of collaboration activity than countries that are lighter in colour. For instance, the map depicts the USA and India having significant collaboration activity, and the USA having significant collaboration activity with the UK. Moreover, the map depicts the USA and the UK collaborating with countries in the Middle East, thereby illustrating the spatial patterns of the research partnerships and how the digitalisation level of a particular region affects the global relations.
Country collaboration map.
4.4. Word map & most frequent words
In Figure 4, node size represents the intensity of a country’s collaboration activity, while link thickness reflects strength of collaborative ties between countries. Analysis of the most frequently occurring words in the titles of the publications points to the prominence of the words, ‘port’, ‘cybersecurity’, ‘security’, ‘analysis’ and ‘detection’, thereby showcasing the key focal points of research that are directed towards the technological security of smart ports. This is further demonstrated in Figure 5.
Word map.
Figure 5 visualises the relative prominence of keywords in the smart port cybersecurity literature based on their frequency of occurrence. The keyword and title word frequency distributions reveal helpful data regarding the main areas of the smart port cybersecurity literature and how they are evolving. It is evident the most popular keywords feature the word security. Table 3 shows the keyword cybersecurity, with 212 occurrences, alongside network security (144) and cyber security (133), which form a strong semantic backbone, indicating that the literature is largely concerned with cybersecurity as a field, as opposed to other areas such as digital integration or logistics. The occurrence of both the keywords cybersecurity and cyber security also indicates a certain degree of fragmentation of language which is characteristic of nascent fields, and has consequences for literature retrieval and potential indexing within the field.
Keyword occurrence and title word frequency distributions.
Beyond these generic terms are the more specific expressions of a technical nature, like, ‘intrusion detection’ (63), ‘intrusion detection systems’ (31), ‘denial-of-service attack’ (35), ‘cyber-attacks’ (41) and ‘computer crime’ (31). As such, these varied expressions of specific attack vectors and threat instances are indicative of a recurring emphasis in the literature and the relative high frequency values exemplify such a focal point being threat detection and attack modelling. Simultaneously, the high use of both ‘internet of things’ (46) and ‘machine learning’ (43) confirms that research on smart port cybersecurity is closely intertwined with IoT-centric infrastructures and data-centric analytical methods. This means that the keyword profile indicates a field that is not only concerned with the more abstract notions of security, but also the more tangible elements of technical designs of security and intelligent detection systems for smart ports. The data on the frequency of title words, as presented in Table 3, showcase this to further support and clarify the profile of this field of research as biased on its specific focal themes. Terms such as ‘port’ (136), ‘security’ (92), ‘detection’ (77), ‘cybersecurity’ (72), ‘maritime’ (54) and ‘network’ (54) dominate the lexicon of titles and reveal a stable port–security–detection triad at the heart of the literature. The frequent appearance of ‘system’ (50), ‘based’ (46) and ‘cyber’ (45) suggests a strong emphasis on system-oriented and method-based contributions, for instance ‘X-based detection system’ or ‘Y-based security model’, which typically denote algorithmic or architectural proposals rather than purely conceptual discussions. The parallel use of ‘port’ and ‘ports’ again points to minor lexical dispersion around otherwise shared concepts.
Taken together, the keyword and title-word distributions indicate that the domain has already converged on a recognisable technical and thematic core: cybersecurity and network security in ports, with particular attention to intrusion detection, cyber-attacks and IoT/ML-enabled solutions. At the same time, the relatively limited visibility (in these top lists) of terms directly linked to logistics operations, governance, human factors or resilience suggests that these dimensions, while present elsewhere in the corpus, are less central in the dominant lexical landscape. This imbalance supports the view that future research would benefit from further integrating operational, organisational and governance perspectives into what is currently a strongly technology-oriented research agenda.
4.5. Co-occurrence network & thematic map
Figure 6 shows a co-occurrence network where nodes represent title terms and edges indicate their co-occurrence strength. The co-occurrence network in Figure 6 based on title words provides a structural view of how key concepts in the smart port cybersecurity literature are interlinked. In this network, each node represents a term appearing in document titles, while edges reflect how often two terms co-occur within the same title. The resulting graph shows a dense core in which ‘port’, ‘security’ and ‘detection’ are tightly connected. This configuration confirms that the dominant problem space in the field is framed around security and detection in port environments, rather than, for example, generic maritime digitalisation or logistics optimisation. In other words, the lexical centre of gravity is clearly located at the intersection of port operations, cybersecurity and threat detection.
Co-occurrence network.
Figure 7 shows thematic maps research themes by centrality and density, distinguishing motor, basic, niche and emerging themes in smart port cybersecurity. The thematic map refines this picture by organising clusters of terms along two dimensions: centrality (relevance to the overall network) and density (internal development of the theme). In the upper-right quadrant, which represents motor themes with high centrality and density, concepts such as smart port, information security and cybersecurity appear close to the boundary of the lower-right quadrant. This placement indicates that these themes are both structurally important for the field and relatively well developed in terms of internal coherence. They represent the core, driving topics of smart port cybersecurity research, and they anchor much of the ongoing discussion about how digital port infrastructures should be protected. The lower right quadrant, which is characterised by high centrality and low density, or basic and transversal themes, the inclusion of systems such as the ‘detection system’ suggests core, basic and transversal topics that are in a more rudimentary stage of development. These are the themes that have a high recurrence rate and emphasis throughout the literature; hence, their centrality in the field. However, it seems that their internal specialisation, and conceptual elaboration and development is not as matured compared with others in the themes that drive the field.
Thematic map.
This is characteristic of fields that still contain terminological chaos and methodological pluralism. Clearly, however, more systematic and comparative studies of detection systems adapted to the context of smart ports are needed.
The upper left quadrant represents low centrality and high density or niche themes and includes concepts like ‘cybersecurity attacks’, ‘port management’, ‘deep learning’, and ‘cargo port’. Their location suggests the existence of these themes as isolated, highly specialised or contextually rich sub-disciplines, which are however still peripheral to the main discourse. The term ‘deep learning’, for instance, suggests a still contained though growing strand of research that focuses on AI-powered solutions for automated decision support, or for the detection of intrusions or anomalies, in ports. Likewise, ‘port management’ and ‘cargo port’ refer to works that target particular operational or managerial concerns of port cybersecurity, like automated operational risk management in the handling of cargo and the automated operations of terminals. While these themes still do not govern the discourse, the high internal density suggests that they could attract more attention and potentially shape the discourse as they begin to articulate more significantly with the central concerns of the security detection framework.
In contrast, certain topics, including that of ‘logistics operations’, are located in, or close to, the lower left quadrant signifying low centrality and low density, which denotes that these are either emerging or declining themes. There are two potential interpretations for this position: these topics could either be emerging frontiers where only a small amount of work has begun to investigate the interaction of cyber security with the logistics/operational processes of a port, or they are areas that are losing prominence with regards to more technical aspects of security. Considering the overall trend in the industry towards integrated supply chain risk management, the first interpretation would be the more reasonable one and indicates a promising, albeit insufficiently developed, research direction.
As a whole, the co-occurrence network and thematic map indicate that smart port cybersecurity research possesses a well-defined conceptual core. This core is centred around port security and detection. Meanwhile, the field is progressing on the periphery through niche technical themes such as deep learning and specific types of attacks. Furthermore, it covers contextual themes including port management and cargo operations. Meanwhile, the relatively modest and underdeveloped positioning of the terms pertaining to logistics and operations reflects a considerable disconnect between the technical cybersecurity research and the larger operational, managerial and supply chain domains. Bridging this disconnect by incorporating cybersecurity within port logistics, governance and resilience planning constitutes a major pathway for future research and for creating genuinely smart and secure port ecosystems.
4.6. Factorial analysis
The conceptual structure of the smart port cybersecurity literature was examined using MCA on title terms and author-supplied keywords. In this approach, documents are projected into a low-dimensional space based on their shared vocabulary, and terms that frequently co-occur in the same documents are located closer to each other. The resulting conceptual structure map therefore visualises how research topics are grouped and how distant or proximate they are within the broader intellectual landscape of the field.
Figure 8 presents a factorial (MCA) map in which the proximity between terms reflects their conceptual similarity based on shared usage across documents. This MCA output in Figure 8 reveals a multi-cluster organisation rather than a single, monolithic topic. One prominent cluster can be characterised as a technical security cluster, where terms such as ‘cybersecurity’, ‘network’, ‘communication’ and related security constructs are concentrated. This cluster represents the core of the field in a narrow sense: it includes studies dealing with classical information and network security issues in port or maritime contexts (e.g. securing communication channels, defending networks against intrusions, hardening systems against attacks). Its central position in the map indicates that these topics are conceptually close to a wide variety of documents and thus form the backbone of smart port cybersecurity research.
Conceptual structural map.
A second major grouping can be described as an AI-for-security cluster, which contains terms such as ‘deep learning’, ‘detection’, ‘algorithm’ and similar methodological labels. This cluster is located at some distance from the purely ‘cybersecurity/network’ cluster, reflecting its more focused methodological orientation. Here, research largely revolves around the design and evaluation of machine learning and deep learning-based approaches for intrusion detection, anomaly detection or predictive analytics in maritime and port systems. The clear separation of this cluster suggests that AI-centred work has started to form a distinct subfield within the broader domain: while closely related to the security core, it has its own internal vocabulary and research questions (e.g. model architectures, performance metrics, dataset issues).
A third cluster aggregates terms such as maritime, management, information, and other context- and operations-oriented concepts. This may be viewed as a contextual/operations cluster comprising research that integrates cyber security within broader issues of port management, maritime operations, information management and organisational practices. Relative to the other two clusters, this position suggests that a portion of the literature examines cyber security as more than a purely technical problem, as it is also a critical element of port governance, risk management and operational decision making. The existence of this cluster demonstrates the inter-disciplinary nature of the field, merging cyber security with literature on maritime transport, management and information systems.
Along with these three primary groupings, smaller peripheral clusters show up around more specialised issues (e.g. logistics, certain systems or specific attack scenarios). The edges of the map where these clusters are located suggest that these are not as central within the current conceptual structure as the other clusters, although they may represent developing niches that are likely to become more significant as the area of research grows.
With the aid of factor analysis, the findings of the co-occurrence and thematic mapping were both validated and extended. The results confirm that smart port cybersecurity is centred on a technical security core, with AI-driven analytics and context management emerging as related subdomains. However, the relative distances between clusters reveal limited integration, particularly between AI-based cybersecurity studies and OT/ICS-focused, or operational and management-oriented frameworks.
This fragmentation highlights clear research gaps at the interfaces of these domains. In particular, further studies on explainable AI applications for OT-level cyber risks, as well as evaluations of such approaches within port management and governance contexts, would significantly contribute to the literature. Overall, the conceptual structure map illustrates a multidisciplinary yet segmented field, emphasising the need for more integrated and holistic approaches to smart port cybersecurity.
5. Discussion
The bibliometric results collectively exhibit smart port cybersecurity as an emerging, but fast-structuring area of research. Definite growth year on year across the last ten years of documented research has propelled the subject from the periphery to the centre of concern as an area of focus research from cadenced digital transformation of ports.
Concerning RQ1 (production dynamics), the results show a field in volume growth and a rate of 11.02%, along with an increasing number of publications after 2017. There seems to be a sustained research stream, and the 344 source dispersion and 460 documents suggest the contributions to this research stream are diffuse within a large spectrum of minimal research activity. The moderate average citations per document (9.967) and the dominance of relatively recent publications further suggest that smart port cybersecurity is in a growth phase, where influential foundational works coexist with a large body of newer, as-yet less cited contributions.
Regarding RQ2 (collaboration structures), authorship and country-level analyses show a hub-and-spoke collaboration pattern. A limited number of countries (notably the USA, China and India) function as major production and collaboration hubs, while the overall international co-authorship rate of 18.7% points to a non-trivial, yet not fully mature level of global integration. This configuration implies that knowledge production is driven by a handful of leading research systems, and that there is considerable scope to broaden collaboration networks to include ports and institutions from under-represented regions and different regulatory and technological contexts.
For RQ3 (conceptual organisation), the lexical, co-occurrence and thematic analyses converge on a clearly identifiable ‘port–security–detection’ core. High-frequency keywords and title words such as ‘cybersecurity’, ‘network security’, ‘intrusion detection’, ‘denial-of-service attack’, ‘Internet of Things’ and ‘machine learning’ demonstrate that the literature is strongly oriented towards technical security questions in port environments, with a pronounced emphasis on detection and protection mechanisms. The thematic map positions ‘smart port’, ‘information security’ and ‘cybersecurity’ as central and comparatively well-developed themes, while ‘detection system’ emerges as a basic but still developing theme. Niche clusters around ‘deep learning’, ‘cybersecurity attacks’, ‘port management’ and ‘cargo port’ indicate specialised, technically or contextually rich subfields that have not yet become central to the overall agenda. At the same time, the relatively peripheral position of terms related to ‘logistics operations’ signals that the integration of cybersecurity with broader logistics and operational processes is still emerging rather than fully established.
In relation to RQ4 (intellectual structure), the factorial analysis (MCA) reveals a multi-cluster conceptual landscape comprising: (i) a technical security cluster (cybersecurity, network, communication); (ii) an AI-for-security cluster (deep learning, detection, algorithm) and (iii) a contextual/operations cluster (maritime, management, information). This configuration confirms that the field is inherently multidisciplinary, but it also exposes a degree of segmentation: technical security studies, AI/machine learning approaches and management/operations-oriented work tend to form partly separate strands, with relatively few studies operating at their intersection. In other words, while the intellectual backbone of the field is now visible and reasonably structured, there remain clear gaps at the interfaces between OT/ICS engineering, AI-driven analytics and operational/governance perspectives.
Lastly, the findings to RQ1–RQ4 can support a dual conclusion. First, the field of smart port cyber security has gained a number of critical and quantitative advancements, particularly within the scope of core and security detection, and the use of AI/ML methods has grown to a heightened level of sophistication. Second, the field suffers a persistence of broader horizontal fragmentation (across the outlets and nations) as well as vertical (within the technical, socio-technical and methodological layers). Improving this fragmentation by integrating cyber security within the broader governance of port logistics system will be the focus of the next round of research. This bibliometric mapping does not only provide a snapshot of the existing literature, it also delineates the specific gaps that are essential for advancing smart port cybersecurity to achieve fully secure, resilient and sustainable ecosystems.
6. Conclusion
This study has filled the gap by providing a bibliometric overview of smart port cybersecurity for the years 2010–2025. Using the Bibliometrix and Biblioshiny tools, the study analysed 460 documents from 344 sources to demonstrate the growth of the field in terms of research output, collaboration and conceptual structure. The findings indicate a continuous, accelerating growth in the number of publications, particularly after 2017. The number of publications is projected to attain an all-time high in 2024, indicating that smart port cybersecurity is a field that is developing and diversifying at a rapid pace. In addition, the publications are diffused across a wide variety of journals and the level of international collaboration is relatively low. Such findings indicate that the field is still in a nascent state.
Lexical, co-occurrence, thematic, and factorial analyses converge on the core port–security–detection. Concepts such as cyber security, network security, intrusion detection and cyber attacks are linked to the infrastructure of a port. Around this core are two main thematic strands of the field, which are becoming increasingly prominent: the AI-for-security strand, which focuses on security through various forms of machine and deep learning, and a more contextual strand relating to maritime management and information. These patterns highlight the sophistication of the research, particularly in detection and defence systems and their institutional context, indicating implications for port operations, management and governance. The fact that terms relating to the logistics operations, organisational factors and governance are thematically peripheral suggests that the operational and socio-technical elements are less developed relative to the technical components of the literature.
Practically speaking, the implications of the findings suggest a desire to avoid technical sophistication and embrace more integrated socio-technical frameworks for smart port cybersecurity. Essential components include the enhanced safety, operational and environmental outcomes of cyber-activity, the development of predictive models of cyber-activity, the incorporation of zero-trust frameworks for systems within the port community, the creation of explainable, operational AI detection frameworks, and the strengthened OT and ICS environments present within ports. Also important are governance and organisational measures such as incident response planning, cooperation among stakeholders, and anticipation and adaptation of international and regional regulations. For ports to achieve true cyber resilience, these measures should be in addition to technical controls.
This investigation is not without its drawbacks. First, as the research is based on a single database (Scopus) and a keyword strategy based on the terms ‘smart port’ and ‘port’, there is a possibility of under-representing related work that is framed within other contexts, such as purely maritime or ICS contexts. Second, in the co-occurrence keyword analysis, the most frequently occurring words are taken from the titles of published works. This analysis may omit a number of significant underdeveloped themes found within the unexamined abstracts and full texts. Also, the coverage of the year 2025 is partial, which has an effect in steering how issues are oriented within that year. For these reasons, it is recommended that future studies omit this approach and instead use multiple databases (e.g. Web of Science and IEEE Xplore) in addition to abstract and keyword text mining, and combine bibliometric mapping with qualitative content analysis on significant texts and relevant case studies.
With respect to these limitations, the current study offers a systematic and reproducible map of the smart port cyber security knowledge base and empirical foundation for setting research agendas. From delineating the primary research centres, fundamental and peripheral topics, and conceptual voids, it can serve as a beacon to researchers, decision makers and practitioners in concentrating on where the focus is most warranted: at the junctures of technical security, AI-driven analysis, operational realities and governance frameworks. As ports continue to advance in digitisation and as the global supply chains become more closely integrated with cyber-physical systems, the closing of such gaps will be crucial to the effectiveness and sustainability of smart ports, and to their resilience and security by design. At a theoretical level, the results indicate that socio-technical and governance dimensions remain underrepresented compared with technically oriented cybersecurity research in smart ports. Practically, this suggests a need to rebalance current approaches by integrating organisational and operational considerations alongside technical solutions. From a policy perspective, the findings point to gaps between cybersecurity research and port governance frameworks. Future studies should therefore prioritise OT–IT convergence, cyber-physical risk assessment in port operations and governance-oriented cybersecurity analyses.
Acknowledgements
This study is supported by Istanbul Technical University Scientific Research Projects, which is titled as ‘GIS-Based Analysis of Smart Ports Cyber Security’ [Project Code: MYLB-2025-47025].
This article is based on the master’s thesis of the first author, conducted within the Maritime Studies Master’s Program at Istanbul Technical University.
