In the second quarter of 2026, Windward recorded 3,137 prolonged dark activity events involving 2,157 unique cargo ships and tankers above 10,000 DWT, along with 171,286 distinct vessels affected by GPS jamming at least once.

None of these figures describe a list of vessels. They describe conditions inside specific stretches of water — and that distinction is the operational problem of 2026. Maritime risk management was built target-first, on the assumption that dangerous vessels could be named in advance and then watched. Mission responsibility does not work that way. A naval force is accountable for a transit corridor. A mission built around sanctioned and shadow-fleet trade is accountable for a fleet of interest, wherever it sails. In every case the mission is fixed, but the geography the mission touches is not something the organization gets to choose — and in the sanctions case it is not even fixed. It moves as the fleet moves.

What follows is a requirement for control of the mission, not control of a boundary for its own sake. Control means the organization defines the mission, translates it into the geography and vessels that mission actually touches, selects the sensors required, and adjusts the picture as the mission moves. The area is not the point; it is the means by which the mission gets covered, and nobody else decides what the operational team is permitted to see.

Sustaining that level of control across open ocean has historically been hard to justify. That has changed, and the gap between organizations working mission-first and organizations still working from target lists is widening quarter by quarter.

Maritime Risk Is Located, Not Listed

GPS jamming is an area condition. Vessels do not carry it with them; they enter regions where positioning is being manipulated, and their reported position stops corresponding to their actual one. Jamming and spoofing of navigation signals has been a recurring feature of the Baltic, the Black Sea, and the Eastern Mediterranean in recent years, and its appearance at this scale reflects a broader pattern in which manipulation of position data is no longer confined to a handful of conflict zones. Since Operation Epic Fury began on February 28, 2026, Windward has detected 3.35 million false ship-to-ship meetings globally, in which spoofed positions made vessels appear to rendezvous when no meeting took place. Spoofing peaked on March 20 at 356,773 false meetings in a single day. Any organization screening vessels rather than watching water inherits that distortion without seeing it.

Dark activity is a gap in a place. The 3,137 prolonged dark activity events recorded in Q2 represent a sevenfold increase over the 451 events recorded in Q1. One in four extended events took place off Saudi Arabia, Oman, Iran, or the UAE. A prolonged dark period is a window during which the vessel stopped self-reporting, and it is only meaningful in relation to where the vessel was when the reporting stopped.

Identity manipulation dissolves the list itself. Some 275 internationally trading tankers were broadcasting the flag of a fraudulent registry in Q2, across 22 fraudulent registries Windward has now identified. Around 90% of tankers using fraudulent registries were Western-sanctioned. When declared identity is unreliable for a growing share of the fleet, a monitoring approach organized around declared identity degrades in step.

The common structure is that the risk sits in the area while the identity is negotiable. A target list is only as good as the naming that produced it, and adversaries control the naming. Nobody controls the water except the organization responsible for it.

Target Lists Answered a Constraint That Has Since Eased

Maritime organizations did not choose target lists over area coverage arbitrarily. They chose them because sustained coverage of the open ocean was difficult to justify at scale.

Land and air domains support fixed collection infrastructure; the ocean largely does not. Tasked satellite imagery was expensive enough that it was generally reserved for named vessels of interest, which meant collection had to be requested, justified, and weighed against competing priorities. The layer that was continuous and global, AIS, is cooperative by design. It reports what the vessel chooses to report, and any operator with a reason to stay unseen has always been able to opt out. That cooperative design is not incidental: AIS was introduced under IMO safety regulation so ships could avoid collisions, and its use as a security and compliance sensor has always depended on vessels choosing to broadcast.

Working from watchlists, screening counterparties, and querying individual vessels when a question arose was a reasonable response to those conditions. It worked while its assumptions held true: vessels broadcast honestly for the most part, declared identity usually matched actual identity, and single-source coverage produced pictures adequate to the questions organizations were asking.

Both sides of that equation have moved. The assumptions have weakened, as the concealment figures show. At the same time, denser satellite constellations, radio frequency detections, and behavioral models trained on more than a decade of global maritime activity have made sustained coverage of a defined mission considerably more practical than it was even a few years ago. The tradeoff that made target lists the sensible default has shifted.

The Same Failure in Three Different Missions

The organizations facing this environment differ completely in mandate, register, and consequence. The requirement underneath is identical.

A Naval Force Cannot Query Its Way Backward

The Somali piracy resurgence has produced the highest attack tempo since 2013. At least 15 attacks have been logged in 2026, with eight occurring since May. Six commercial vessels have been hijacked since April 21, 2026, and attacks are occurring increasingly far from the Somali coastline.

The reason for the extended reach is the analytical center of the case. SWARD (IMO 8324713), hijacked on April 26, 2026, has been dark on AIS since seizure. It was last observed underway towing a small vessel — a signature consistent with hijacked commercial tonnage being used to stage attacks further offshore than skiff-based operations permit. The use of captured vessels as motherships is the same tactic that defined Somali piracy at its peak in the early 2010s, when the international naval response was organized around patrolled transit corridors rather than named suspects. That finding changes what the vessel is: SWARD stopped being a victim and became infrastructure. No screening process produces that conclusion, because SWARD is not a suspicious vessel by any list-based measure. It is a hijacked cement carrier. The finding exists only because the corridor was under continuous coverage across months, with AIS gaps cross-referenced against satellite imagery, radio frequency emissions, and prior activity baselines.

A query run at the moment of the next hijacking cannot recover this. The mothership was operating dark for weeks before it mattered, and there was no name to query. Continuous coverage of the corridor holds the observation until it becomes actionable; request-based collection does not, because nobody knew to request it.

Sanctioned Trade and Shadow-Fleet Operations

Sanctioned trade and shadow-fleet operators do not stay inside one port or one route. They move through ports, waiting areas, and shifting routes, and the picture only holds if collection follows them there rather than watching a single fixed boundary.

Windward's tracked dark fleet expanded to 2,186 vessels in Q2 2026, of which 1,106 are sanctioned. Ukraine now classifies more than 700 Russia-trading tankers as military-affiliated assets. Some 275 internationally trading tankers were broadcasting the flag of a fraudulent registry in Q2 alone, across 22 fraudulent registries Windward has identified, and roughly 90% of those vessels were already Western-sanctioned. A tanker loads sanctioned crude at one port, waits at anchorage while a buyer is found, transships onto a second hull at sea, and discharges at a different terminal entirely — switching flag, name, and registered owner along the way.

Detections have to flag the ship-to-ship transfer and the evasive movement as they happen, correlated against each vessel's history, so the tactic does not go unnoticed the way it would if collection were tied to a single port or route. What holds the picture together is the mission — track this trade across every port, waiting area, and route it touches. The area under coverage is generated by the mission.

A Chokepoint Picture Breaks Exactly Where It Matters

Hormuz is the case where both audiences share the same problem. The Strait is one of the world's most heavily used oil and LNG transit chokepoints, which is why a collapse in visible traffic there registers simultaneously as a security question and a commercial one.

AIS-visible monthly transits through the Strait totaled 3,750 ships in February 2026, then fell to 450 in March, 630 in April, 450 in May, and 640 in June. June transits ran at roughly one-sixth of pre-war traffic. The quarter ended with the Strait split into two politically controlled corridors: a permissions-based northern route through Iranian waters and a U.S.-supported southern corridor through Omani waters. Many vessels are transiting with AIS turned off, in some cases with owner and flag state consent for security reasons.

The analytical difficulty is structural. A vessel approaches from the Arabian Gulf, disables AIS as it enters the chokepoint, and resumes broadcasting in the Gulf of Oman after transit. The dark window is precisely the period when identity, position, direction, and cargo matter most. The picture fails at the point of maximum consequence, and it fails for the naval planner assessing corridor security and the trader pricing a cargo at the same moment, for the same reason. According to the Windward Maritime AI™ Platform, a vessel transits the Arabian Gulf broadcasting normally, goes dark on approach to the Strait — leaving its behavior during the dark period unaccounted for — and resumes transmission in the Gulf of Oman after transit.

Continuous coverage of the chokepoint closes that window from the outside, drawing on whatever the mission requires rather than whatever happens to be broadcasting. Pre-transit AIS establishes who entered. Through the dark period, imagery, radio frequency emissions, open-source reporting, terminal and port activity, ownership and commercial records, and the organization's own data all remain available, and any source that answers a question the others cannot is a source worth pulling into the picture. Behavioral history sets what normal looks like for that hull on that route, so a transit that deviates registers as a deviation rather than a gap. The mission determines the collection, not the reverse. The output is a transit picture assembled while the transit is happening rather than reconstructed afterward.

The Same Structure Holds Across Other Missions

The pattern repeats wherever an organization owns an area rather than a list. Gray-zone monitoring in the Baltic and the South China Sea requires distinguishing between commercial and state-directed behavior inside the same waters, with Ukraine now classifying more than 700 Russia-trading tankers as military-affiliated assets. Sanctions and shadow fleet exposure shifts continuously rather than at review cycles, and Windward's tracked dark fleet expanded to 2,186 vessels in Q2, of which 1,106 are sanctioned. Commodity flow analysis depends on watching origin terminals, transit corridors, and destination behavior together rather than querying any one of them.

Different mandates. An identical requirement.

All-Source Coverage Is What Makes the Mission Legible

Continuous coverage only produces intelligence if the collection is resilient to the manipulation happening inside it.

Every mission above breaks on a single-source picture. The naval case breaks because the mothership is dark. The sanctions case breaks because declared flag, name, and ownership are exactly the fields being falsified. The chokepoint case breaks because AIS is switched off during the transit. Each failure is a single-source failure, and in each case a different sensor covers the gap.

Fusing AIS, satellite imagery, radio frequency signals, digital presence signals, open-source reporting, behavioral history, the organization's own data, and any additional sources required into one continuously updated picture means a gap in any single source is not a gap in the operational picture. In an environment where 171,286 vessels were jammed at least once in a single quarter, that redundancy is the difference between a mission you are monitoring and a mission you actually control.

What Control of a Mission Area Requires

Four characteristics separate this from the static, single-source monitoring of the past decade.

Collection is organized around the mission, not around fixed coordinates. The operational team defines the area and changes it as the mission changes. A naval force extends a corridor. A cable operator adds a protection zone. A mission tracking sanctioned trade adds a newly sanctioned operator's fleet to the picture. None of that should require a rebuild or a new procurement.

Historical baseline is present from day one. A mission area is not a fresh slate. Assessing whether activity is anomalous requires knowing what normal looks like for that water and that vessel class, which means historical coverage has to arrive with the first day of monitoring rather than accumulating over the following year.

Collection is persistent and does not require a specialist to operate. Coverage builds continuously across every source in the mission, correlated as it arrives, with no manual request cycle. Organizations should not have to staff a collection management function to keep their own monitoring running.

Coverage is all-source by default. Every available sensor and any additional source the mission requires, including the organization's own data, feed one picture rather than several that have to be reconciled by hand.

Mission Area Monitoring

Windward's Mission Area Monitoring is built to these requirements: all-source data fusion across AIS, satellite imagery, radio frequency signals, digital presence, open-source intelligence, and customer-supplied data through the platform's bring-your-own-data architecture; mission-based collection that adapts as priorities move; continuous correlated output delivered within hours of collection, without specialist collection expertise; and historical context included from the first day of coverage.

For naval forces, coastal states, chokepoint monitors, compliance functions, and commercial trade teams, the architecture is the same and the mission scope is not. That is the point. The area is whatever the organization is responsible for, and the sensors are whatever that mission and those areas demand.

Source: Windward