FOR SHIPYARDS AND ONBOARD EQUIPMENT SUPPLIERS
FuzzForge tests your suppliers’ software without the source code, and gives you proof the surveyor can replay.
OVERVIEW
IACS UR E26 and E27 are the cyber resilience rules that classification societies apply to every ship contracted since 1 July 2024. UR E26 covers the ship, UR E27 each system on board. In practice, IACS UR E26 E27 compliance means an inventory of every system, a secure development lifecycle and security tests witnessed by the class surveyor.
WHO DOES WHAT
UR E26
Shipyard (systems integrator)
The ship test procedure and commissioning tests.
Flaws beyond the published CVE list.
UR E27
Equipment supplier
A secure development lifecycle and tested updates.
The same campaign, rerun in your CI on every release.
UR E26
Shipowner
Records at every annual survey.
A findings history per system and per version.
FuzzForge does not issue certificates. Your class society assesses compliance.
PROOF
FAQ
No technique is named. Both rules ask you to demonstrate compliance by “testing and/or analytic evaluation”. Fuzzing, emulation and binary analysis are ways to produce that evidence, for example for the verification phase of the secure development lifecycle in UR E27.
Type approval is voluntary and applies to standard, routinely manufactured systems. With a valid certificate, the supplier submits a reduced set of vessel-specific documents and skips the vessel-specific factory test. The secure development lifecycle still applies to every update of the product.
Yes. FuzzForge works on compiled binaries and firmware images and writes the fuzzing harness itself. It runs on-premise, with an air-gapped option, as well as in SaaS or a private cloud.
A real campaign on one of your systems, run inside your environment. Results your engineers can replay in front of the surveyor.
MEET US
| Cookie | Duration | Description |
|---|---|---|
| cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
| cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
| cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
| cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
| cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
| viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
