Cybersecurity, knowledge management and sustainability disclosure in DT-Enabled European ports

The adoption of digital twin (DT) technology is reshaping European port operations by enabling advanced, data-driven planning, monitoring and optimization that can improve both operational efficiency and environmental performance (Tao et al., 2019). In this context, DTs act as critical enablers for designing, tracking and refining decarbonization strategies, aimed at reducing greenhouse gas (GHG) emissions. Yet accelerated digitalization also widens the attack surface and increases dependencies on data integrity, availability and confidentiality, making cybersecurity and knowledge management (KM) pivotal capabilities. Sensitive operational and environmental data must circulate securely and reliably across complex multi-actor ecosystems including port authorities, terminal operators, shipping companies, regulators and technology providers (ENISA, 2022; Heilig and Voß, 2017). Despite extensive research on the environmental and operational advantages of DTs, the convergence of digital transformation, cybersecurity, KM and decarbonization remains insufficiently theorized and empirically examined (Alamoush et al., 2022; Di Vaio et al., 2025a, 2025b, 2025c).

Moreover, the COVID-19 pandemic accelerated digital transformation in port ecosystems by increasing reliance on remote operations, automated coordination and real-time data exchange. As dependence on DT-enabled infrastructures grew, ports became more exposed to cyber threats, while cyber incidents and governance responses increasingly generated organizational learning signals that could be captured, codified, shared and reused through KM processes. From this point of view, cybersecurity-related reporting is not seen only as a compliance-driven reporting process, but as a way for organizations to share the knowledge acquired in their operations, learn about cybersecurity risks and articulate governance frameworks and learning processes to internal and external audiences. Hence, this study focuses on the disclosure of cybersecurity governance and cybersecurity-related KM practices in DT-enabled port environments. Accordingly, KM is adopted as the focal analytical lens through which cybersecurity governance is examined in DT-enabled port environments.

Although research on cybersecurity governance and digital transformation is expanding, there has been limited focus on the management and disclosure of cybersecurity-related knowledge within digitally enabled port ecosystems. The current literature frequently addresses cybersecurity from primarily technical or operational viewpoints, leaving the KM aspects of cybersecurity governance and disclosure largely unexplored, especially in the port sector after the rapid digitalization prompted by the COVID-19 pandemic. Prior research has addressed individual components, including DT adoption (Cunha et al., 2025), cybersecurity in port logistics (Heilig and Voß, 2017), KM linked to digital strategies (Wang and Li, 2023) and GHG accounting in DT contexts (Di Vaio et al., 2025a, 2025b, 2025c), but rarely integrates these dimensions within analyses of official port disclosures. In addition, previous studies have not sufficiently integrated KM processes with stakeholder-focused disclosure practices in digitally interconnected operational environments (Bebbington et al., 2008; Di Vaio et al., 2024).

Hence, to address this gap, the research question (RQ) of this study is:

Cybersecurity activates learning signals in the form of detected vulnerabilities, near misses and control failures. The codification of these signals is carried out with the help of KM artefacts, including playbooks, revised procedures, training modules and after-action reviews. In turn, these knowledge processes can improve operational resilience and support emissions-relevant decision-making.

Therefore, answering our research question, we analyze public disclosures (sustainability reports and strategic documents) as a lens on the strategic narrative ports construct to demonstrate accountability and compliance with evolving sustainability mandates (Higgins et al., 2018; Neugebauer et al., 2024).

Our study suggests 2 × 2 typology (cybersecurity governance depth × KM maturity) as an explanatory approach, not as a descriptive one. Different configurations illuminate when cybersecurity is largely technical and compliance-based and when it is turned into institutionalized knowledge governance, enabling organizations to communicate DT-enabled emissions decisions and enforce stakeholder-based disclosure practices.

Methodologically, we conduct a comparative qualitative content analysis of documents published between 2020 and 2024, a period of intensified digitalization and sustainability initiatives in European ports. At this stage, ports have expedited digitalization and remote operational capacities to ensure continuity in the face of mobility restrictions and supply-chain disruption. Meanwhile, extended digital interfaces and decentralization of workflows enlarged the cyber-attack area, exposing the system and its vulnerabilities to phishing, ransomware, and other attacks. These changes enhanced resilience, transparency and safe data governance. Two cases, Rotterdam and Hamburg, are purposively selected following Neugebauer et al. (2024) based on their DT maturity. We combine automated thematic mapping using Leximancer (Smith and Humphreys, 2006) with manual interpretive coding, coupling computational breadth with contextual depth to identify dominant themes and to interpret how cybersecurity and KM are framed and disclosed as enablers of digital governance and the net-zero transition.

The principal contribution of this study is its conceptualization of cybersecurity governance as a valuable form of organizational knowledge that can be reused within digital transformation-enabled port ecosystems. By framing cybersecurity events and governance procedures as signals for organizational learning, the study elucidates the processes by which such knowledge can be codified, disseminated and disclosed through KM mechanisms in digitally interconnected operational settings.

This study is primarily grounded in a KM perspective on how ports in DT-enabled environments manage cyber security information and organizational learning processes. KM theory focuses on the development, codification, sharing and reusing of organizational knowledge to enhance decision-making, operational coordination and adaptability. In highly digitalized port ecosystems, cybersecurity events and governance activities create valuable knowledge about vulnerabilities, operational risks, incident response and system reliability. Therefore, cybersecurity governance in a DT environment requires organizational mechanisms to turn cyber-related information into reusable knowledge resources.

In addition, the study selectively relies on stakeholder and legitimacy arguments to back this central KM position. The stakeholder-driven governance approach implies that the disclosure of cybersecurity information is important for organizations to minimize information asymmetry and to show accountability to regulators, investors, supply chain partners and other stakeholders. However, these perspectives do not provide an independent theoretical basis but are used as explanatory mechanisms. Similarly, resilience is not treated as an independent theoretical framework, but as an operational implication of cybersecurity-related KM practices in digitally connected port systems.

We define the intersection of cybersecurity and KM in DT-enabled port ecosystems. Maritime digitalization is accelerating and, with it, the complexity and interconnection of port information systems also (Schinas and Metzger, 2023). In such contexts, cybersecurity must be conceived not only as a suite of technical controls, such as encryption, multi-factor authentication, systematic patching and hardening, but also as an organizational capability governed through policies, risk assessment, training and compliance with regulatory frameworks including network and information systems directive 2 and general data protection regulation (Cheung et al., 2021; Mehmood et al., 2019; Nankya et al., 2023; Ometov et al., 2018; Progoulakis et al., 2023; Senarak, 2024; Tam et al., 2021). When this sociotechnical alignment is weak, operational inefficiencies emerge and may translate into longer waiting times, additional rework and ultimately higher emissions, thus diluting the environmental promise of digitalization (de la Peña Zarzuelo, 2021).

In this study, we define KM as the systematic ability by which organizations generate, codify, share and institutionalize as well as reuse knowledge to facilitate coordinated action and adjustment (Nonaka and Takeuchi, 1995; O’Dell and Grayson, 1998). Whereas other similar views like the organizational learning and dynamic capabilities accentuate adaptation in the face of uncertainty, KM anticipates the artefacts, routines, repositories and governance organizations that make knowledge enduring and transferable across the organizational boundaries. This structured knowledge ability in DT-enabled ports defines whether cybersecurity knowledge will still be episodic reactions or be institutionalized as an operational and environmental performance driver. In practice, this involves documenting incident response playbooks and threat models, maintaining lessons-learned repositories and security bulletins, institutionalizing after-action reviews and cross-functional exercises and monitoring coverage and reuse through simple metrics such as time-to-codify, adoption rates of updated procedures, near-miss capture and the speed with which knowledge propagates across units (O’Dell and Grayson, 1998; Wang and Wang, 2019).

This study builds upon the KM perspective and considers cybersecurity governance as a source of reusable organizational knowledge. In the digitally connected port ecosystems, such knowledge can be incorporated in organizational routines, port governance practices, training programs and disclosure processes to enable operational coordination and communication with stakeholders. While the adoption of DT, cybersecurity governance and KM practices have been studied separately, the combination of these within stakeholder-oriented disclosure processes has not been investigated.

Theoretical perspectives converge on the same implication. Stakeholder theory explains how environmental and social imperatives are translated into firm-wide action and legitimacy (Calderaro and Craig, 2020; Papa et al., 2021; Sahoo, 2024). Socio-technical systems [ship-to-ship (STS)] theory emphasizes the inseparability of human, organizational and technological elements in secure digital infrastructures (Bostrom and Heinen, 1977; Troyer, 2017). The knowledge-based view (KBV) treats knowledge embedded in people, routines and infrastructure as a strategic asset for adaptation under uncertainty (Alvarenga et al., 2020). In DT-enabled ports, cybersecurity delivers sustainability value when it is embedded in institutionalized KM that reliably carries learning into operational decisions.

Cyber incidents generate operational knowledge about vulnerabilities, responses and system dependencies. The value of this knowledge depends on both technical protections and the organization’s ability to codify, share and reuse it. Organizations that document and distribute cyber events and insights are better able to refine their procedures, reducing delays, fuel use and emissions. Table A1. (see  Appendix) Outlines the main constructs and their implementation in DT-Enabled ports.

Operational resilience is increasingly important in digitalized port ecosystems where operations rely on interdependent digital infrastructures and ongoing data exchange (Salvi et al., 2022). In this context, resilience is defined as the capacity of organizations to predict, to absorb and recuperate interruptions and to continue functioning. In DT surroundings, this ability is strictly connected with cybersecurity governance and KM. Cyber incidents, vulnerabilities and threat-intelligence signals create learning opportunities which when recorded and shared in the KM mechanisms such as training, procedures and knowledge sharing have the potential of enhancing organizational preparedness and adaptive capacity (Faleiro et al., 2021).

In DT-enabled ports, sustainability gains depend on much more than simulation and predictive analytics. They require secure data governance and a KM capability that can keep pace with dynamic, high-volume information flows. Moving beyond reactive mitigation, many organizations adopt proactive methods such as threat modeling, which systematically identifies and analyzes potential vulnerabilities in maritime cyber-physical systems and informs anticipatory defenses that evolve as the threat landscape changes (Erbas et al., 2024; Yu et al., 2023). KM makes these approaches operational by integrating explicit knowledge, such as policies and incident logs, with tacit operator expertise, so that vulnerability identification, adaptive defense and sustainability goals are aligned rather than sequential (Uden and He, 2017). AI and machine learning augment KM by detecting complex patterns and issuing early warnings before cyber disruptions degrade operational or environmental performance (Leoni et al., 2024).

Experiences related to cybersecurity gain value when embedded within routines, governance protocols, repositories, training initiatives and mechanisms for cross-functional knowledge sharing. This approach expands traditional discussions of cybersecurity beyond technical risk management by underscoring the organizational processes that enable the retention and reuse of cyber-related knowledge in digitally transformed environments.

Efficiency relates to turnaround times, throughput and resource utilization; reliability concerns the consistency and predictability of services; and safety and security compliance reflect adherence to applicable laws and best practices designed to protect people, assets and the environment (Chlomoudis et al., 2024; World Bank, 2021, 2025; Yang et al., 2014). Safety focuses on preventing accidental harm and benefits from indicators such as incident rates, near-miss reporting and compliance measures, while security focuses on intentional threats and depends on posture, audits and response readiness (Tseng and Pilcher, 2017; UNCTAD, 2022). KM links cyber learning to operational decisions that have emissions implications.

Despite conceptual clarity, an operational gap persists. There is still limited empirical evidence on how proactive cybersecurity approaches such as threat modelling are combined with KM in day-to-day practice in DT-enabled ports, and with measurable effects on resilience, stakeholder confidence and environmental performance. Table A2. represents the port performance dimensions where KM-cyber links to environmental outcomes (see Table A2 in the  Appendix).

The International Maritime Organization has required that cyber-risk management be embedded within safety management systems (de la Peña Zarzuelo, 2021). In parallel, ports remain critical infrastructures with non-trivial environmental impacts, variously estimated to account for a meaningful share of global GHG emissions, so that digitalization and DT adoption in particular, act simultaneously as levers for operational resilience and environmental accountability (Di Vaio et al., 2025a, 2025b, 2025c; Notteboom et al., 2022).

Cybersecurity measures produce knowledge that is central to digital governance. Explicit elements include policies, incident logs, threat models, configuration baselines, audit trails and documented response procedures; tacit elements comprise operator expertise, anomaly recognition and contextual judgment under time pressure. Effective KM captures, protects, stores, disseminates and reuses this knowledge so that vulnerabilities are identified earlier, defenses can adapt and decision-making improves without compromising confidentiality (Alsehrawy et al., 2022; Di Vaio et al., 2025a, 2025b, 2025c; Uden and He, 2017).

This study uses stakeholder and legitimacy perspectives to elucidate the disclosure dimension of cybersecurity-related KM practices. Within digitally interconnected port ecosystems, organizations encounter heightened expectations from regulators, investors, logistics partners, and other stakeholders regarding transparency in cybersecurity governance and digital risk management.

From stakeholder and legitimacy standpoints, disclosure functions as a governance tool rather than a procedural requirement. In this research, credible disclosure is conceptualized as the reporting of tangible process evidence rather than declarative statements. In contrast, process evidence encompasses observable routines and artefacts such as named incident-response procedures, after-action reviews, formal training programs, knowledge repositories, reuse metrics or cross-functional governance boards.

Reports that describe concrete processes, naming the artifacts that store knowledge, the learning loops that spread it and the reuse or coverage measures that track it, help stakeholders evaluate whether ports are credibly translating cyber learning into operational and environmental outcomes (Bebbington et al., 2008; Dowling and Pfeffer, 1975; Freeman, 1984; Higgins et al., 2018; Suchman, 1995). However, a port-specific reporting architecture that integrates cybersecurity, KM, DT use cases and environmental indicators is still nascent, which limits comparability and assurance (de Vicente-Lama et al., 2023; Homayouni et al., 2025). The International Association of Ports and Harbors (IAPH) Cybersecurity Guidelines emphasize structured staff training and organizational awareness as foundations of governance, and these principles appear in public communications by ports such as Hamburg (IAPH, 2021; Port of Hamburg, 2021). Yet disclosures frequently under-specify the concrete training programs, the cadence and content of cyber drills and the measures used to monitor learning and reuse. The summary of how credible disclosure looks like and the common gaps noted in practices is represented in Table A3 (see  Appendix).

By reading sustainability reports and strategic documents through the lenses of stakeholder and legitimacy theory, and by treating KM as the capability that institutionalizes cybersecurity learning, the analysis can identify when public disclosures provide sufficient process evidence to support credible claims about how digital resilience underpins environmental performance.

Figure 1 shows the theoretical framework of this study.

This study uses a qualitative content analysis to explore how European ports disclose cybersecurity and KM practices within fully implemented DT environments, addressing key research gaps related to the integrated management and communication of these domains in support of decarbonization and stakeholder engagement (Alamoush et al., 2022; Cunha et al., 2025; Di Vaio et al., 2025a, 2025b, 2025c; Heilig and Voß, 2017; Neugebauer et al., 2024; Wang and Li, 2023).

Content analysis is a well-established methodology for examining corporate disclosures, enabling the systematic identification of thematic patterns and textual relevance, particularly in sustainability reporting research (Guthrie et al., 2004; Lozano and Huisingh, 2011; Steenkamp and Northcott, 2007; Torelli et al., 2019; Unerman, 2000). Integrating both quantitative and qualitative approaches (Beck et al., 2010), this study combines automated thematic extraction via Leximancer (Version 5) with manual interpretative coding to provide computational rigor alongside contextual depth.

Following Neugebauer et al.’s (2024) framework on DT maturity, two case studies, Rotterdam and Hamburg, were purposively selected as the only European ports with fully implemented and comprehensive DT systems. This choice facilitates an in-depth investigation of how cybersecurity and KM practices are operationalized and disclosed in advanced digital environments to enhance operational resilience, stakeholder legitimacy and GHG emissions reduction. The selection of these two case studies is intended to enable analytical generalisation rather than statistical representativeness, allowing for the identification of recurring patterns across advanced digital port environments (Ghemawat and Khanna, 2003). Accordingly, the 2 × 2 typology was used as a heuristic framework to compare disclosure patterns across the two port cases in relation to cybersecurity governance depth and KM maturity.

The empirical data set comprises 36 documents, including sustainability reports, digital transformation roadmaps and innovation strategies published between 2020 and 2024. This period corresponds to a pivotal phase marked by accelerated digitalization in European ports, influenced by policy drivers such as the European Commission’s Sustainable and Smart Mobility Strategy (European Commission, 2020), technological advancements and increasing environmental commitments.

Data collection involved a systematic review of official port websites to retrieve relevant disclosures between June and October 2025, encompassing DT adoption, cybersecurity, KM practices and environmental strategies. In fact, the study does not directly observe internal organisational practices, but it rather focuses on how ports publicly communicate and make visible cybersecurity, KM and DT-enabled governance. This choice is grounded in the relevance of public disclosures as analytical sources, as they reveal how ports construct accountability and legitimacy toward stakeholders by communicating strategic priorities, responsibilities and governance commitments. Nevertheless, the integration of multiple secondary data sources, combined with the sequential use of automated and manual content analysis, enhances the credibility and depth of the findings (Di Vaio et al., 2025a, 2025b, 2025c). Although these disclosures do not directly reveal internal practices, they remain analytically relevant as they reflect how organisations signal priorities, accountability and resilience to external stakeholders (Landrum and Ohsowski, 2018; Torelli et al., 2019; Di Vaio et al., 2025a, 2025b, 2025c). To maintain a focused analytical scope, decarbonization is treated as an outcome dimension rather than as an independent analytical pillar.

These documents represent rich knowledge artefacts that encapsulate organizational narratives, policy responses and innovation pathways (Table 1).

All documents were archived and catalogued to ensure traceability and replicability of the data set. Inclusion criteria comprised publicly available documents explicitly addressing digitalization, cybersecurity, KM practices or environmental strategies, while purely financial or non-relevant communications were excluded.

The content analysis was structured along three dimensions: cybersecurity, focusing on management of cyber risk, data security and resilience linked to digital infrastructures supporting GHG reduction (ENISA, 2022); KM, investigating collaborative knowledge flows, learning and decision-making in carbon reduction (Del Giudice et al., 2017; Nonaka and Takeuchi, 1995); and GHG emissions, analysing DT applications for tracking and reducing emissions in port operations (Alamoush et al., 2022; Di Vaio et al., 2025a, 2025b, 2025c).

To strengthen coding reliability, the four authors adopted a structured cross-check procedure. Author 1 and Author 2 independently coded the full data set using the theory-informed codebook developed from the literature and refined through the exploratory Leximancer outputs. Specifically, the codebook is structured around cybersecurity governance, KM routines and artefacts, DT-enabled operational knowledge flows and stakeholder legitimacy. To ensure consistency across heterogeneous disclosure formats, the codebook distinguished between explicit evidence, including references to training, procedures, cybersecurity initiatives and inter-organisational knowledge-sharing mechanisms, and implicit evidence, including references to data-driven coordination, real-time information exchange and digitally embedded learning processes. Author 3 and Author 4 subsequently reviewed and validated the coding outputs, focusing on the consistency of category attribution, the interpretation of ambiguous evidence and the alignment between the final categories and the theoretical framework. Cases of disagreement or uncertain classification were discussed collectively among the authors until consensus was reached. Through this iterative process, the codebook was progressively refined by clarifying category definitions, inclusion criteria and illustrative examples.

The analysis followed a sequential integration workflow in which automated outputs informed theory-driven manual coding. Leximancer (version 5) facilitated automated thematic coding, identifying clusters of related concepts and visualizing key themes and their interrelationships (Crofts and Bisman, 2010; Smith and Humphreys, 2006). The software is used as an exploratory mapping tool to identify patterns of word co-occurrence and to map the semantic structure of the data set. The aim is to provide a preliminary overview of recurrent concepts and semantic associations, rather than as the main basis for theoretical interpretation. These outputs serve as a preliminary layer of analysis that supports, but does not replace, the interpretative coding process (Di Vaio et al., 2025a, 2025b, 2025c). The authors implemented a systematic procedure before running the analysis, to extract meaningful concepts based on word association and proximity. First, the collected documents were grouped into individual folders corresponding to each selected European port, differentiating between sustainability reports and web content. Second, the files were uploaded into Leximancer (Version 5) and analysed using an unsupervised concept-seeding approach. Common function words and non-informative terms (e.g. “and,” “used,” “based”) were manually removed from the concept seeds to refine the output. Moreover, singular and plural forms of semantically equivalent words (e.g. “port/ports,” “employee/employees”) were consolidated. Third, the software generated concept maps using default map generation settings, illustrating the main themes and their interrelationships within the analysed materials (Figure 2).

While Leximancer provides valuable support for automated text analysis, the core analytical contribution of the study derives from the manual comparative coding. Conducting a manual content analysis using a set of keywords commonly adopted in the literature is essential to deepen the interpretation of results and to clarify how port authorities disclose and manage critical digital infrastructure, with particular emphasis on data security and knowledge flows within the port ecosystem (Engstrom et al., 2022). To enhance the reliability of this manual coding process, a double-coding approach was applied, whereby two independent coders examined the same data set and subsequently compared their outputs to resolve discrepancies. As evidenced in Table A4 in the  Appendix, to enhance transparency and replicability, the authors operationalised the 2 × 2 typology (Cybersecurity Governance Depth and KM Maturity) through explicit scoring criteria. Cybersecurity governance depth was assessed based on the extent to which ports disclosed structured and coordinated practices, including monitoring systems, incident response mechanisms and inter-organisational initiatives (e.g. cyber resilience networks). KM maturity was evaluated by considering both explicit references and implicit evidence of knowledge processes, such as training activities, knowledge-sharing platforms and the integration of learning mechanisms within digital and operational workflows. Each dimension was coded on a binary scale (low/high) based on the presence of isolated versus systemic and embedded practices, ensuring consistency across cases despite heterogeneous disclosure formats. Each category was defined with inclusion criteria and illustrative examples to enhance coding consistency and replicability. The following keywords were selected based on an analysis of the existing literature: “digital,” “digital-twin,” “smart-ports,” “cybersecurity,” “security,” “knowledge,” “knowledge-management,” “knowledge-sharing,” “technologies,” “decarbonization.”

The analysed European ports do not rely on a uniform reporting framework. Instead, most relevant information, particularly concerning digitalization efforts, is disclosed through website pages, which tend to be more up-to-date and reflective of ongoing technological developments compared to formal sustainability reports. Hence, the manual content analysis was conducted on all the selected non-financial disclosures (NFDs), including reports, website pages and innovation strategies, to capture a more comprehensive and current picture of ports’ digital and sustainability practices.

Figure 3 shows the “WordCloud” generated from the 50 most frequent words identified across the selected sustainability reports and website pages. The size of each term reflects its relative frequency within the selected documents. As illustrated, the most prominent words are “smartport,” “digital,” and “authority,” providing an initial descriptive overview of the data set.

Leximancer was used to provide a preliminary overview of how key themes and concepts emerge within ports’ digital and environmental strategies.

The 36 analysed documents produced 10 themes and 50 concepts. The key themes that emerged from the analysis were: port, projects, emissions, risks, environmentally, safety, strategy, possible and employees (Table 2). These themes emerged as the most prevalent within the cluster, as indicated by their high frequency of occurrence and strong connectivity, reflecting their relative importance.

Port is the most relevant theme with the highest connectivity rate. It is related to concepts like “sustainable,” “management,” “climate,” “value,” “infrastructure,” “business,” “development,” and “supply.”

The theme “risks” is central to the analysis, and it is strongly linked with concepts like “impact,” “chain,” “future,” “security,” “digital,” “partners,” and “control.” On the other hand, the theme “safety” emerges as key dimension, associated with concepts like “measures,” “environment,” “information,” and “process” (Figure 4).

The concepts “environmentally,” “sustainable” and “emissions” emerge as highly relevant, suggesting the focus of the selected ports on decarbonization targets and goals (Table 3).

Also, the concept “digital,” which appears in the analysis with a relatively low likelihood, is linked to important concepts like “incidents,” “network,” “data,” “control,” “chain,” “supply,” “system,” “infrastructure,” “security,” and “traffic” (Figure 5).

The co-occurrence of “digital,” “security,” and “supply” suggests a strong association between digitalization and operational processes.

The manual content analysis shows that the selected European ports publicly frame digitalization and DTs as strategic infrastructures for improving efficiency and supporting the net-zero transition. When examined through a KM lens, the reports analysed describe how digitalization initiatives in both ports can implicitly generate and mobilize knowledge flows, indirectly support operational coordination and emissions-related decision-making. In particular, digital technologies are presented as enabling data-driven optimisation of port operations, including traffic management, berth allocation and energy efficiency strategies. The Port of Rotterdam describes the link between digital technologies and data-driven decision-making for emissions monitoring and reduction, and to stakeholder coordination in the energy transition, for instance through tools supporting port call optimisation and real-time traffic management (Port of Rotterdam, 2024a, 2024b). From a KM perspective, the description of these practices suggests an ongoing process of knowledge production and circulation across organisational boundaries (Port of Rotterdam, 2024a, 2024b). Similarly, the Port of Hamburg presents digital solutions such as real-time traffic optimization systems and digital infrastructure projects aimed at improving efficiency and reducing emissions (Port of Hamburg, 2025). While the discourse emphasizes integration, collaboration and continuous refinement, the reference to KM practices remains implicit and is not translated into clearly identifiable organizational learning structures.

Digitalization is thus presented primarily as an infrastructural enabler rather than as a formal knowledge governance system. The analysed documents further emphasize stakeholder collaboration as a prerequisite for implementing digitalization strategies. At the KM level, this emerges through references to knowledge sharing for logistics coordination, energy transition and real-time information exchange, particularly in the case of Rotterdam. Standardized data sharing is associated with greater ecosystem resilience and collective situational awareness. However, the disclosures do not specify formal KM architectures such as shared repositories, structured learning protocols or inter-organizational knowledge governance arrangements, suggesting that knowledge flows remain largely informal or technologically embedded.

The selected documents also describe the development and adoption of DT. Rotterdam’s DT, which integrates container terminal processes and container flows and is being expanded toward autonomous navigation, functions as a platform for combining infrastructural, environmental and logistical knowledge (Neugebauer et al., 2024; Port of Rotterdam, 2025b). From a KM perspective, the disclosures do not clarify how DT – which can be used as knowledge integration device – validates, storages, updates or systematically reuses knowledge over time. Similarly, Hamburg’s BIM-based DT is described as a repository tool where “all relevant data and information are recorded, managed, and exchanged” among project participants. This directly supports the interpretation of the DT as a knowledge integration device, while still avoiding claims about full KM implementation (Port of Hamburg, 2025).

Regarding cybersecurity, the analysed documents highlight increasing strategic attention to digital risks and resilience. The Port of Rotterdam frames digital resilience as a core element of its broader strategy for flexibility, supply-chain continuity and strategic autonomy (Port of Rotterdam, 2025a, 2025b). In this area, KM-related evidence is more explicit than in other dimensions. Rotterdam’s participation in the FERM Foundation’s Cyber Strategy for Dutch Seaports can be interpreted as disclosure-based evidence of inter-organisational knowledge sharing, particularly in relation to threat intelligence, awareness raising and collective cyber resilience (FERM, 2025). Similarly, internal instruments such as codes of conduct addressing phishing and digital risks suggest mechanisms of cybersecurity knowledge codification and dissemination at the employee level (Port of Rotterdam, 2024b). Moreover, Rotterdam describes the secure chain as a collaboration between industry and government aimed at “making port logistics more digitally resilient” (Port of Rotterdam, 2024b). At the sectoral level, the IAPH Cybersecurity Guidelines, promoted also by the Port of Hamburg, describes training and organizational awareness as foundational KM practices for cybersecurity governance (IAPH, 2021; Port of Hamburg, 2021). Nevertheless, despite these strategic references, the analysis reveals a limited disclosure on the operationalization of KM. Information regarding the structure and frequency of cybersecurity training, the presence of formal learning cycles or after-action reviews, the mechanisms for capturing and reusing incident-based knowledge and the use of KM metrics to assess learning effectiveness is largely absent.

The cross-case comparison highlights both convergence and heterogeneity in the analysed ports. As shown by Table 4, both Rotterdam and Hamburg exhibit high levels of digital maturity and strategic integration of cybersecurity within broader governance frameworks. However, differences emerge in the visibility and formalisation of KM practices. Rotterdam describes more explicit forms of knowledge codification and inter-organisational learning, particularly in cybersecurity initiatives, while Hamburg’s KM practices remain more implicitly embedded within the disclosure of digital infrastructures and operational processes. Across both cases, KM is consistently under-disclosed as a formal capability, despite being functionally central to DT-enabled decision-making and emissions reduction.

Hence, the results reveal that the selected ports disclose their digitalization, DTs and cybersecurity practices at strategic level, while KM appears mainly through indirect or embedded disclosure evidence. Cybersecurity-related knowledge is publicly represented through collaborative security initiatives, awareness mechanisms, data-sharing practices and digitally enabled coordination, rather than through explicitly institutionalised KM systems. The limited visibility of structured KM practices suggests a disclosure gap between ambitious digital strategies and the knowledge processes needed to support cybersecurity governance, DT reliability and emissions decision-making.

This study offers insights into how European ports adopting DT disclose cybersecurity and KM practices within the context of the net-zero transition. Regarding the research question, the results suggest that European ports with higher levels of digital maturity increasingly see cybersecurity and KM as mutually supporting capabilities, integrating them into their GHG reduction strategies thereby converging digital innovation, resilience and environmental goals.

The disclosure evidence suggests a possible pathway through which cybersecurity governance, KM mechanisms and DT-enabled workflows may support emissions-relevant decision-making. Cybersecurity-related learning signals may be codified through KM processes and embedded into digital operational routines, contributing to more adaptive and efficient decisions. However, the disclosures do not allow us to assess whether this process is fully institutionalised internally. DT-enabled sustainability may depend not only on technological advancement, but also on the maturity of KM processes that support the capture, sharing and reuse of cybersecurity-related knowledge.

The manual content analysis reveals an increasing disclosure of practices related to data governance, cyber risk management and collaborative knowledge exchange, underscoring their transition toward integrated cybersecurity–KM frameworks. First, the integration of advanced data analytics enhances operational transparency and decision-making by providing deeper insights into port performance (Port of Rotterdam, 2025a, 2025b). Second, digitalization is described as a facilitator of collaborative stakeholder engagement and as an essential enabler for the future energy system by improving energy reliability, reducing costs and accelerating the broader energy transition (Port of Rotterdam, 2025a, 2025b). Third, the deployment of digital platforms, e.g. those supporting just-in-time navigation and berth optimisation, is presented as a pathway through which ports may reduce vessel waiting times, improve supply chain predictability and support emissions-relevant operational decisions (Port of Rotterdam, 2025a, 2025b). The concept of port performance includes aspects like reliability, safety and security compliance (Chlomoudis et al., 2024; Yang et al., 2014). The growing integration of digital technologies challenges ports to balance environmental goals with operational reliability and regulatory compliance, emphasizing the need for governance models that can align performance improvement with resilience and sustainability (World Bank, 2021, 2025).

This multifaceted digitalization strategy aligns with the principles of the STS Theory, which emphasize the inseparability of human, technological and organizational dimensions in shaping complex transformations (Bostrom and Heinen, 1977; Troyer, 2017). The findings suggest that alignment across technological, organisational and human elements may depend on the extent to which cybersecurity-derived learning is institutionalised through KM mechanisms and embedded into operational workflows. Hence, knowledge is central to digital infrastructure effectiveness, but its impact depends on its codification, transfer and reuse across organisational and inter-organisational boundaries.

DTs may enable ports to simulate, monitor and optimize operations while ensuring the integrity, availability and confidentiality of critical data streams (Klar et al., 2023). The cases of Rotterdam and Hamburg Ports indicate that DT deployment is disclosed within port environments characterised by technological readiness, as well as organisational commitment to digital innovation and environmental objectives. These conditions suggest that DTs can function as platforms that may support informed decision-making, secure data flows and collaborative knowledge sharing among stakeholders. The results suggest that ports’ decarbonization efforts may emerge from the interaction of technological capabilities (DT and data analytics), organizational enablers (KM and governance structures) and environmental pressures (regulatory and stakeholder expectations). Consequently, DTs may function as platforms to support secure data governance, collaborative knowledge creation and adaptive decision-making, thus potentially fostering a socio-technical ecosystem in which cybersecurity and KM jointly contribute to sustainability and resilience. The results confirm that the increasing reliance on digital infrastructures amplifies cyber risks. Hence, cybersecurity readiness is described as a core pillar of port safety and security strategies, and in some cases explicitly included in broader strategic plans. Moreover, cybersecurity measures are complemented by KM initiatives, e.g. workforce training, incident reporting and cross-functional learning, that institutionalize awareness and support continuous adaptation. The IAPH’s guidelines promote a cyber-aware culture within the port environment through tailored training, cybersecurity drills and continuous professional development across all functional areas. The analysed disclosure suggests that cyber resilience may depend not only on technical infrastructure but also on organizational learning, human behaviour and a culture of shared responsibility.

These strategies reframe cybersecurity as a shared organizational responsibility requiring a workforce equipped with the necessary understanding of risk indicators, role-based responsibilities and secure digital behaviours. This calls for KM approaches that promote continuous learning, cross-functional knowledge exchange and a culture that prioritizes digital resilience (Shaw et al., 2009). While these results suggest a clear commitment of the selected ports to fostering cyber awareness, the official websites and sustainability reports often lack detailed information on specific training programs, cyber drills or measurable learning outcomes, suggesting a potential gap between strategic intentions and the effective operationalization of KM practices in port cybersecurity governance.

From a legitimacy and stakeholder theory perspective, the findings highlight that disclosures increasingly serve accountability and signalling functions, as ports seek to demonstrate alignment with stakeholder expectations on resilience, transparency and sustainability. However, this study shows that such disclosures vary significantly in their degree of operational grounding. In line with stakeholder theory, value creation in port ecosystems depends on building trust-based relationships with both internal and external actors. Hence, ethical and transparent disclosure practices become essential to meet regulatory demands and to align with broader societal expectations, as emphasized by legitimacy theory. This points to a possible distinction between substantive capability and symbolic legitimacy in disclosure. The authors do not claim to assess substantive capability directly but use the distinction between substantive capability and symbolic legitimacy as an interpretive lens to evaluate the degree of operational detail contained in public disclosures. Specifically, substantive practices may be indicated by the presence of detailed processes, e.g. training routines, incident response mechanisms and knowledge codification practices, which signal the institutionalisation of cybersecurity and KM within organisational structures. In contrast, high-level or generic statements without supporting operational detail suggest a more symbolic orientation aimed at maintaining legitimacy rather than demonstrating actual capability. Importantly, transparent reporting of cybersecurity and KM practices may reinforce the institutional legitimacy of ports by demonstrating accountability, resilience and a commitment to sustainability goals.

In summary, European ports adopting DTs exhibit a growing tendency to integrate cybersecurity and KM as mutually reinforcing enablers of sustainable and resilient governance. The limited visibility of KM operationalisation in the analysed disclosures can be interpreted in two complementary ways. On the one hand, it may reflect a capability gap, whereby ports have not yet fully institutionalised structured learning processes despite advanced digital infrastructures. On the other hand, it may represent a strategic nondisclosure choice, given the sensitivity of cybersecurity-related knowledge and competitive considerations. Since the data set is based on publicly disclosed reports, the analysis does not allow us to determine which explanation prevails. Rather, the evidence points to the possibility that KM under-disclosure may result from insufficient institutionalisation, deliberate nondisclosure or a combination of both.

Regardless of the underlying rationale, the limited visibility of KM operationalisation is analytically relevant because it suggests that, although ports increasingly disclose advanced digital infrastructures, cybersecurity initiatives and DT-enabled governance, the mechanisms through which cybersecurity-related knowledge is codified, shared, reused and embedded into organisational routines remain weakly specified. This points to the under-disclosure of KM as a formal organisational capability, despite its central role in supporting digital resilience and DT-enabled decision-making. Nonetheless, the absence of standardized reporting frameworks continues to limit the comparability and transparency of such disclosures. Developing a coherent, port-specific disclosure model that integrates cybersecurity, KM and DT-enabled environmental indicators would not only strengthen accountability but also enhance stakeholder trust and legitimize sustainable digital transformation across the European port sector.

This study contributes to the emerging literature at the intersection of digitalization and environmental sustainability in the port sector by investigating how European ports disclose cybersecurity and KM practices as part of their decarbonization strategies. Drawing on the STS, KBV, stakeholder and legitimacy theories, the findings provide a multi-theoretical lens to better understand the strategic and operational role of DTs in shaping sustainable and resilient port ecosystems. The STS perspective underscores that digitalization in ports is not solely a matter of adopting technological infrastructures, but rather a process embedded in the interrelation between technical systems, human competencies and organizational structures (Bostrom and Heinen, 1977; Troyer, 2017). The findings align with recent conceptualizations of DT-enabled ecosystems as socio-technical environments where cyber-physical integration, data analytics and human expertise converge to enhance sustainability performance and adaptive capacity (Klar et al., 2023).

Ports with higher digital maturity implement digital infrastructures to enhance transparency, stakeholder coordination and real-time monitoring. In line with the KBV theory (Alvarenga et al., 2020), the study suggests that digitalization serves as a strategic enabler of knowledge creation and dissemination across the port ecosystem. More specifically, the study contributes by conceptualizing cybersecurity governance not only as a technical safeguard or risk-control function, but also as a potential source of reusable organizational knowledge within DT-enabled environments. This perspective extends KM scholarship by showing that, in digitally intensive and multi-stakeholder infrastructures such as ports, cybersecurity-generated knowledge can become a reusable organisational resource when it is codified, shared and embedded into DT-enabled governance processes. The integration of cybersecurity into port governance frameworks and the growing emphasis on cross-functional training and cyber-awareness campaigns indicate how cybersecurity-related learning signals may be codified, shared and reused through KM mechanisms to support digital resilience. In this sense, the study further clarifies that the reliability of DT-enabled environments depends not only on protecting data through cybersecurity measures, but also on transforming protected data and cybersecurity-related signals into actionable organisational knowledge through KM processes.

This reinforces the view of knowledge as a critical asset for organizational adaptation, especially under conditions of technological and environmental uncertainty. Moreover, by embedding KM into cybersecurity governance, disclosures suggest that ports increasingly frame cybersecurity governance as evolving from reactive risk mitigation toward more proactive and knowledge-oriented approaches, strengthening their capacity to predict, absorb and recover from disruptions (Erbas et al., 2024; Yu et al., 2023). Stakeholder and legitimacy theories are used as supporting lenses to explain why disclosure matters, particularly in relation to increasing stakeholder expectations for transparency, data protection and sustainable performance. Hence, data protection and cybersecurity readiness are acquiring growing importance among port stakeholders, shaping disclosure practices through which ports publicly communicate cybersecurity-related KM processes to demonstrate accountability, credibility and alignment with stakeholder expectations. Finally, by combining insights from STS, KBV, stakeholder and legitimacy theories, this study supports the conceptualization of ports as dynamic STSs where KM-cyber practices operate as complementary mechanisms for maintaining digital resilience, stakeholder legitimacy and environmental integrity.

Placing KM at the heart of port operations highlights the process by which DT-enabled ports publicly frame cybersecurity signals as knowledge resources that support operational coordination and governance. From a managerial perspective, the introduction of KM indicators in ports’ public disclosure could be beneficial to monitor cybersecurity learning processes, e.g. frequency of cybersecurity training sessions, participation rates in awareness programmes, documentation of lessons learned from incidents. Ports could benefit from reporting specific mechanisms through which cybersecurity knowledge is codified, shared and reused, including training routines, participation in awareness programmes, incident-learning processes, knowledge-sharing structures and indicators capturing the reuse of lessons learned across organisational units.

To improve transparency and comparability, port managers could adopt structured disclosure formats that explicitly report cybersecurity training activities, incident-learning routines, knowledge-sharing initiatives and the role of digital systems in supporting emissions-related decision-making. Finally, the experience of digitally advanced ports offers a roadmap for scaling innovation and capacity-building across the sector. By leading pilot projects, participating in digital corridors and forming knowledge partnerships with different stakeholders, ports could facilitate the diffusion of best practices and support smaller ports in their digital transitions. Establishing cross-functional governance mechanisms, like cybersecurity learning committees or periodic reviews following incidents, could further ensure that cybersecurity insights are systematically integrated into operational and DT-enabled decision-making processes. Policy support, including targeted incentives and technical guidelines, can further amplify these efforts, positioning ports as key enablers of the maritime industry’s broader decarbonization and digitalization goals.

This study presents limitations that could be explored by future research. First, the reliance on secondary data, e.g. NFDs, may limit the accuracy and comprehensiveness of the findings. While sustainability reports and official communications provide valuable insights into organisational priorities and strategic orientations, they primarily reflect narrative representations rather than direct observations of internal practices. Therefore, the findings provide insights into how ports publicly represent governance patterns, knowledge processes and digital integration, but they do not allow for definitive conclusions about the actual internal implementation or operational effectiveness of these practices. Furthermore, the limited disclosure of KM operationalisation also restricts the extent to which the study can assess how cybersecurity-related knowledge is codified, shared, reused and embedded into organisational routines. Second, the study concentrates on the most digitally advanced European ports, specifically those with a current DTs, potentially limiting the generalizability of the findings. Ports that have not yet integrated DTs in their systems may exhibit different practices due to varying levels of technological readiness, resource availability or regulatory frameworks. Third, the analysis is geographically confined to the European context, which may not fully capture the diversity of practices adopted by ports in other regions. While Leximancer offers automated and objective insights, the manual content analysis component may introduce interpretative bias. In addition, the absence of uniform reporting frameworks across the analysed ports may have limited the comparability of their disclosures.

This study highlights how European ports publicly frame KM as a central component of cybersecurity governance and sustainability-oriented digital transformation within DT-enabled environments. The results suggest that ports disclose varying levels of cybersecurity governance depth and KM maturity, particularly when learning processes are explicitly codified, shared and embedded within DT-enabled operational narratives. A key insight is that disclosures linking KM with digital infrastructures may reinforce narratives of technical capability and stakeholder legitimacy. In ports such as Rotterdam and Hamburg, the disclosures suggest that KM-related mechanisms, transparent data governance and stakeholder engagement may contribute to system resilience and trust, although the extent of their internal operationalisation cannot be directly assessed from public reports alone. However, the limited disclosure of KM operationalisation also indicates that caution is needed in interpreting these findings. Such under-disclosure may reflect insufficient institutionalisation of KM routines, strategic nondisclosure due to the sensitivity of cybersecurity-related knowledge, or both. Accordingly, this study interprets KM under-disclosure as a meaningful disclosure pattern rather than as direct evidence of either organisational weakness or deliberate opacity.

Furthermore, collaborative stakeholder involvement and well-structured KM processes for cybersecurity awareness are crucial for advancing the digitalisation of ports and securing resilient, sustainable maritime governance. In this context, future research should adopt multi-method approaches to triangulate disclosure-based evidence with additional qualitative and quantitative data sources, e.g. interviews, internal documents, operational indicators, incident and business continuity metrics and longitudinal data. This would allow future studies to validate and extend the present findings by assessing not only how cybersecurity governance and KM practices are publicly represented, but also how they are internally implemented, operationalised and developed over time. Extending the analysis beyond European ports and including less digitally mature contexts would also enhance the generalisability of findings and provide comparative insights into different stages of digital and organisational development.

The authors would like to thank the Editor-in-Chief, Associate Editor and reviewers for their helpful comments and suggestions, which helped improve the article. This study is an outcome of the “Blue Shipping & Cruise Laboratory” (BSCLab), Department of Law, University of Naples Parthenope, Naples, Italy.