I. The classic threat has not disappeared, but it has been contained
Piracy, in the narrow legal sense, is having a noisy but bounded year. The International Maritime Bureau (IMB) recorded 137 incidents of piracy and armed robbery against ships in 2025, up from 116 in 2024 and the highest figure in five years [1]. Yet the headline conceals the structure. The surge is overwhelmingly concentrated in the Singapore Strait, which alone accounted for 80 of those incidents, most of them low-level, opportunistic thefts from vessels under way [1]. The Gulf of Guinea, long the world's most lethal piracy theatre for crews, registered 21 incidents, broadly in line with 18 in 2024, and remained "restricted" in the IMB's own assessment thanks to sustained regional and naval action [1].
TThis matters because it inverts the intuitive picture. The Gulf of Guinea remains dangerous for the people aboard, 23 seafarers were kidnapped there in four separate incidents in 2025, and the IMB flagged a disproportionate rise in the carriage of guns, with 27 gun reports against eight a year earlier [1]. But as a systemic threat to global trade, classic kidnap-for-ransom piracy has been pushed to the margins. It is a crew-welfare and rule-of-law problem of real gravity. It is no longer the thing that moves freight rates in Rotterdam or Shanghai.
Piracy in 2025 is a human tragedy at the edges and a managed risk at the centre. The thing that actually disciplines world trade now sits one tier up: the chokepoint.
II. The Red Sea proved that a non-state actor can tax a chokepoint
The decisive break came not from pirates but from a movement with missiles. From November 2023, Yemen's Houthis attacked commercial shipping transiting the Bab-el-Mandeb and the southern Red Sea, beginning with the helicopter-borne seizure of the car carrier Galaxy Leader on 19 November 2023, whose 25 crew were held for 430 days and released only in January 2025 [2]. The campaign did not need to sink many ships to work. It needed to make the route uninsurable.
It succeeded. The US Defense Intelligence Agency assessed that Houthi attacks caused roughly a 90% collapse in container shipping through the Red Sea between December 2023 and February 2024, with carriers rerouting around the Cape of Good Hope, adding some 11,000 nautical miles, around ten days, and roughly a million dollars in fuel per voyage [3]. The macro signature was unmistakable. Suez Canal revenue fell about 61%, from US$10.2 billion in 2023 to roughly US$4 billion in 2024, on transits down from about 26,400 ships to 13,200 [4]. EIA data show roughly 4.2 million barrels per day still transiting the Bab-el-Mandeb in the first half of 2025, about half the pre-crisis level [5].
A narrow, hard-to-substitute maritime passage through which a disproportionate share of global trade or energy must flow. The Strait of Hormuz carried about 20 million barrels of oil per day in 2024, roughly 20% of world petroleum-liquids consumption [5]. The Strait of Malacca, Bab-el-Mandeb, the Suez Canal and the Turkish Straits complete the short list on which the world economy is, in practice, single-threaded.
That a lightly resourced non-state group could impose a continent-sized detour on global logistics is the strategic lesson of the decade. And the ceasefire did not settle it. After the US–Houthi understanding of May 2025 retired Operation Prosperity Guardian [6], attacks resumed in July 2025: the bulk carriers Magic Seas and Eternity C were both sunk within a week, with at least four seafarers killed and eleven held captive until December 2025 [7]. Traffic has not snapped back. Suez transits in early 2026 were still running about 60% below their pre-crisis baseline [8].
III. The naval response is real, expensive, and structurally insufficient
Western navies answered with two parallel efforts: the US-led Operation Prosperity Guardian (December 2023) and the EU's defensive Operation Aspides (launched February 2024) [6][9]. Aspides has done serious work, by EU Naval Force accounting it has supported over 700 merchant vessels, with more than 410 receiving close protection, and its mandate has been extended into 2026 [9]. But the asymmetry is brutal. Escorting ships one by one across a thousand-mile threat box, with frigates whose interceptor magazines cost orders of magnitude more than the drones they shoot down, is not a model that scales. The naval presence reassures; it does not reopen the route on commercial terms. The market, not the warship, decides when Bab-el-Mandeb is "open", and the market reads insurance.
IV. The next chokepoint is invisible, and it lies on the seabed
While attention fixed on the Red Sea, a second front opened around the infrastructure that carries data rather than cargo. Submarine cables carry an estimated 95–99% of intercontinental data traffic across roughly 570 systems in service worldwide [10]. They break often and mostly by accident, around 150–200 faults a year, the overwhelming majority from fishing gear and dragged anchors [10]. That ordinariness is precisely what makes the cable a perfect grey-zone target: sabotage hides inside the statistics of clumsiness.
The pattern is now established. In February 2024, three cables in the Red Sea were severed, most likely by the dragging anchor of the abandoned, Houthi-struck bulker Rubymar [11]. In the Baltic, the C-Lion1 (Finland–Germany) and BCS East-West Interlink (Lithuania–Sweden) cables were cut near-simultaneously on 17–18 November 2024 [12]; on Christmas Day 2024 the Estlink 2 power cable and four telecom lines between Finland and Estonia were severed, with Finnish prosecutors alleging the shadow-fleet tanker Eagle S dragged its anchor across the seabed for tens of kilometres [13]. NATO responded in January 2025 with Operation Baltic Sentry, deploying frigates, maritime patrol aircraft and naval drones [13]. Attribution, tellingly, remains contested in almost every case, which is the point of the tactic.
The cable cut is the chokepoint attack stripped of its drama: no fire, no casualties, plausible deniability built in, and the same capacity to impose cost on an adversary's economy without firing a recognised shot of war.
V. Conclusion, Read the sea as an economic-security map, not a piracy map
The Institute's assessment is that the analytical frame inherited from the 2008–2012 Somali piracy era is now actively misleading. Piracy is a contained, regionally specific crew-protection problem. The systemic risk has migrated to two classes of fixed vulnerability, the navigational chokepoint and the subsea cable, both of which can be held at risk cheaply, deniably, and by actors who do not need a navy. The common currency of all three threats is not violence but cost: insurance premiums, rerouting fuel, repair queues, data latency.
For a small, open, landlocked and digitally dependent economy, Switzerland being the archetype, three implications follow. First, maritime security is a trade-and-data continuity question that belongs on the economic-security agenda, not solely in the foreign-policy or defence silo. Second, resilience is bought upstream: diversified routing, strategic stock depth, contractual flexibility and redundant connectivity matter more than any flag-state gesture. Third, the cable layer deserves the same seriousness now reserved for chokepoints, mapping dependencies, hardening landing stations, and pressing for the international repair capacity that, today, simply does not exist at the scale the threat implies.
The sea did not become more violent. It became more load-bearing. That is the shift policy must price in.