About Fairway

Founded in 2026 to do one thing

Get working fleets through the Coast Guard's cybersecurity rule — on time, in writing, and without turning your office upside down.

Why we exist

The rule is knowable. Most of the noise around it is not.

When the Coast Guard published 33 CFR Part 101 Subpart F, towing companies started getting two kinds of mail: vague warnings from people who had not read the rule, and proposals with no actual numbers on them. Neither one helps an owner decide what to do on a Tuesday.

We read all of it — every section, every deadline, every clock, every citation you see on this site. Then we turned it into one fixed path a working fleet can actually walk, with the money and the effort named up front. That is the whole company: the rule, taken apart and made usable.

How we are built

One rule, read all the way through

We run the assessment, write all fourteen plan sections, stand as your Cybersecurity Officer of record, and keep the training, drills and annual audit on the calendar — so the obligation lives with us, not on a spreadsheet in your office. A portal tracks every date the rule creates, in plain sight, so your port captain can run it without a compliance background.

Fairway Systems leads the program: the rule, the fourteen-section Cybersecurity Plan, the Cybersecurity Officer of record, the portal and the calendar. Virtus Cybersecurity leads the security work: the assessment, penetration testing, incident response, the technical build of the plan, and the annual independent audit. One contract, one fixed quote, and two firms each doing what they are best at.

Plan language and waiver filings are reviewed by maritime counsel before they go anywhere. We are not a law firm, and nothing here is legal advice — we are the people who own the program and keep it moving.

Why two firms, and who leads what

Honest about it

New company. New rule. Read cover to cover.

Fairway is new, and we will not pretend otherwise. So is the rule — it takes full effect on July 16, 2027, and everyone selling against it is new to it too. What we bring is not a decade of maritime brochures. It is having read this specific rule end to end, built the fixed path through it, and put a plan behind every line.

You run boats. You should not have to become a cybersecurity expert to keep running them. That is our job, and it is the only job we do.

Founders

Who you will be working with

Founder, Fairway Systems

Aaron Henderson

Fairway Systems, what we do

Aaron founded Fairway in 2026 after a career building software platforms, most recently as a lead platform engineer for G2, a billion dollar software company, and running the design studio HelloSavvy. He read the rule end to end, built the fixed path through it, and put a plan behind every line on this site.

He is the person who answers the readiness call, and the reason every claim here carries its citation: he had to learn this rule from zero, so it is written the way he needed it explained.

Founder and CEO, Virtus Cybersecurity

Bogdan Salamakha

Virtus Cybersecurity, www.virtuscyber.com

Bogdan leads Virtus Cybersecurity, an independent security firm in North Royalton, Ohio, with over two decades in incident response, penetration testing and security architecture for Fortune 500 corporations, government agencies and startups.

He believes the best way to protect an organization is to teach it about the threats it faces, which is why he sits on every technical call and signs off every plan before it carries either firm's name.

Industry advisors will be named here as they join.

What you can hold us to

Four promises, in writing

Approved, never certified: There is no certificate under this rule, so we never sell one. We use the rule's own words, and we cite the section behind every claim on this site.
One fixed price, itemized: You get a written quote built line by line from your own fleet, before you sign anything. No rate we cannot show you the math for, and no change-order games later.
Your records are yours: Full export, any time, no questions. Sensitive Security Information is access-controlled, marked, and never emailed — because the law treats it that way, and so do we.
We say when it is not us: If your operation is a candidate for a waiver instead of the full program, or belongs with someone else, we tell you. An honest no is worth more than a bad yes.