In 2011, the growing number of pirate attacks prompted several flag states to authorise the use of armed guards aboard vessels. Despite facing the same threat, the United Kingdom, the Netherlands and Italy have adopted three distinct approaches to securing their merchant ships, ranging from the exclusive use of private security companies (PSCs) to the employment of military personnel only. This article conducts a congruence testing of the main theoretical explanations for the use of PSCs on land against UK, Dutch and Italian vessel protection policies. By relying on sequencing as a technique for theoretical synthesis, we develop a multicausal explanation of states' vessel protection arrangements, showing the varying influence of functionalist, ideational, organisational and political drivers of security privatisation at different phases of the policy process.