Strategy Page has a useful round-up of information on the pirates and their operating methods:
The piracy has been a growing problem off the Somali coast for over a decade. The problem now is that there are thousands of experienced pirates. And these guys have worked out a system that is very lucrative, and not very risky. For most of the past decade, the pirates preyed on foreign fishing boats and the small, often sail powered, cargo boats th[at] move close (within a hundred kilometers) [to] the shore. During that time, the pirates developed contacts with businessmen in the Persian Gulf who could be used to negotiate (for a percentage) the ransoms with insurance companies and shipping firms. [. . .]
Big ships have small crews (12-30 sailors). Attacking at night finds most of the crew asleep. Rarely do these ships have any armed security. Ships can post additional lookouts when in areas believed to have pirates. Once pirates (speedboats full of armed men) are spotted, ships can increase speed (a large ship running at full speed, about 40+ kilometers an hour, can outrun most of the current speed boats the pirates have), and have fire hoses ready to be used to repel boarders. [. . .]
Now that the pirates have demonstrated their ability to operate far (over 700 kilometers) from shore, it’s no longer possible to just use naval patrols and convoy escorts. This works in the Gulf of Aden, but father off the Somali coast, there is simply too much area to patrol. With ocean going mother ships, the pirates can operate anywhere in the region. Between the Gulf of Aden, and the Straits of Malacca to the east (between Singapore and Indonesia), you have a third of the worlds shipping. All are now at risk. Convoys for all these ships would require more warships (over a hundred) than can be obtained.
