Evolving Cyber Risk Driven by User Credentials and Human Error

Marlink has released its Cyber Intelligence Report for Remote Operations 2026, highlighting how evolving cyber threats are increasing the risk of disruption across maritime, energy, enterprise and critical infrastructure sectors.

The report reflects growing exposure to safety, operational, financial and reputational risk as digital dependency increases across remote environments. Based on continuous monitoring from global Security Operations Centres (SOCs) and more than 200 cyber security assessments, it identifies a clear shift in how attacks occur, with key findings including:

• Trusted access and credentials are now primary attack pathways

• Greater IT/OT integration has expanded the attack surface

• The human factor continues to drive initial compromise.

These vulnerabilities allow attackers to exploit trusted access pathways, making incidents harder to detect and increasing the likelihood of cyberattacks resulting in network and operational downtime. Identity-based attacks now dominate, with the report finding that 69% of observed risks were linked to compromised user credentials, compared with 12% related to traditional technical vulnerabilities, signaling a decisive shift in attacker behavior.

According to the report, IT/OT convergence is further expanding exposure across digitalized operations on ships and industrial sites in remote environments on land. In 2025, 60% of assessed sites relied on shared infrastructure,