Marlink’s 2026 cyber intelligence report finds that 82% of detected maritime cyber alerts occurred in crew network zones, putting shipowners under pressure to improve visibility across connected IT and operational systems. The findings also show that 60% of assessed sites and vessels relied on shared IT/OT infrastructure that was poorly documented or inadequately secured.
The figures come from more than 200 cybersecurity assessments conducted by Marlink, including 160 technical security tests and red-team engagements across maritime, offshore and critical infrastructure environments. The report provides a view of where cyber exposure is being detected across vessel networks, while noting that its findings are indicative rather than a measurement of global cyber activity.
For shipowners and managers, the concentration of alerts in crew networks is significant because these environments can provide pathways into other connected vessel systems. Marlink found that 17% of alerts were detected in network support environments, while fewer than 1% were attributed to OT/ICS.
The low OT figure does not necessarily mean those systems face less risk. The report says limited visibility across legacy OT environments may leave threats harder to detect, with potential consequences for vessel operations, safety and regulatory exposure.
Identity is another major concern. Compromised credentials accounted for 69% of identified risks, compared with 12% linked to vulnerability exploitation. In controlled phishing simulations, 20% of recipients clicked malicious links.
Marlink’s President, Marlink Cyber, Nicolas Furge, said: “Compliance is important, but it is only the starting point.” The report calls on organisations to focus on detecting attacks, responding effectively and maintaining operations when disruption occurs.
For maritime operators, the report recommends separating crew, business and OT networks, building visibility through passive OT monitoring and assessing technical and governance gaps before incidents occur.
Its outlook also identifies identity, digital supply chains, connected physical systems and AI-enabled attacks among the trends expected to shape maritime cyber risk in the coming years.
