Cyber insights across the whole ship lifecycle

Released on 23 February 2026, Cytur Inc’s 2026 Maritime Cyber Threat White Paper analyses major global maritime cyber incidents recorded in 2024 and 2025 and sets out forecasts for 2026.

Drawing on data from its CYTUR-TI threat intelligence platform, the company outlines how expanding vessel connectivity and satellite communications have widened attack surfaces, directly impacting ship security and operational continuity.

“The incident data from 2024 and 2025 proves that maritime cybersecurity is no longer an ‘option’ but a matter directly linked to a vessel’s ‘right to operate’,” said Yong-hyun Cho, CEO of Cytur.

Cyber resilience

According to the report, threats targeting ship IT and OT interfaces surged by 103% year on year, with ransomware increasingly infiltrating operational technology systems such as ballast water control and engine monitoring. 

The white paper highlights a sharp rise in supply chain and asset forgery attacks, in which vulnerabilities in onboard software and equipment are exploited to compromise multiple vessels simultaneously.

Satellite communication systems have also emerged as critical weak points, with attackers attempting to transmit fabricated commands or manipulate vessel asset data.

Looking ahead, Cytur identifies 2026 as the first year of practical verification under IACS UR E26/E27 regulations, which took effect in July 2024.

As ships contracted under these rules enter delivery phases, compliance will shift from documentation to operational validation.

The report concludes that embedding cyber resilience across ship building, delivery and lifecycle management will be essential to sustaining ship security and safeguarding marine cyber security in an increasingly regulated environment.