CGCYBER’s 2026 Cyber Trends Report: The Fundamentals Still Decide the Outcome
What CGCYBER’s Fifth Annual Threat Report Means for Maritime OT, Phishing Defense, and AI Adoption
July 10, 2026 | By Ron Frechette | Founder & Managing Director | CyberSurv
Two days ago, the U.S. Coast Guard Cyber Command released its fifth annual Cyber Trends and Insights in the Marine Environment report.
The numbers are worth sitting with.
Reported maritime cyber incidents rose 17 percent year-over-year. Operational technology featured in 62 percent of Cyber Protection Team missions. Phishing remains the single most common way attackers get in the door.
None of that should surprise anyone who has spent time on a vessel, in a terminal operations center, or in front of a port’s control systems. But the report does something more useful than confirm what practitioners already suspect. It tells us, in CGCYBER’s own words, where the marine environment is still exposed, and where the fundamentals are finally starting to work.
For an industry that carries more than 90 percent of U.S. imports and exports, that combination of findings deserves more than a passing read.
The Numbers Behind the Headline
A 17 percent increase in reported incidents isn’t just a statistic. It’s a signal that the attack surface across the marine environment continues to expand faster than most organizations can secure it.
Operational technology sits at the center of that expansion.
Navigation systems. Cargo handling. Ballast control. Access control. CCTV. These systems were built for reliability, not for defense against a modern threat actor. As they get connected to broader networks, often for entirely legitimate operational reasons, they become part of the attack surface whether anyone intended that or not.
CGCYBER’s Cyber Protection Teams saw that firsthand. OT showed up in 62 percent of their missions this year. That’s not a niche concern anymore. That’s the center of the threat picture.
And phishing hasn’t gone anywhere. It remains the most common entry point into maritime networks, which tells us something important: the biggest risk to most organizations still isn’t an exotic zero-day. It’s a crew member, a shoreside employee, or a contractor clicking the wrong link.
That’s a hard truth, but it’s also good news. Phishing is one of the most preventable risk factors in the entire threat landscape, if organizations invest in the right training and technical controls.
AI Tools Cut Both Ways
One of the more candid findings in this year’s report involves artificial intelligence.
CGCYBER teams observed AI-enabled cybersecurity tools performing extremely well when they were properly configured and trained to understand the organization’s specific network.
They also observed the opposite. Organizations that deployed AI tools without proper configuration ended up with systems that were far less effective at catching malicious activity.
That distinction matters more than the AI conversation usually allows for.
Buying an AI-powered detection platform doesn’t make an organization more secure. Configuring it correctly, tuning it to the environment it’s protecting, and maintaining it over time is what makes the difference.
The same principle applies well beyond cybersecurity tooling. Any AI system, whether it’s watching your network traffic or automating a back-office process, only performs as well as the governance behind it. A misconfigured AI tool doesn’t just underperform. It can create a false sense of security at exactly the moment an organization needs its defenses to be real.
The Fundamentals Still Decide the Outcome
Here’s the encouraging part of the report.
CGCYBER found that baseline cybersecurity posture across the marine environment is improving. Multi-factor authentication adoption is up. Password policy enforcement is stronger. Coast Guard assessors saw fewer successful phishing attempts and fewer successful brute-force password cracking attempts during their evaluations.
None of that requires cutting-edge technology. It requires discipline.
I spent years in the Coast Guard before founding CyberSurv, and one lesson from that time has never stopped being true: the organizations that perform best under pressure aren’t the ones with the newest equipment. They’re the ones that got the fundamentals right, consistently, before the pressure ever arrived.
Maritime cybersecurity works the same way. Patch management, least privilege, MFA, and timely incident reporting to the National Response Center aren’t glamorous. They’re also the difference between an attempted breach and a successful one.
What This Means for FSOs and CySOs
If you’re a Facility Security Officer or Cybersecurity Officer reading this, the CTIME report should shape how you prioritize the next twelve months.
Start with your OT inventory. If you don’t have a clear, current picture of every operational technology system connected to your network, that’s the first gap to close, and it’s foundational to the risk-based approach the Coast Guard has been building toward under 33 CFR Part 101, Subpart F.
Then look at your phishing defenses. Not just the technology, but the training. Every employee and contractor with network access is a potential entry point, and the report confirms attackers know it.
Finally, if your organization has adopted or is considering AI-enabled security tools, don’t treat the purchase as the finish line. Configuration, tuning, and ongoing oversight are where the real security value gets created, or lost.
Final Thoughts
CGCYBER’s report doesn’t describe a maritime industry that’s losing ground. It describes one that’s making real progress on the fundamentals while facing an attack surface that keeps growing, largely through OT.
Both things are true at once.
The organizations that come out ahead over the next year will be the ones that keep investing in the unglamorous basics while being deliberate, not reactive, about how they adopt new technology like AI-enabled defense.
That’s not a compliance exercise. It’s operational discipline, and it’s the same discipline that has always separated organizations that recover quickly from a cyber incident from those that don’t.
Let’s Explore What’s Possible
Understanding where your organization stands against findings like these starts with an honest assessment of your operational technology, your access controls, and your incident response readiness.
That’s exactly what our RiskGuard 365™ Cyber Hygiene Program is built for. Rather than a once-a-year checkup, RiskGuard 365™ gives your organization continuous visibility into the fundamentals CGCYBER just confirmed are working: MFA adoption, patch management, phishing resilience, and incident readiness, so gaps get closed before an assessor, or an attacker, finds them.
We also help maritime organizations through our Maritime Cybersecurity Assessment, Penetration Testing, and Security Leadership Program (SLP™), each designed to build the same operational discipline the Coast Guard is asking the industry to adopt.
If this year’s CTIME report raised questions about where your organization stands, let’s start the conversation.
