Evolving Cyber Risk Driven by User Credentials and Human Error

Why It Matters

The findings underscore that traditional perimeter defenses are insufficient in remote environments, prompting operators to prioritize identity management and integrated IT/OT security to protect operational continuity and reputation.

Key Takeaways

• Identity‑based attacks represent 69% of observed cyber risks.
• IT/OT convergence expands attack surface on remote sites.
• 20% of users click phishing links; only 11% report.
• Ransomware incidents grew to 7,793 in 2025.
• Multi‑factor authentication and segmentation are recommended controls.

Pulse Analysis

The Marlink report highlights a broader industry trend: as remote operations become more digitized, attackers are abandoning classic malware exploits in favor of credential theft. Identity‑based breaches now dominate, accounting for nearly seven‑tenths of documented incidents. This shift forces organizations to rethink security architectures, moving beyond perimeter firewalls toward robust identity governance, continuous authentication checks, and real‑time monitoring of privileged access. Companies that fail to adapt risk not only operational downtime but also costly reputational damage.

Converging IT and OT environments further complicate defense strategies. Shared infrastructure, undocumented connections, and unmanaged OT assets—present in 30‑40% of surveyed sites—create blind spots that attackers exploit through trusted pathways. Visibility into asset inventories and network segmentation become critical, enabling security teams to isolate OT systems from broader IT traffic. Integrating SOC insights with operational technology monitoring allows for rapid detection of anomalous behavior, reducing the window for attackers to move laterally across critical systems.

Human error remains the weakest link, with phishing simulations showing that one in five users will click a malicious link and only a fraction report the incident. Effective mitigation requires a layered approach: mandatory multi‑factor authentication, regular phishing awareness training, and automated response playbooks. As ransomware continues to rise—evidenced by a 36% increase in incidents year‑over-year—organizations must adopt an identity‑first posture that couples technology with disciplined user behavior. Investing in these measures not only curtails exposure but also builds resilience, positioning firms to maintain operational continuity in increasingly hostile remote environments.