What can validators be penalized for?

There are two types of penalties. One is malicious behavior. This is 100% slashing

There is bounty reduction for poor performance. If a validator is offline more than 24 hours or has high latency, there will be a bounty reduction penalty. Important - most severe penalties (slashing) do not come in effect at Phase 2 (on October 1, 2020)