ENISA reveals the State of Cybersecurity in the Union | ENISA
As the cyber ecosystem is in flux, the 2026 edition of the biennial report introduces a ‘strategic compass’, reflecting the main directions of the EU cybersecurity ecosystem and sets out actionable policy recommendations identifying areas for improvement.
As the cyber ecosystem is in flux, the 2026 edition of the biennial report introduces a ‘strategic compass’, reflecting the main directions of the EU cybersecurity ecosystem and sets out actionable policy recommendations identifying areas for improvement.
ENISA Executive Director, Juhan Lepassaar, said: The State of Cybersecurity in the Union reflects on the EU's collective effort and determination to become more resilient.
However, challenges persist and recent developments not only in frontier AI models but also cyber incidents in refrigeration systems across the EU underline the operational gaps and the need for timely information sharing and coordination.
There has been progress but now we need to build on this foundation and update our strategies to address the increasingly complex cybersecurity landscape.
Taking a closer look: The Report sets out five key directions for EU’s future, based on which policy recommendations were developed: Intrusion activity remained significant and diverse in 2025 and 2026, while the threat landscape is becoming more complex.
Common situational awareness must be strengthened and alignment in critical sectors policies must be increased, and overall, the EU’s cybersecurity posture has improved, however the entire ecosystem is in flux.
Ideology is the main driver of cyber incidents, geopolitics continue to shape cyber activity, financially motivated activities remain impactful, and hacktivists continue to dominate the volume of attacks.
In parallel, AI acts as a multiplier of offensive and defensive capabilities while AI models’ evolution is accelerating vulnerability discovery and exploitation.
Meanwhile, it is observed that the geopolitical context and technological developments have triggered the launch or update of several initiatives, including the proposal for the Cybersecurity Act 2 and the recent EU Action Plan on Cybersecurity and AI.
What happened
As the cyber ecosystem is in flux, the 2026 edition of the biennial report introduces a ‘strategic compass’, reflecting the main directions of the EU cybersecurity ecosystem and sets out actionable policy recommendations identifying areas for improvement.
ENISA Executive Director, Juhan Lepassaar, said: The State of Cybersecurity in the Union reflects on the EU's collective effort and determination to become more resilient.
However, challenges persist and recent developments not only in frontier AI models but also cyber incidents in refrigeration systems across the EU underline the operational gaps and the need for timely information sharing and coordination.
What changed
There has been progress but now we need to build on this foundation and update our strategies to address the increasingly complex cybersecurity landscape.
Taking a closer look: The Report sets out five key directions for EU’s future, based on which policy recommendations were developed: Intrusion activity remained significant and diverse in 2025 and 2026, while the threat landscape is becoming more complex.
Who is affected
Common situational awareness must be strengthened and alignment in critical sectors policies must be increased, and overall, the EU’s cybersecurity posture has improved, however the entire ecosystem is in flux.
Why it matters
Ideology is the main driver of cyber incidents, geopolitics continue to shape cyber activity, financially motivated activities remain impactful, and hacktivists continue to dominate the volume of attacks.
Technical details
In parallel, AI acts as a multiplier of offensive and defensive capabilities while AI models’ evolution is accelerating vulnerability discovery and exploitation.
Response
Meanwhile, it is observed that the geopolitical context and technological developments have triggered the launch or update of several initiatives, including the proposal for the Cybersecurity Act 2 and the recent EU Action Plan on Cybersecurity and AI.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.