ENISA Report Finds EU Cybersecurity Posture Improving Amid Persistent Threats
Summary
ENISA’s biennial report finds the EU’s cybersecurity posture has improved, but threats remain substantial and capabilities uneven. It recommends stronger cross-border coordination, crisis capacity, critical-infrastructure resilience, supply-chain risk management and upk
Key points
- The 2026 EU Cybersecurity Index averaged 71.53 out of 100, with most Member States reaching a mature posture or above.
- Supply-chain management maturity scored 89.91, while CSIRT maturity scored 54.76 and varied across Member States.
- Intrusion activity remained significant and diverse in 2025 and 2026; hacktivists dominated attack volume, while geopolitical and financial motives also shaped activity.
- The report says AI is amplifying offensive and defensive capabilities and accelerating vulnerability discovery and exploitation.
- Regulatory compliance was reported as the main driver of cybersecurity investment by 70% of critical-sector organizations, while progress across sectors remained uneven.
- The share of countries with a national coordinated vulnerability disclosure policy rose from 7 to 17 since 2024.
- The report recommends improving cross-border coordination, crisis response capacity, critical-infrastructure resilience, supply-chain risk management, and cybersecurity skills.
Article Details
- Publisher
- ENISA
- Report Period
- 2025–2026
- Scope
- State of cybersecurity across the EU, including Member State capabilities, cyber threats, policy, critical sectors, supply chains, and resilience.
- Key Statistics
- The EU Cybersecurity Index average for 2026 was 71.53 out of 100.
- The reported average for Member State supply-chain management maturity was 89.91 points.
- The share of countries with a national Coordinated Vulnerability Disclosure policy increased from 7 to 17 since 2024.
- Regulatory compliance was reported as the main driver of cybersecurity investment by 70% of organisations across critical sectors.
- The cyber skills gap increased by 8% since 2024, according to the World Economic Forum’s Global Cybersecurity Outlook 2025.
- Recommendations
- Improve cross-border and cross-legislative coordination so entities operating across Member States face a coherent environment.
- Fine-tune crisis cooperation, including the involvement and capacity of relevant actors and information sharing.
- Develop critical-sector maturity according to criticality and strengthen resilience strategies, including addressing legacy limitations and supply-chain risks.
- Integrate cybersecurity throughout the value and supply chain, from secure development to secure operations.
- Balance cybersecurity awareness, education, talent hiring and retention, and continuous upskilling and reskilling.