ENISA: the state of cybersecurity in the EU in 2026 – an index of 71.53 and five directions for the future

Europe is becoming more mature in cybersecurity, but the threat remains “significant”. That is the conclusion of the second report on the State of Cybersecurity in the Union, presented on Tuesday, November 10, 2026 by ENISA, the European Union Agency for Cybersecurity. The report is issued every two years, under Article 18 of the NIS2 Directive, in cooperation with the European Commission and the NIS Cooperation Group of the member states.

ENISA Executive Director Juhan Lepassaar said that “there is progress, but now we must build on this foundation and update our strategies”. He noted that developments in the most advanced technologies, but also the incidents involving refrigeration systems across the EU, highlight operational gaps and the need for timely information sharing and coordination. We covered those incidents in our report on the attacks on refrigeration systems, while American agencies had issued a similar warning about attacks on refrigeration controllers. He asked for a stronger common situational picture and more alignment of policies in critical sectors.

The index: 71.53 on average

States’ maturity was measured with the European Cybersecurity Index (EU-CSI), on a scale of 0 to 100. The EU average for 2026 is 71.53 points. Two member states are ranked at the “advanced” level, 22 at “mature” and three at “established”, while none is lower. The top five countries average 79.86 points and the bottom five 60.45.

Strengths are supply chain management by essential and important entities (89.91), research and innovation (79.24) and the implementation of national strategies (66.72). The gaps are in computer security incident response teams (CSIRTs, 54.76), national certification (55.56, with 13 states at low and 14 at high levels), the participation of entities in peer-to-peer information sharing (26.30) and cybersecurity teaching in primary and secondary schools, where only 12 states reach a mature or advanced level, against 21 for higher education (73.59).

The threat level is judged the same as in the 2024 report, because Russia’s war against Ukraine was already factored into the previous assessment and today’s cyber activity is aimed mainly at the parties directly involved, with limited spillover into the EU. The attacks that touch the Union are mostly low-impact distributed denial-of-service (DDoS) attacks. Of the 2025 incidents, 57.3% had ideological motives, 29.3% financial and 5.9% concerned espionage.

A “strategic compass” with five directions

The new report adds a “strategic compass” with five directions on which the policy recommendations rest. The first is effective implementation of legislation, so that businesses operating in several states find a coherent framework. The second concerns operational capacity in crises: the European cyber crisis management Blueprint of 2025 has not yet been used in a real crisis, and it has not been defined how European networks will cooperate in a structured way with their military counterparts. The third is critical infrastructure, where 70% of organisations say that compliance with legislation is the main motive for investing in cybersecurity.

The fourth direction concerns dependencies in the supply chain: countries with a national coordinated vulnerability disclosure policy rose from 7 to 17 since 2024, and the NIS Cooperation Group approved in early 2026 the ICT supply chain security toolbox. The fifth is long-term resilience through awareness, skills and education, as the cybersecurity skills gap widened by 8% since 2024, according to the World Economic Forum’s Global Cybersecurity Outlook 2025.

On policy, the report records the implementation of the NIS2 Directive, the Cyber Resilience Act and the Cyber Solidarity Act, and the proposal for a second Cybersecurity Act. The European cybersecurity reserve now extends its support to Moldova and Ukraine. The full findings are available in ENISA’s press release.