ENISA: AI turns cyberattacks into an industry and cuts defense time to zero

'The picture is not particularly rosy'

The European cybersecurity agency ENISA has published a report describing the accelerating transformation of cyber threats under the influence of artificial intelligence. 'If you look at the threat landscape, the picture is not particularly rosy,' said the agency's executive director Juhan Lepassaar at a press conference, as reported by euronews.

AI as a 'force multiplier' — for both sides

The report calls AI a 'force multiplier' that expands and accelerates the capabilities of both hackers and defending companies in searching for vulnerabilities. According to researchers cited in the document, the time between the discovery of a vulnerability and its weaponization 'is tending toward zero' — soon companies may have no time left to defend themselves after systems are launched. At the same time, advanced AI shortens the timelines for response and patch release: companies can proactively test systems and fix vulnerabilities before attackers exploit them. The report describes this as a kind of cyber arms race that requires keeping track of new AI models.

Recent incidents as an illustration

The backdrop to the report is a series of recent incidents in Europe: a vulnerability in PHP that led a number of EU governments to temporarily take their websites offline, and a wave of attacks on supermarket refrigeration equipment and blood storage facilities in France and eight other countries, caused by outdated software. It was the refrigeration system incidents, according to Lepassaar, that highlighted 'operational gaps' and the need for timely information sharing. Experts quoted by the outlet note that supermarkets and similar companies traditionally approach cybersecurity through the lens of protecting finances, leaving connected infrastructure to operational departments with different budgets and priorities.

Who attacks and why

According to the report, 57.3% of cyber incidents in 2025 were ideologically motivated by geopolitical events — Russia's war against Ukraine and the conflict in the Middle East — although most of them had limited impact. Another 29.3% were financially motivated, with ransomware remaining the most damaging type of incident for businesses, while the ease of exchanging malicious tools 'fuels a professional criminal ecosystem.' ENISA also records attacks resembling state-sponsored operations, aimed at cyber espionage and the theft of intellectual property. In terms of attack volume, hacktivists dominate the reporting, with their actions consisting mostly of low-impact DDoS operations.

Regulation exists, personnel do not

The EU's regulatory framework is saturated: the NIS2 directive obliges all sectors of the economy to protect critical infrastructure, the Cyber Resilience Act (fully applicable from December 2027) introduces incident reporting through a single portal, and the Cyber Solidarity Act created the European Cyber Alert System, an emergency response mechanism, and the EU Cybersecurity Reserve. However, NIS2, in force since October 2024, has not yet been transposed into the national legislation of all member states. ENISA considers personnel the main problem: according to the NIS Investment 2025 study, 45% of surveyed organizations have difficulty finding cybersecurity specialists, which could give wealthier companies an advantage in the competition for a limited talent pool. The agency calls on member states to expand EU programs in this area.