The key facts

  • ENISA rated the level of cyber threats to the EU as 'substantial' based on the 2025–2026 period
  • Ideologically motivated activity accounted for the largest share of incidents, mainly DDoS attacks by hacktivists
  • AI is being used for phishing, deepfakes, automated vulnerability discovery, and malware development

ENISA: threats remain 'substantial'

The European Union Agency for Cybersecurity (ENISA) on Tuesday published its biennial report State of Cybersecurity in the Union, in which it rated the level of cyber threats to the European Union as 'substantial'. According to the agency, malicious intrusion activity remained significant throughout 2025 and 2026, and organisations remain exposed to direct attacks and compromises through recently discovered vulnerabilities. Despite the overall improvement in the cybersecurity situation in the EU, the agency believes the ecosystem remains unstable and requires stronger coordination and preparedness.

Who attacks and how

Geopolitical events continue to shape the nature of cyber activity against EU member states. Ideologically motivated activity accounted for the largest share of observed incidents, although such attacks usually had limited consequences. In terms of the volume of recorded attacks, hacktivist groups dominated — mainly DDoS operations against government administrations, transport, and business services. At the same time, state-linked groups continued cyber-espionage campaigns against the government structures of member states to gather strategic intelligence and potentially steal intellectual property.

AI amplifies familiar attack methods

ENISA singled out the growing role of artificial intelligence: technological progress is reinforcing traditional attack methods. Malicious actors increasingly use AI to craft convincing phishing emails, realistic fake videos and audio recordings, automate vulnerability scanning, and develop malware. AI is also involved in voice phishing and online impersonation fraud. In addition, some attackers exploit the popularity of generative AI by creating fraudulent websites to distribute malware.

Five priorities

The report identifies five strategic priorities for strengthening the EU's cyber resilience: effective implementation of legislation, full operational capability during crises, enhanced preparedness to protect critical infrastructure, management of supply chain risks and cross-border dependencies, and long-term societal resilience through awareness-raising, skills, and education. ENISA also called for strengthening information-sharing mechanisms and common situational awareness to enable a coordinated response to cyber crises.