Brussels – The measures put in place by the European Union to detect and respond to significant, large-scale cybersecurity incidents are inadequate, the European Court of Auditors said in a report. It urged the EU to improve information-sharing practices, refine coordination to avoid duplication of effort among the various bodies involved, make the European cybersecurity alert system operational, and strengthen security checks on recipients of EU funding.
The Court points out that such incidents can “disrupt public services, businesses, critical infrastructure, and the EU’s internal market.” Responsibility for the response lies primarily with the Member States, but the Union “plays an important role.” For example, when such incidents “cause major disruption, significant financial losses, or substantial harm to people or organisations (significant cybersecurity incidents), or when they affect several member states and go beyond the capacity of a single country to respond effectively (large-scale cybersecurity incidents).”
To tackle these threats, the EU is investing increasingly in strengthening cybersecurity. “Under the 2021-2027 EU budget, the Digital Europe Programme is the main source of cybersecurity funding, with €1.4 billion allocated,” according to the Court. According to George-Marius Hyzler, a member of the European Court of Auditors responsible for the audit, this represents “progress” made “in building a cybersecurity cooperation framework.” At the same time, however, the EU “is not yet working as effectively as it should,” while “when a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value”, he notes.
According to the auditors, the Achilles heel of the entire system is the insufficient exchange of information. This is because, although the cybersecurity programme, adopted in 2025, sets out in detail the roles and responsibilities for managing major cybersecurity crises, “the way the two EU cyber networks work together has still not been formally defined. This hampers the cooperation of the CSIRTs network, which brings together national teams dealing with cyber incidents, and EU-CyCLONe, an EU network for cyber crisis cooperation.” Added to this is the fact that some Member States “are still implementing” the updated EU cybersecurity rules, such as the NIS 2 Directive, while “national security laws restrict what information can be shared.” The result is that EU networks face difficulties in detecting threats at an early stage and coordinating an effective response.
The Court also identified “overlaps between some EU bodies responsible for monitoring cybersecurity threats.” In particular, between the European Commission’s Cyber Situation Centre and the European Union Agency for Cybersecurity (ENISA). Furthermore, “at the time of the audit, the European Cybersecurity Alert System was not yet operational. The two hubs examined by the auditors – ATHENA and ENSOC – had not started operations because of procurement delays,” and “the necessary cooperation agreements, a common classification system, and technical standards needed for the system to work were still lacking.”
Finally, the auditors identified weaknesses in how some organisations receiving EU cybersecurity funding were being checked. “Although grant beneficiaries are responsible for assessing the ownership and control of third parties in receipt of financial support, the European Cybersecurity Competence Centre does not verify these assessments. As a result, sensitive infrastructure, operational data, and security-critical technologies could be exposed to security risks,” the Court concluded.
At the Commission, officials “welcomed” the European Court of Auditors’ special report. “We will carefully examine its recommendations to strengthen further the Union’s capabilities in the detection, situational awareness and response to cyber threats and incidents. The revision of the Cybersecurity Act puts forward proposals to enhance ENISA’s capabilities to support Member States in situational awareness and incident response,” they said.
English version by the Translation Service of Withub
