Brussels – The European Union’s ability to defend itself against cyber-attacks is improving, but the level of threat remains “substantial,” and differences persist between Member States in terms of preparedness and incident response. This is the picture outlined by the EU Agency for Cybersecurity (ENISA) in the 2026 report on the state of cybersecurity in the EU, which identifies cooperation amongst the 27 Member States, the resilience of critical infrastructure, and the development of skills as the main challenges for the coming years.
According to the European Cybersecurity Index compiled by the agency in line with the NIS2 directive – the European directive aimed at raising the common level of security of networks and information systems across the EU – the average maturity level of Member States’ cyber capabilities and resources reached 71.53 out of 100 in 2026. Most countries are considered to have a mature or advanced level of preparedness. The best results relate to the management of supply chains for essential entities, with 89.91 points, and investment in research and development, which stands at 79.24 points.
However, the picture remains uneven. Among the areas where there is the greatest scope for improvement are training and education: while the maturity score for higher education stands at 73.59 points, in primary and secondary education it falls to 55.44. The capacity of national cyber incident response teams also presents challenges, with an average of 54.76 points and significant differences between Member States.
Of particular concern is the gap between regulatory progress and the ability to translate this into a coordinated operational response. Seventy per cent of organisations cite regulatory compliance as the main driver of investment in cybersecurity, but the implementation of measures is proceeding at different speeds across different sectors. Furthermore, artificial intelligence risks widening the disparities in exposure to threats, while obsolete IT systems and dependencies on supply chains continue to represent vulnerabilities.
“Recent developments, concerning both cutting-edge AI models and cyber incidents affecting refrigeration systems across the EU, highlight operational shortcomings and the need for timely information-sharing and greater coordination,” warned ENISA’s Executive Director, Juhan Lepassaar. The agency’s head believes it is essential to strengthen shared threat awareness and improve policy alignment in critical sectors.
The report identifies five priorities for strengthening European cybersecurity: improving the implementation of regulations, enhancing coordination in crisis management, increasing the resilience of critical infrastructure, reducing risks and dependencies in supply chains, and investing in digital awareness and skills.
As regards vulnerability management, some progress is already evident: between 2024 and 2026, the number of Member States with a national policy on the disclosure of cyber vulnerabilities rose from seven to 17. According to ENISA, this step forward must be accompanied by greater capacity for collaboration between national authorities and European institutions.
English version by the Translation Service of Withub
