secureline
Talk to an expert
← Whitepapers

External report / ENISA, the European Union Agency for Cybersecurity

ENISA Threat Landscape 2026

The EU's annual threat assessment

Cyber dependencies expand the attack surface: supply chains, third-party providers and cloud environments keep producing large-scale incidents, while different threat groups increasingly share access vectors and tooling.

Published
Data period
1 January – 31 December 2025
Length
101 pages (TLP:CLEAR)
Read the original
PDF ↗ · Report page ↗

01 / Numbers worth knowing

Four figures,
in the publisher's words.

  • 60.4%vulnerability exploitation cited as a prevalent vector for unauthorised access[1]
  • 77.8%phishing campaigns, named as the main social-engineering route[1]
  • 31.8%public administration, the most impacted sector[1]
  • 29.3%of recorded incidents were financially motivated[1]

Percentages are reproduced as ENISA states them in its executive summary. They come from different subsets of ENISA's dataset, so they do not add up to 100% and should not be compared across categories without reading the methodology chapter.

02 / Key findings

What the report
says.

Paraphrased closely from the publisher's own text. Open the original for context, method and the full set of findings.

  1. DDoS attacks (51.3%) and unauthorised access (39.5%) continued to account for a large share of recorded activity affecting EU Member States and EU-based organisations.[1]
  2. Social engineering remained a common enabling tactic, particularly through phishing campaigns (77.8%), increasingly supported by phishing kits and service-based ecosystems; ClickFix and SMS phishing (smishing) use increased.[1]
  3. Exploitation of vulnerabilities, including N-day and 0-day vulnerabilities, remained a prevalent intrusion vector for unauthorised access (60.4%).[1]
  4. Financially motivated activity accounted for 29.3% of all recorded incidents and, particularly ransomware, remained the most impactful in the short term. Ransomware operators continued to rely on extortion and public claims on data leak sites.[1]
  5. Public administration remained the most impacted sector (31.8%), followed by business services (8.5%), transport (8%), manufacturing (6.9%) and finance/banking (5.6%).[1]
  6. ENISA assesses that AI will highly likely increasingly support malicious operations, and that it is likely 2026 will see more kill-chain phases directly enabled by AI, with possible experimentation on human-out-of-the-loop proofs of concept.[1]

03 / Where to look

If you read
only a few pages.

Page numbers come from the report's own contents list.

  • Executive summaryp. 7
  • Overview and trendsp. 11
  • Sectoral analysis (public administration, business services, transport, manufacturing, finance)p. 18
  • Cybercrime threats: fraud, data breaches, ransomwarep. 38
  • State-nexus threatsp. 60
  • Vulnerabilitiesp. 90
  • Outlook and conclusionp. 95