Summary
- Ransomware remains ENISA’s most impactful short-term incident type, while geopolitical developments continue to drive disruptive activity against European organisations.
- Seventy-three per cent of organisations targeted in ENISA’s dataset were entities classed as essential or important under NIS2.
- Supply chain and technology dependencies are increasing the potential for incidents to spread beyond the organisation initially compromised.
ENISA has put ransomware, geopolitical activity, and shared digital dependencies at the centre of its latest assessment of Europe’s cyber threat landscape, with organisations classed as essential or important under NIS2 accounting for almost three-quarters of the targets in its dataset.
The EU cybersecurity agency’s 2026 Threat Landscape analyses incidents and events observed between 1 January and 31 December 2025. Its findings describe an environment in which recurrent attack types remain prominent, but the dependencies connecting organisations increasingly shape how widely disruption can spread.
Ransomware remains the incident type ENISA considers most impactful in the short term. Public administration was the most frequently targeted sector, accounting for 32% of organisations in the dataset, followed by business services and transport at 8% each, manufacturing at 7%, and finance and banking at 6%.
Across all recorded incidents, 73% of targeted organisations were entities classified as essential or important under the NIS2 Directive. That places most of the observed activity within sectors and organisations the EU already treats as carrying heightened economic, operational, or societal importance.
Volume and impact do not necessarily move together. Public administration activity was heavily influenced by ideology-driven distributed denial-of-service campaigns, which ENISA said accounted for 82% of the events recorded against that sector. Hacktivist campaigns were frequently aligned with elections, protests, geopolitical tensions, and member states’ support for Ukraine.
Cybercrime remained another major component of the landscape. Among financially motivated activity analysed by ENISA, ransomware deployment accounted for 40% of events, followed by data breaches at 31%, and fraud and impersonation at 19%.
State-linked intrusion sets followed a different pattern, with intrusion operations making up the large majority of their recorded activity and phishing remaining another significant route. The technical methods used across criminal, hacktivist, and state-linked activity continue to overlap even when the objectives behind them differ.
Dependency risk cuts across those categories. ENISA said supply chain and third-party attacks can generate incidents affecting multiple organisations, while expanding use of cloud services, managed providers, software platforms, and other common infrastructure increases the number of shared failure points.
That exposure is already reflected in NIS2, which requires covered organisations to address supply chain security and risks arising from relationships with direct suppliers and service providers. A disruption at a shared provider can therefore become both an operational incident and a test of whether an organisation understood the dependencies supporting its essential services.
The vulnerability burden is also increasing. ENISA recorded more than 48,000 new Common Vulnerabilities and Exposures during 2025, a 22% increase from the previous year. The number does not mean every disclosed vulnerability carries material enterprise risk, but it expands the volume organisations must assess against their own exposure and criticality.
Artificial intelligence appears on both sides of the landscape. ENISA expects malicious groups to make greater use of AI to support operations, while organisational deployment of AI systems creates additional technology that can itself be attacked. State-linked groups, cybercriminals, and information-manipulation actors have all shown interest in AI either as an operational tool or as a target.
The report therefore presents Europe’s cyber risk less as a sequence of isolated attack categories than as a system of connected exposures. Ransomware, DDoS activity, vulnerabilities, third-party compromise, and state-linked intrusion remain distinct problems, but common services and infrastructure can determine how far the consequences travel once one part of the system fails.
