Summary
- Thirty-eight per cent of European respondents said their organisation was experiencing more cyberattacks than a year earlier.
- Fifty-six per cent described their cyber teams as understaffed and 55% as underfunded.
- Seventy-two per cent said their role was more stressful than five years ago, with threat complexity among the leading causes.
European cybersecurity teams are reporting increased attack activity while more than half describe themselves as understaffed and underfunded, according to new research from ISACA.
The European results from ISACA’s 2026 State of Cyber research found that 38% of IT and cybersecurity professionals said their organisation was experiencing more cyberattacks than at the same point a year earlier. Fifty-six per cent described their cyber team as understaffed and 55% said it was underfunded.
The figures are based on survey responses rather than independent incident telemetry, but the combination points to a capacity problem extending beyond attack volume alone. Organisations are adding cloud services, AI systems, third-party dependencies, and new regulatory duties while many of the teams responsible for security say resources have not grown at the same rate.
Fifty-four per cent of respondents considered it likely their organisation would experience a cyberattack within the following year. Social engineering was the most frequently cited attack type, identified by 46% of respondents.
The workforce data suggests the pressure is accumulating. Seventy-two per cent said their role was more stressful than five years earlier, with increasing threat complexity cited by 72% as one of the causes. Fifty-seven per cent pointed to excessive workloads or unrealistic expectations, while 35% cited insufficient training or skills.
ISACA also found that one in five organisations was taking no action specifically to address burnout. Others reported measures including flexible working arrangements and encouraging staff to take leave, although those responses do not increase engineering capacity or reduce the size of the technology estate that requires protection.
The resource problem is becoming harder to separate from resilience obligations. European organisations affected by NIS2, DORA, and sector-specific requirements are being asked to demonstrate risk management, incident handling, continuity, testing, reporting, and third-party oversight.
Those obligations can improve governance, but compliance activity consumes time as well. Where teams are already constrained, evidence gathering, reporting, supplier review, and resilience testing compete with vulnerability remediation, engineering, architecture work, and incident investigation.
Budget figures are similarly difficult to assess without understanding where spending goes. ISACA argued that organisations can invest heavily in responding to crises without making an equivalent investment in workforce development, training, and the operational capacity intended to prevent or contain incidents.
Artificial intelligence is beginning to feature in the response. Thirty-seven per cent of organisations in the survey said they were using AI to automate threat detection and response, eight percentage points more than in 2025. Thirty-five per cent reported using it for routine security tasks and 29% for endpoint security.
Automation can reduce repetitive work, but it does not replace ownership of architecture, incident coordination, supplier management, or the authority to change systems. A smaller team may deploy more automated tooling without gaining additional influence over legacy technology, maintenance windows, procurement decisions, or business priorities.
That distinction becomes more important as security functions are measured against an expanding set of responsibilities. Understaffing affects not only alert queues but also how thoroughly dependencies are mapped, how quickly vulnerabilities are addressed, and whether lessons from incidents are converted into engineering changes.
Survey data cannot establish that the same conditions apply uniformly across Europe, and ISACA’s figures represent respondent experience rather than a complete measurement of the regional workforce. They nevertheless describe a persistent mismatch between the amount of security work organisations expect and the people and budgets available to perform it.
