EU Cybersecurity Defenses Improve as ENISA Warns of Gaps in Crisis Response & Critical Infrastructure

Key Takeaways

• Cybersecurity Maturity: The EU recorded an average cybersecurity maturity score of 71.53 out of 100, with most member states reaching at least a mature level of preparedness.
• Critical Infrastructure: Regulatory compliance was the principal driver of cybersecurity investment for 70% of organizations across critical sectors, although preparedness remains uneven.
• Incident Response: Computer Security Incident Response Teams received a maturity score of 54.76, reflecting differences in national capabilities and continued challenges in crisis coordination.
• Supply Chain Security: The number of member states with national coordinated vulnerability disclosure policies increased from seven to 17 since 2024, as AI accelerates vulnerability discovery.
• Policy Priorities: ENISA called for better implementation of existing legislation, stronger crisis response, improved critical infrastructure resilience and greater investment in cybersecurity skills.

Deep Dive

The European Union scored 71.53 out of 100 in its latest assessment of cybersecurity maturity, with most member states reaching at least a mature level of preparedness despite significant differences in their ability to respond to incidents and protect critical infrastructure.

The findings show that national cybersecurity capabilities have improved even as the threats facing the bloc have become more complex. Cyber intrusion activity remained substantial throughout 2025 and 2026, while geopolitical tensions, supply chain dependencies and advances in artificial intelligence placed additional demands on national authorities and critical infrastructure operators.

ENISA's biennial State of Cybersecurity in the Union report identifies weaknesses in crisis coordination, information sharing and the implementation of cybersecurity requirements across national borders. It also introduces five policy priorities intended to guide the EU's next phase of cybersecurity development.

The assessment comes as member states continue implementing major pieces of EU cybersecurity legislation, including the NIS2 Directive, the Cyber Resilience Act and the Cyber Solidarity Act. ENISA found that progress has been made, but differences between national approaches and overlapping regulatory obligations are creating practical difficulties for organizations operating across several jurisdictions.

The agency's Cybersecurity Index, developed under Article 18(3) of NIS2, provides a measure of those differences. Supply chain management received one of the highest scores, averaging 89.91 points across member states. Almost all reported an advanced level of maturity in managing the supply chains of essential and important entities. Cybersecurity research and development also performed relatively well, scoring 79.24 points, reflecting greater consistency in national research and innovation priorities. Other results were considerably weaker.

National cybersecurity policy implementation averaged 66.72 points, while the maturity of Computer Security Incident Response Teams (CSIRTs) stood at 54.76 points. ENISA found that incident response capabilities were established but remained uneven across member states.

National cybersecurity certification ecosystems received a score of 55.56 points, reflecting substantial differences in maturity. Cybersecurity education showed a similar divide, with higher education scoring 73.59 points compared with 55.44 points for primary and secondary education.

The figures indicate that while member states have made progress toward a common level of cybersecurity preparedness, important differences remain in the capabilities needed to prevent, identify and respond to incidents.

Critical Infrastructure and Crisis Response

ENISA found that cybersecurity maturity across critical sectors appears to have improved steadily since its previous assessment in 2024. Regulatory requirements have played a considerable role in that progress, with 70% of organizations across critical sectors identifying compliance as the principal driver of cybersecurity investment.

The agency nevertheless warned that preparedness remains uneven between sectors, reflecting differences in operational requirements, technological capabilities and exposure to emerging threats.

Legacy systems continue to present difficulties, particularly where replacing or modernizing infrastructure is expensive or operationally complicated. Supply chain vulnerabilities add another layer of exposure, while artificial intelligence is increasing the speed and scale of potential threats.

ENISA recommended developing cybersecurity maturity according to the criticality of individual sectors rather than relying on uniform approaches that may not account for their different operating conditions. The report also identified shortcomings in the EU's arrangements for responding to major cybersecurity incidents.

Although the 2025 Cyber Blueprint established a foundation for more structured cooperation, ENISA found that the involvement and capabilities of relevant authorities, along with information-sharing arrangements, still require improvement.

The agency pointed to recent cyber incidents involving refrigeration systems across the EU and developments in frontier AI models as examples of challenges requiring stronger operational coordination.

"The State of Cybersecurity in the Union reflects on the EU's collective effort and determination to become more resilient," ENISA Executive Director Juhan Lepassaar said. "However, challenges persist and recent developments not only in frontier AI models but also cyber incidents in refrigeration systems across the EU underline the operational gaps and the need for timely information sharing and coordination."

Lepassaar called for stronger shared situational awareness and greater alignment between cybersecurity policies affecting critical sectors. The findings also raise questions about how effectively existing EU cybersecurity requirements work together.

ENISA recommended improving the implementation of legislation across national borders and regulatory frameworks so that organizations operating in multiple member states face more consistent and workable obligations.

The recommendation comes amid broader efforts to simplify and adjust EU cybersecurity rules, alongside newer initiatives including the proposed Cybersecurity Act 2 and the EU Action Plan on Cybersecurity and AI.

Supply Chain Risks and the Growing Influence of AI

Despite strong national maturity scores for supply chain management, ENISA identified cross-border dependencies as a growing source of cybersecurity risk. The report found that member states have made progress in establishing coordinated vulnerability disclosure policies, which provide mechanisms for reporting and addressing security weaknesses.

The number of countries with a national coordinated vulnerability disclosure policy increased from seven to 17 since 2024. At the same time, artificial intelligence is changing how vulnerabilities are discovered and handled. ENISA found that AI has accelerated vulnerability discovery, increasing the demands placed on organizations and authorities responsible for assessing and addressing security weaknesses.

The agency recommended integrating cybersecurity throughout the value and supply chain, from product development through ongoing operations. AI is also influencing the broader threat environment. ENISA described the technology as a multiplier of both offensive and defensive capabilities, with increasingly capable models accelerating vulnerability discovery and exploitation.

The report found that ideological motivations were the principal driver of cyber incidents during 2025 and 2026, while geopolitical developments continued to shape malicious activity. Financially motivated attacks remained consequential, and hacktivists continued to account for much of the overall attack volume.

ENISA concluded that the level of cyber threats facing the EU remains substantial, notwithstanding improvements in national preparedness. The agency also identified cybersecurity education and workforce development as areas requiring sustained attention.

Citing the World Economic Forum's Global Cybersecurity Outlook 2025, ENISA noted that the global cybersecurity skills gap had widened by 8% since 2024.

The report recommended continued investment in cybersecurity awareness, education, recruitment and retention, alongside training programs to help existing professionals develop new capabilities. It also called for greater consideration of how artificial intelligence will affect future workforce requirements.

These concerns form part of the five priorities ENISA has established for future EU cybersecurity policy:

• Legislative Implementation: Improving the implementation of existing cybersecurity legislation across member states.

• Crisis Response: Strengthening operational capabilities and coordination during major cybersecurity incidents.

• Critical Infrastructure Resilience: Advancing cybersecurity preparedness and resilience across critical sectors.

• Supply Chain Security: Managing supply chain risks and cross-border dependencies.

• Education and Workforce Development: Building long-term resilience through cybersecurity awareness, education and workforce skills.

The assessment was prepared in cooperation with the European Commission and the NIS Cooperation Group under the reporting requirements established by Article 18 of the NIS2 Directive.

Its findings suggest that the next stage of European cybersecurity policy will depend increasingly on the practical implementation of existing requirements. National capabilities have improved, but the ability of authorities and critical infrastructure operators to coordinate across borders, manage shared dependencies and respond effectively to major incidents remains uneven.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey