ENISA Threat Landscape 2026 describes a European cybersecurity environment in which cybercrime, geopolitical dynamics and the growing interconnectedness of digital ecosystems increasingly overlap. The analysis examines 8,257 incidents reported during the 2025 calendar year, highlighting the increasingly structural nature of the threat environment. DDoS attacks account for 51.3% of the incidents observed, partly due to the impact of hacktivist campaigns. Frequency, however, does not necessarily equate to impact: ransomware, data breaches and cyber-espionage activities can have more far-reaching consequences for organisations and infrastructure. Public administration ranks first among the most affected sectors, accounting for almost one in three attacks, partly due to the growing role of geopolitical factors and hacktivism as drivers of cyberattacks in international crises. Attention to the digital supply chain is also increasing, as it can provide an indirect route into organisations. In this context, artificial intelligence is progressively expanding attackers’ capabilities, particularly in social engineering and impersonation activities. This may lower the barriers to entry for illicit cyber activities, increasing EU organisations’ exposure to new threats.
Author: European Union Agency for Cybersecurity (ENISA)
Publisher: ENISA
Publication date: September 2026