In partnership with
The European Union Agency for Cybersecurity published its 2026 threat report on September 22. The report analyses incidents and events observed from January through December 2025. Its central finding is that cyber dependencies expand the attack surface. Software suppliers, service providers, and connected infrastructure can extend the effect of one compromise beyond the first organisation.
For product teams moving at AI speed.
AI makes it easier to ship anything, even bad ideas. The hard part is knowing which ideas are worth building.
Jira Product Discovery brings your ideas, customer insights, and priorities into one place, so your team can decide what to ship and move forward with confidence.
Capture ideas, prioritize with evidence, and build living roadmaps your team can rally around—all while staying connected to delivery in Jira, so everyone can see what’s being built and why.
Better product decisions in the AI era.
ENISA says seventy-three percent of targeted organisations were entities classified within the NIS2 framework. Public administration was the most targeted sector, representing thirty-two percent of cases. Business services, transport, manufacturing, and finance or banking followed at smaller shares. These percentages describe the report’s recorded incidents, not every attack occurring in the European Union. The report therefore separates exposure from sector count when it interprets the figures.
The report identifies ransomware as the most short-term impactful incident type. It says low-impact distributed denial-of-service attacks made up fifty-one percent of recorded cases. Public administration faced a particularly strong concentration of such activity. Ideology-driven distributed denial-of-service incidents represented eighty-two percent of recorded public-administration events.
These figures describe different parts of the same system. Ransomware is assessed by short-term impact. Distributed denial-of-service activity is counted by incident volume. A high incident count does not automatically mean the highest operational damage. Reading the measures together requires attention to the denominator, sector, motivation, and effect being measured.
Vulnerability exploitation remains another major entry route. ENISA says that among unauthorised-access incidents where an intrusion vector was identified, five percent of the total incidents met that condition. Sixty percent of that subset used a vulnerability. The nested denominator matters. It would be incorrect to read sixty percent as the share of all reported incidents.
7 Stocks to Ride The A.I. Megaboom
The next A.I. boom could create massive winners just like the 1990s tech surge.
We identified 7 small tech companies positioned to benefit from the next phase of A.I. growth.
See them inside this free report 7 Stocks to Ride The A.I. Megaboom.
The report also records more than forty-eight thousand vulnerabilities assigned CVE identifiers during 2025, a twenty-two percent increase from the previous year. That number describes published identifiers, not confirmed exploitation. ENISA separately reports that threat groups reused tools, exploited vulnerabilities, and targeted supply chains and third parties.
Artificial intelligence appears in the report as both an enabling tool and an attack surface. ENISA says emerging AI models are expected to support malicious operations. It also says groups showed interest in AI systems as targets. The report does not establish that every new model creates a new incident. It identifies a direction that security teams must monitor.
The evidence base has limits. ENISA combined open-source information with anonymised data shared by member states and its Cyber Partnership Programme. The analysis concerns events affecting the European Union during 2025. It is not a complete registry of global attacks, and its category counts depend on how incidents were identified and classified.
The operational implication is a shift from isolated asset review toward dependency mapping. Organisations need to know which suppliers, identity systems, software components, and hosted services support important processes. They also need a way to connect a supplier incident with local exposure. The report supports that priority, but it does not prescribe one control set for every organisation.
ENISA’s defensible conclusion is narrower than a claim that one threat dominates every environment. European organisations faced overlapping cybercrime, geopolitical, vulnerability, and dependency risks. The report’s value lies in showing how those risks intersect. Effective interpretation requires preserving the source, time period, denominator, and uncertainty behind each number.
See what's really happening in every deal
Aligned shows you what buyers are doing between meetings inside your most important deals then surfaces the risks, openings, and next steps. No more guessing where a deal stands or finding out a champion went quiet too late. Just real visibility, so you can act before it's too late.
