The EU has made significant progress in strengthening its cybersecurity. Still, persistent cyberattacks, geopolitical tensions and the rapid development of AI are creating increasingly complex risks, according to a new report from the cybersecurity watchdog.
The study by the European Union Agency for Cybersecurity (ENISA) concludes that ideologically motivated attacks accounted for 57.3 per cent of cases in 2025. Nevertheless, their impact was generally limited. In contrast, financial attacks represented 29.3 per cent but were the most disruptive to business, particularly through ransomware. Geopolitical developments, including Russia’s war against Ukraine and conflicts in the Middle East, continued to shape malicious cyber activity.
Recent incidents include the hacking of refrigerators in supermarkets across several European countries, including France, Belgium, Sweden, Ireland, and Estonia, raising temperatures remotely. Besides, in France, a cyberattack affected cold-storage systems at three facilities operated by the national blood service.
Artificial intelligence is adding another dimension to the situation. ENISA highlights the summer incident with Hugging Face, a platform for sharing AI models and tools, and the escape of an OpenAI agent, which gained access to its production infrastructure.
You might be interested
ENISA Executive Director Juhan Lepassaar warned that recent incidents, from vulnerabilities in advanced AI systems to hacked refrigerators, have exposed gaps in Europe’s ability to respond to cyber threats. He stressed the need for countries to share information more quickly and coordinate their efforts.
“Common situational awareness must be strengthened and alignment in critical sectors policies must be increased. There has been progress but now we need to build on this foundation and update our strategies to address the increasingly complex cybersecurity landscape,” he added.
Disparities across the EU
Despite these challenges, the report identifies improvements in cybersecurity preparedness across the EU. The overall EU Cybersecurity Index reached 71.53 points out of 100, with 22 member states achieving a mature cybersecurity posture, two reaching an advanced level and three remaining at an established level.
National cybersecurity policy implementation scored 66.72 points, while supply chain security management among essential entities reached 89.91 points. Research and development priorities also performed strongly, scoring 79.24 points.
However, significant differences remain between member states. The maturity of Computer Security Incident Response Teams averaged just 54.76 points, with considerable disparities across countries. National cybersecurity certification ecosystems also showed uneven development, scoring 55.56 points. While 14 member states achieved mature or advanced levels, 13 remained at foundation or developing levels.
Education represents another area requiring attention. While measures to promote cybersecurity in higher education scored 73.59 points, primary and secondary education lagged behind at 54.44 points. Only 12 member states achieved a mature or advanced posture. The report found that cybersecurity was included in primary school curricula in 14 member states and secondary school curricula in 13.
EU cybersecurity legislation enters a new phase
Regulatory compliance is the principal driver of cybersecurity investment, cited by 70 per cent of surveyed organisations. However, ENISA warns that differences in operational capabilities, outdated technologies and supply chain vulnerabilities continue to expose essential services to cyber risks.
There has also been progress in vulnerability management. Since 2024, the number of member states without an established or in-development national coordinated vulnerability disclosure policy has fallen from 17 to 7. The report comes as the EU continues implementing more cybersecurity legislation, including the NIS2 Directive, the Cyber Resilience Act and the Cyber Solidarity Act. Further initiatives include the proposed Cybersecurity Act 2 and the EU Action Plan on Cybersecurity and AI.
However, ENISA stresses that new legislation alone will not be enough. It identifies five priorities: improving legislative implementation, strengthening operational crisis response, increasing the resilience of critical infrastructure, managing supply chain and cross-border risks, and investing in cybersecurity education and skills.
