- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeGuidanceLegal InstrumentReportSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailEuropean UnionPublisherEuropean Union Agency for Cybersecurity (ENISA)
- VersioningVersionENISA Threat Landscape 2026 (Final)Effective DateSeptember 22, 2026Issue DateAnnual report; 2026 edition published September 22, 2026
- AdoptionAdoption ModelVoluntaryImplementation ComplexityLow
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
ENISA publishes the report free of charge, and its reuse is allowed under the Creative Commons Attribution 4.0 license with credit to ENISA. It is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- The ENISA Threat Landscape is the EU cybersecurity agency's annual report on the cyber threats affecting the European Union.
- The 2026 edition, published September 22, 2026, analyzes 8,257 incidents recorded during calendar year 2025.
- It groups incidents into cybercrime, state-nexus, hacktivist, and information manipulation threats.
- It is an evidence report, not a standard, and creates no obligation for any organization.
- Security teams use it to test threat assumptions against EU data and to support risk assessments under frameworks such as NIS2.
Overview
The ENISA Threat Landscape (ETL) is the European Union Agency for Cybersecurity's annual report on the cyber threats affecting the EU. The 2026 edition, published on September 22, 2026, analyzes 8,257 incidents recorded from January 1 to December 31, 2025 and groups them into cybercrime, state-nexus, hacktivist and information manipulation threats. It is an evidence report, not a standard: it creates no obligation for any organization.
ENISA, the EU's cybersecurity agency, writes it from open sources and anonymized information shared by Member States and members of its Cyber Partnership Programme, using the updated ENISA Cybersecurity Threat Landscape methodology published in September 2026. Its legal notice states that it represents ENISA's views and does not endorse a regulatory obligation. The earlier 2025 edition covered July 2024 to June 2025, so the reporting period has moved to the calendar year.
Security and risk teams use it to test their own threat assumptions against EU data: which sectors are hit, which techniques recur, and which dependencies expand the attack surface. It supports risk assessments under frameworks such as NIS2, but a team must still do its own analysis.
Why does it matter?
The ETL gives a regional, sector-level view of what attackers are doing, which an organization cannot get from its own logs. Used with care, it helps decide where to spend security budget and what to brief the board on.
Key benefits include:
- EU-specific evidence
The report is based on 8,257 incidents affecting EU Member States and EU-based organizations in 2025, so it describes the European picture rather than a global average.
- Sector context
Public administration was the most impacted sector at 31.8 percent of incidents, followed by business services (8.5), transport (8), manufacturing (6.9) and finance and banking (5.6).
- Threat types are separated
Cybercrime, state-nexus activity, hacktivism and foreign information manipulation each have their own chapter, since their objectives and defenses differ.
- Technique trends
DDoS attacks (51.3 percent) and unauthorized access (39.5 percent) accounted for a large share of recorded activity.
- An outlook
ENISA assesses that several 2025 dynamics will persist, including cybercrime, geopolitical activity and growing use of artificial intelligence in malicious operations.
How does it work?
The report has eight chapters. Chapter 1 gives an overview and trends. Chapter 2 analyzes five sectors: public administration, business services, transport, manufacturing and finance and banking. Chapter 3 covers cybercrime (fraud and impersonation, data breaches and ransomware), chapter 4 state-nexus threats, chapter 5 foreign information manipulation and interference (FIMI), chapter 6 hacktivist threats, chapter 7 vulnerabilities and chapter 8 the outlook. Appendix A lists law enforcement operations and Appendix B the assessment methodology.
ENISA notes that open sources and voluntarily shared information are not a complete picture, and that the figures for data breaches, fraud and ransomware overlap because stolen data is reused across them. The 2026 edition also expanded the cybercrime activities it tracks, which changed some numbers but not the trends and rankings.
A reader takes the sector and threat-type findings that match their business, compares them with their own incident data and threat model, and turns them into risk register entries, control priorities and exercise scenarios. Chapter 7 on vulnerabilities supports patching priorities.
Key Elements
- Overview and trends (chapter 1)
The headline findings on techniques, motives and the role of digital dependencies such as suppliers, cloud services and software providers.
- Sectoral analysis (chapter 2)
How threats differ across public administration, business services, transport, manufacturing and finance and banking, including sectors of high criticality under NIS2.
- Cybercrime threats (chapter 3)
Fraud and impersonation, data breaches and ransomware, with financially motivated activity at 29.3 percent of recorded incidents.
- State-nexus threats (chapter 4)
Cyberespionage at 5.9 percent of incidents, with Russia-nexus activity focused on government and diplomatic entities and China-nexus activity showing interest in transport.
- FIMI and hacktivist threats (chapters 5 and 6)
Information manipulation based on the EEAS FIMI report, and ideology-driven activity at 57.3 percent of incidents, notably DDoS against public-facing services.
- Vulnerabilities and outlook (chapters 7 and 8)
Exploitation of N-day and zero-day vulnerabilities, and the expected effect of artificial intelligence on malicious operations.
What does it cover?
The ETL is addressed to national and EU authorities and the private sector. It describes threats to the EU's networks and information systems across sectors, and its sectoral analysis highlights those that NIS2 treats as sectors of high criticality. It does not describe every threat, and it covers the period named on the cover, here calendar year 2025.
What are its objectives?
The ETL aims to give decision makers a shared, sourced picture of the EU cyber threat landscape.
Provide an overview of the most prominent threats and trends affecting the EU.
Show how threats differ by sector and by threat actor type.
Describe the vulnerabilities and techniques behind recorded incidents.
Give an outlook that helps organizations anticipate the next reporting period.
Document the method so readers can judge the data.
Framework in Context
The ETL sits with ENISA's other threat work, such as its sectoral threat landscapes and the Cybersecurity Threat Landscape methodology. It complements, and does not replace, requirements such as the NIS2 risk-management measures, which require entities to assess risks based on their own circumstances. Taxonomies such as MITRE ATT&CK can be used to map its techniques to controls.
Common Framework Mappings
Organizations map the ENISA Threat Landscape to established standards and taxonomies to align threat intelligence, scoring, controls, regulatory obligations, and detection/prioritization across security and compliance programs.
Mapped frameworks include:
CIS Critical Security Controls
Common Vulnerability Scoring System (CVSS)
ISO/IEC 27001
MITRE ATT&CK
NIS2 Directive
NIST Cybersecurity Framework
NIST SP 800-53
STIX/TAXII Cybersecurity
How SmartSuite Supports ENISA Threat Landscape
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Cyber & IT Risk and Enterprise Risk Management to turn ETL findings into risk register entries linked to controls, owners and actions, and Third Party Risk Management to track supplier and cloud dependencies the report highlights.
Threat Input Log
Record each ETL finding that applies to the organization, the edition and chapter it comes from and the decision taken.
Risk Register Linkage
Link findings to enterprise and IT risks with likelihood and impact notes and an owner.
Control Gap Mapping
Map the techniques named in the report, such as DDoS, phishing and vulnerability exploitation, to existing controls and gaps.
Sector Exposure Review
Compare the sector chapters with the organization's own sectors and record the exposure assessment.
Dependency Tracking
List software suppliers, service providers and cloud environments flagged as dependencies and their review dates.
Board Threat Briefing
Report threat exposure and mitigation progress to executives each cycle, with the edition date and sources.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
The NIS2 Directive requires essential and important entities in critical sectors to manage cyber risk, report significant incidents within 24 and 72 hours and make management accountable.
Frequently Asked Questions For ENISA Threat Landscape
It is ENISA's annual report on the cyber threats affecting the European Union. The 2026 edition, published on September 22, 2026, analyzes 8,257 incidents from January 1 to December 31, 2025, grouped into cybercrime, state-nexus, hacktivist and information manipulation threats.
No. It is an evidence report. Its legal notice says it represents ENISA's views and does not endorse a regulatory obligation, and there is no certification. Organizations use it as an input to their own risk assessments.
Public administration was the most impacted sector at 31.8 percent of recorded incidents, followed by business services (8.5 percent), transport (8 percent), manufacturing (6.9 percent) and finance and banking (5.6 percent). Chapter 2 analyzes these five sectors.
DDoS attacks (51.3 percent) and unauthorized access (39.5 percent) accounted for a large share of recorded activity. Financially motivated activity, particularly ransomware, was 29.3 percent of incidents, ideology-driven activity 57.3 percent and cyberespionage 5.9 percent. ENISA also highlights digital dependencies and growing use of artificial intelligence by threat actors.
Compare the findings for its sectors and threat types with its own incident data, then update the risk register, control priorities and exercise scenarios. ENISA cautions that open sources and voluntarily shared information give an incomplete picture, so the report supports rather than replaces an organization's own analysis.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.