The ENISA cybersecurity report on the state of the Union in 2026, released this week, finds that Europe’s digital defences are getting stronger while national crisis capabilities remain uneven. The EU Agency for Cybersecurity rates the overall threat level as substantial and calls for tighter coordination before the next large incident tests the system.
At the heart of the ENISA cybersecurity report sits the European Cybersecurity Index, built on the indicators of the NIS2 Directive. Member States reached an average maturity score of 71.53 out of 100 in 2026, and most countries now sit in the mature or advanced bands. That progress reflects two years of NIS2 transposition, national strategies and investment by operators of essential services.
The strongest results come from supply chain management among essential entities, which scores 89.91. Investment in cybersecurity research and development follows at 79.24. These figures suggest that large operators in energy, transport, health and finance have absorbed the message that suppliers and software dependencies are a primary attack surface.
The weak spots in the ENISA cybersecurity report are more worrying. National incident response teams average only 54.76, with wide gaps between the best and worst performers. Cyber education in primary and secondary schools scores 55.44, well below the 73.59 recorded for higher education, which points to a long-term skills problem rather than a temporary shortage.
The ENISA cybersecurity report also shows that law is driving behaviour. Around 70% of organisations say regulatory compliance is the main reason they invest in cybersecurity. The number of Member States with a national coordinated vulnerability disclosure policy has risen from 7 in 2024 to 17 in 2026, a sign that NIS2 obligations are reaching ministries and agencies.
Emerging risks complicate the picture. The agency warns that artificial intelligence may widen exposure gaps, both by helping attackers scale operations and by adding new systems that defenders must secure. Obsolete IT, legacy industrial controllers and concentrated supply chains remain persistent vulnerabilities across sectors.
Executive Director Juhan Lepassaar pointed to recent developments in AI models and to cyber incidents affecting refrigeration systems across the EU as reasons for urgency. He called for timely information-sharing between national authorities and stronger coordination at Union level, arguing that fragmented reporting slows down the response when attacks cross borders.
The ENISA cybersecurity report sets out five priorities for the coming period. They are better implementation of existing legislation, more effective crisis-management coordination, resilience of critical infrastructure, reduced supply-chain risk and dependencies, and stronger digital awareness and skills. Each maps onto files already open in the Council and Parliament, from the Cyber Resilience Act roll-out to the revision of the Cybersecurity Act.
For policymakers, the message is that compliance alone will not close the gap. Countries with weak incident response teams will need staff, funding and cross-border exercises, not only new reporting duties. The ENISA cybersecurity report gives ministers and MEPs a shared baseline for that debate, and its next edition will show whether the weakest national teams have caught up.
