The European Union Agency for Cybersecurity (ENISA) has published its new Threat Landscape 2026, an analysis of the main threats and trends shaping the current cybersecurity landscape.

The report highlights an important evolution: organisations are increasingly dependent on digital infrastructures, cloud services, technology providers, third-party applications and connected systems. This growing interdependence is also expanding the attack surface and creating new opportunities for cybercriminals and other malicious actors.

Key Findings from the Report

Among the key findings highlighted by ENISA are:

• 57% of the incidents analysed were ideologically motivated.
• Almost 30% of the incidents were financially motivated.
• Public administration remained the most targeted sector, accounting for 32% of the cases analysed.
• Phishing and the exploitation of vulnerabilities remain among the main entry points used by attackers.
• Cybercrime accounted for 36% of the events analysed.
• Hacktivism generated 4,709 claims targeting EU Member States, with more than 89% related to DDoS attacks.
• In operations attributed to state-nexus intrusion sets, intrusion operations accounted for 87%, followed by phishing campaigns at 12%.
• Artificial intelligence is increasingly playing a role in Foreign Information Manipulation and Interference (FIMI) operations.

An Increasingly Expanding Attack Surface

One of the most important aspects highlighted by the report is that technological risk is no longer limited to the systems an organisation directly controls.

A company may have well-protected internal systems and still be exposed through a supplier, a third-party application, a compromised account, an unpatched vulnerability or a technology dependency.

This makes attack surface management one of the fundamental elements of a modern cybersecurity strategy.

The question is no longer simply:

What systems do we have and how do we protect them?

We should also be asking:

Which systems and suppliers do we depend on? What information do they handle? What would happen if one of them were compromised?

Phishing Remains a Major Challenge

Despite increasingly advanced security technologies, the human factor remains highly relevant.

Phishing attacks attempt to obtain credentials, sensitive information or initial access to an organisation through social engineering techniques.

For this reason, security cannot rely exclusively on technical tools. A combination of security awareness, training, multi-factor authentication, access controls, monitoring and incident response capabilities is essential.

Vulnerabilities: The Importance of Reducing Exposure

Another important element highlighted by ENISA is the exploitation of vulnerabilities.

A known vulnerability can become an entry point when an organisation lacks the appropriate mechanisms to identify its assets, assess its exposure and apply the necessary security updates.

An effective vulnerability management programme should therefore begin with something that may seem simple, but is fundamental:

knowing what assets we have, where they are and what software they are running.

Without this visibility, it becomes much more difficult to properly prioritise risk.

DDoS Attacks and Hacktivism

The report also highlights the significant level of activity associated with hacktivism.

DDoS (Distributed Denial-of-Service) attacks primarily aim to affect the availability of a service by generating large amounts of traffic or requests.

Although a DDoS attack does not necessarily mean that an attacker has gained access to an organisation's internal systems, it can cause service disruptions, affect an organisation's reputation and generate operational costs.

For this reason, availability should be considered an essential part of an overall security strategy, alongside confidentiality and integrity.

Artificial Intelligence Introduces a New Dimension

AI is transforming virtually every area of technology, and cybersecurity is no exception.

In addition to being used to improve defensive capabilities, ENISA highlights the use of AI in Foreign Information Manipulation and Interference (FIMI) operations.

This creates an environment in which certain campaigns can potentially become faster, more scalable and more sophisticated.

For organisations, this means that security strategies should consider not only traditional attacks against IT systems, but also risks related to information, digital identity and trust.

What Should Organisations Do?

The threat landscape described by ENISA reinforces the need to adopt a risk-based approach to cybersecurity.

Some fundamental measures include:

1. Maintain an up-to-date inventory of assets and systems.
2. Identify critical dependencies and technology providers.
3. Manage and prioritise vulnerabilities.
4. Strengthen protection against phishing and social engineering.
5. Implement multi-factor authentication and apply the principle of least privilege.
6. Monitor systems to detect anomalous behaviour.
7. Maintain incident response and recovery plans.
8. Perform regular backups and periodically test recovery procedures.
9. Assess the risks associated with the use of artificial intelligence.
10. Continuously train and raise security awareness among users.

Conclusion

The ENISA Threat Landscape 2026 demonstrates that the threat landscape continues to evolve alongside our growing dependence on technology.

Security is no longer simply about installing antivirus software, configuring a firewall or keeping systems up to date.

The real challenge is understanding which assets we have, what we depend on, which threats may affect us and how we would respond if an incident occurred.

Cybersecurity should be approached as a continuous process of prevention, detection, response and improvement.

For any organisation, understanding the current threat landscape can be an important first step towards reviewing its cybersecurity strategy and identifying where its greatest risks actually lie.

Official Source and Documentation

This article is based on the ENISA Threat Landscape 2026, published by the European Union Agency for Cybersecurity (ENISA) on 22 September 2026.

The report analyses the evolution of the cybersecurity threat landscape in the European Union and the incidents observed during 2025.

👉 Read the official report: ENISA Threat Landscape 2026

👉 Explore the ENISA Threat Landscape: ENISA Threat Landscape

The statistics and findings cited in this article are based on ENISA's published report. The interpretations and recommendations included in this article are provided as an informative analysis of ENISA's published material.