The European Union’s cyber agency ENISA has released its Threat Landscape 2026, of the incidents and events it collected and analysed in 2025. Covered are threats by type of crime, and sector.
ENISAโs Executive Director Juhan Lepassaar said: โThe ENISA threat landscape is more than a list of cybersecurity threats affecting the EU and how they are distributed around sectors and entities. The analysis highlights how threats become more interconnected and how threat groups spread their impact across the larger map of digital services and infrastructures. Being aware of such underlying dynamics is key if we want to implement the right solutions and maintain a high level of resilience across our digital economy.โ
Social engineering continues to evolve, according to the agency. While large-scale phishing and spearphishing remain common threats, campaigns increasingly relied on trusted communication platforms and bypassing or abusing legitimate authentication. Disruptive and cyber espionage campaigns frequently coincided with political developments, public statements or high-visibility events.
The document concluded that cybercriminal, hacktivist and State-nexus groups’ practical differences between are likely to further converge. Each frequently relied on similar access vectors, tools and operational approaches. It stated: “Still, new groups will likely continue emerging. Of note, the frequent updates and convergence of TTPs by well-known State-nexus and cybercriminal groups increasingly hinder tracking and consistent imputation, ultimately leading to a virtually inflated and scattered threat landscape.” As for Artificial Intelligence, AI is likely to further accelerate several of these developments. During 2025, ENISA observed AI being incorporated into the playbooks of cybercriminal, State-nexus and information manipulation sets, although often in a supporting role.
You can download the 100-page document at the ENISA website – https://www.enisa.europa.eu/publications/enisa-threat-landscape-2026.
Comment
Raphael Auphan, Chief Operating Officer (COO) at Proton, said: “Reducing dependency doesn’t mean disconnecting from the world; it means avoiding building Europe’s digital economy on infrastructure it doesn’t control. When 74 per cent of listed European companies’ email still runs through US-based providers, Europe isn’t just dependent. It’s exposed to decisions made in boardrooms, foreign authorities, and courtrooms it has no say over.”
