European Cyber Threat Landscape 2026: Trends from ENISA and National CSIRTs

ENISA's annual Threat Landscape Report, combined with data from national CSIRTs across Europe, paints a picture of an evolving threat environment. Here are the key trends relevant to organizations navigating NIS2 compliance and broader cybersecurity strategy.

Top threats

Ransomware remains the top threat for the fifth consecutive year. ENISA's data shows ransomware incidents targeting European organizations increased 23% year-over-year. The shift toward "double extortion" (encrypting data AND threatening to leak it) is now the default model. Supply chain attacks increased 42%. Attackers increasingly target smaller vendors and open-source libraries to gain access to larger targets downstream. This directly validates NIS2's emphasis on supply chain security. AI-enhanced social engineering is the fastest-growing category. Deepfake voice and video in BEC (business email compromise) attacks are no longer edge cases. DDoS attacks against European infrastructure increased significantly, often linked to geopolitical events.

Sector-specific trends

Healthcare — Most targeted sector in terms of data breach volume. Patient data commands premium prices on dark markets, and operational disruption can have life-safety implications. Public administration — Second most targeted. Geopolitically motivated attacks and ransomware both feature prominently. Digital infrastructure — Cloud providers and managed service providers are increasingly targeted as a vector to reach their customers. NIS2's inclusion of digital infrastructure as an "essential" sector addresses this directly. Manufacturing — OT (operational technology) attacks growing rapidly as IT/OT convergence creates new attack surfaces.

Attack trends

• Average dwell time (time between initial compromise and detection) dropped to 18 days in Europe, down from 24 days in 2024. Better detection tools and NIS2-driven investment in monitoring are contributing factors.
• Initial access methods: phishing remains #1 (37%), followed by exploitation of public-facing applications (28%) and compromised credentials (22%).
• Extortion without encryption — Some threat actors skip ransomware entirely and go straight to data theft + extortion. Faster, harder to detect, and often more profitable.

Implications for NIS2 compliance

• Incident reporting speed — 18-day dwell time means many incidents are detected well within the 24-hour reporting window, but the reporting infrastructure needs to be in place
• Supply chain security — 42% increase in supply chain attacks validates the need for supplier assessment
• Management awareness — AI-enhanced social engineering means even senior leaders can be targeted. Management training isn't bureaucratic overhead — it's operational security
• Business continuity — Ransomware's prevalence means tested backup and recovery procedures are essential, not optional

Looking ahead

• Continued growth in AI-assisted attacks (both in sophistication and volume)
• Increased targeting of edge and IoT infrastructure
• More regulatory enforcement as NIS2 matures across member states
• Growing need for sector-specific incident response capabilities