The cyber threat landscape of the European Union is still shaped by a combination of recurrent threats, according to the new report ENISA, the European Union Agency for Cybersecurity.
ENISA collected and analysed incidents and events observed from 1 January to 31 December 2025 for the new edition of the Threat Landscape. It says that geopolitical developments still influence cyber activity affecting the EU, and that emerging AI models are expected to be increasingly used to support malicious operations.
-
Where ENISA could identify the intrusion vector in 2025, 60% of unauthorised-access incidents came through a N-day and 0-day vulnerability. At the same time, the targeting of supply chains, third-party providers, cloud environments and other cyber dependencies continued resulting in impactful and large-scale incidents.
-
State-nexus intrusion sets were mostly reported to be relying on unauthorised access (81.7%) as well as phishing campaigns (12%). ENISA was able to identify an initial intrusion vector in only 20% of the recorded incidents. Within this subset, vulnerability exploitation was the most frequently observed intrusion vector, accounting for 70% of identified cases. The increase in insider threats (5%) represents a particular concern. Intrusion sets associated to Russia accounted for 47.6%, followed by China (15.5%), North Korea (14.1%) and Iran (9%).
Here is the full report: ENISA Threat Landscape 2026 (pdf)
[Edit to insert the archived link.]