ENISA report says shared suppliers widen Europe’s attack surface
The EU cyber agency’s review of 2025 finds supply-chain and third-party attacks usually lead to large-scale incidents. Its sector data matters to UK and Irish partners serving EU customers
- ENISA’s previous report, published in October 2025, covered July 2024 to June 2025, so the two editions overlap by six months
- Hacktivists made 4,709 claims against EU member states, and more than 89% involved DDoS attacks
- Ransomware deployment made up 40% of the cybercrime events ENISA analyzed
- ENISA expects threat groups to make growing use of AI models, and treats business AI systems as an extended attack surface
Map which suppliers, especially managed service and managed security providers, hold standing access to your systems, and rank them by what they could reach if compromised. Ask each for evidence of how fast they patch exploited vulnerabilities, not a policy document. Organizations with EU operations under NIS2 should check whether supplier contracts cover security controls and incident notification. Keep DDoS protection on public-facing services, but put new effort into third-party access.
“The analysis highlights how threats become more interconnected and how threat groups spread their impact across the larger map of digital services and infrastructures.”Juhan Lepassaar, executive director, ENISA
The European Union Agency for Cybersecurity (ENISA) published its Threat Landscape 2026 on 22 September. Nearly three-quarters (73%) of the organizations targeted in the incidents it analyzed were essential or important entities as defined by the EU’s NIS2 directive.
The report covers events from 1 January to 31 December 2025, gathered from open sources, anonymized information shared by EU member states and ENISA’s Cyber Partnership Programme. Public administration was again the most targeted sector, at 32% of cases, well ahead of business services and transport at 8% each.
Much of that volume is noise. Low-impact distributed denial-of-service (DDoS) attacks made up 51% of recorded cases, and ideology drove 57% of incidents against almost 30% that were financially motivated. The more serious finding is about dependencies: ENISA says attacks on supply chains and third parties usually produce large-scale or high-impact incidents.
Vulnerabilities remain a main way in. More than 48,000 new common vulnerabilities and exposures (CVE) identifiers were published in 2025, up 22% on the year before. Where ENISA could identify how attackers got in during unauthorized-access incidents, 60% exploited a vulnerability, though it could trace the entry point in only 5% of those cases.
ENISA links the findings to its NIS360 assessment, which rated several sectors’ maturity below their criticality. One of them is ICT service management, the NIS2 sector that includes managed service providers and managed security service providers (MSSPs).
Sources
- ENISA, “Exploring the evolution of the cyber threat landscape: How dependencies weaken our digital resilience”, press release, 22 September 2026. https://www.enisa.europa.eu/news/exploring-the-evolution-of-the-cyber-threat-landscape-how-dependencies-weaken-our-digital-resilience
- Help Net Security, “Europe's technology backbone is becoming a cyber target”, 24 September 2026. https://www.helpnetsecurity.com/2026/09/24/enisa-eu-cyber-threats-report/
