ENISA recorded 8,257 cyber incidents affecting organizations across the EU and EEA during 2025, according to its Threat Landscape 2026. The data reinforces a practical security priority for European businesses: phishing remains the most prevalent tactic in social-engineering activity, while disruption, unauthorized access, and digital dependencies continue to test resilience.
The ENISA Threat Landscape 2026 examines incidents reported between 1 January and 31 December 2025. Its findings put the scale of the threat into context. DDoS attacks accounted for the largest share of incidents, but unauthorized access was also widespread. For teams that rely on email, cloud software, external providers, and remote access, the report is a reminder that technical disruption and human-targeted intrusion attempts must be addressed together.
What ENISA’s 2025 data shows
Cybercrime drove many of the incidents analyzed by ENISA. The report also identifies public administration as the most affected sector, at about 31.8% of incidents. That concentration does not make other sectors less relevant. Digital services often connect public bodies, suppliers, customers, and business systems, so disruption or compromise can travel through dependencies beyond the initially affected organization.
The report’s incident categories and social-engineering findings measure different things, but together they show why security planning cannot focus on a single attack type.
| Finding from ENISA’s 2025 analysis | Share or result | Practical meaning |
|---|---|---|
| DDoS incidents | 51.3% of incidents | Service availability and operational continuity remain major concerns. |
| Unauthorised access incidents | 39.5% of incidents | Controlling access and detecting suspicious activity remain central to risk management. |
| Phishing in social-engineering-related activity | 77.8% | Email and other deceptive communications remain a key route for enabling intrusion. |
It is important not to read the 77.8% phishing figure as a share of all 8,257 incidents. ENISA identifies it specifically within social-engineering-related activity. Even so, the finding is significant because social engineering can be used to obtain credentials, persuade employees to take unsafe actions, or create an opening for further abuse.
ENISA also highlights the accelerating role of AI in phishing and related abuse. The report does not reduce the problem to AI alone. Rather, it places AI alongside an evolving threat environment in which attackers can adapt tactics and exploit connected digital services. That makes clear processes, informed staff, and up-to-date threat awareness more valuable, not less.
EU policy context and practical priorities
The Threat Landscape situates these trends within an evolving EU AI and cybersecurity policy framework. It references the AI Act, Cyber Resilience Act, NIS 2, and Cyber Solidarity Act, alongside the continuing importance of cross-border incident response and threat-intelligence sharing. The report does not present these measures as a single checklist for every company. Their shared direction, however, is toward stronger resilience across an increasingly interconnected European digital environment.
For business leaders, the immediate lesson is not to treat cybersecurity as a one-time technology purchase. The most useful response is to connect everyday operational risks to the threats ENISA identifies. Priorities supported by the report’s findings include:
- Strengthening phishing defences, including making staff aware of deceptive messages and reviewing how suspicious communications are handled.
- Using threat-informed risk management to focus attention on the intrusion routes and dependencies most relevant to the organization.
- Reviewing digital dependencies, particularly the services, suppliers, and connected systems that could affect continuity or expose business data.
- Preparing for coordinated response, with clear internal escalation paths and awareness of the value of timely information sharing when an incident occurs.
These actions matter because DDoS, unauthorized access, and phishing create different immediate problems but can all interrupt operations, affect customer trust, and consume scarce management time. A company does not need to mirror the scale of an EU-level response to benefit from the same principle: understand critical dependencies, identify likely attack paths, and make response responsibilities clear before an incident creates pressure.
Security planning becomes more useful when it is tied to real workflows rather than treated as a separate technical exercise. Businesses adopting AI tools or automating routine work should consider how those tools interact with access, data, communications, and third-party services. ENISA’s emphasis on AI-enabled abuse and wider digital dependencies makes that connection increasingly relevant.
Scalevise helps businesses turn emerging AI and technology risks into practical implementation decisions, from selecting suitable tools to mapping how they fit existing processes. A focused AI implementation and risk assessment can help identify where automation, data access, and customer-facing workflows need clearer safeguards before complexity grows. Build a practical roadmap that supports productivity without losing sight of operational resilience. Request an AI consultancy discussion today.
Frequently Asked Questions
What does ENISA’s Threat Landscape 2026 cover?
ENISA’s Threat Landscape 2026 analyzes cyber incidents affecting EU and EEA organizations from 1 January to 31 December 2025. It reports 8,257 incidents and examines threat patterns, affected sectors, and the wider EU cybersecurity context.
How prevalent was phishing in ENISA’s 2025 analysis?
Phishing was involved in 77.8% of social-engineering-related activity analyzed by ENISA. The figure refers to social-engineering activity, not to all reported cyber incidents.
What were the most common incident types in 2025?
DDoS accounted for 51.3% of incidents in ENISA’s analysis, followed by unauthorised access at 39.5%. These categories highlight both availability risks and the importance of protecting access to systems.
Which EU measures does the report reference?
The report references the AI Act, Cyber Resilience Act, NIS 2, and Cyber Solidarity Act as part of the evolving EU AI and cybersecurity policy framework.
Conclusion
ENISA’s 2025 findings show that Europe’s cyber risk remains both technical and human. DDoS and unauthorized access were major incident categories, while phishing remained the dominant social-engineering tactic. For businesses, the most practical response is to strengthen phishing defences, assess critical digital dependencies, and use threat-informed risk management as EU cybersecurity coordination continues to evolve.
