EU cyber agency: AI leads to a 300 per cent increase in vulnerabilities

The time available to businesses to defend themselves against a cyberattack is shrinking to almost zero, and AI has accelerated the discovery of vulnerabilities in digital systems. This is according to the 2026 report on the state of cybersecurity in the European Union, drawn up by ENISA, the European Union Agency for Cybersecurity in collaboration with the Commission and the Member States. “The number of vulnerabilities detected over the last three months has risen by over 300 per cent compared with the same period last year,” explains Juhan Lepassaar, Executive Director of ENISA. “In the past, these flaws were identified by researchers or specialist firms.

‘Now, thanks to artificial intelligence, vulnerabilities can be identified on an industrial scale.’ The document paints a picture of a 27-member Europe that is better equipped than it was two years ago, but facing new challenges. The level of cyber threat remains ‘substantial’, the report states, but the conflict in Ukraine and those in the Middle East are accelerating cyber activities hostile to the Union, fuelling the so-called ‘hybrid war’.

In 2025, 57.3 per cent of the incidents analysed by ENISA were attributable to ideological motives, 29.3 per cent to financial gain and 5.9 per cent to cyberespionage. The public sector remains the hardest-hit sector, accounting for 31.8 per cent of incidents, followed by business services (8.5 per cent), transport (8 per cent) and manufacturing (6.9 per cent). “As geopolitical tensions rise, so too do cyber threats,” emphasises Lepassaar. “DDoS attacks (Distributed Denial-of-Service, ed.) remain the main type of incident in Europe (51.3%)”. These are operations that aim to render websites and digital services inaccessible by flooding them with requests. “In the public sector, ideologically motivated DDoS attacks accounted for 81.8 per cent of recorded incidents.”

However, it is attacks carried out for financial gain that have the most serious consequences for business continuity, particularly ransomware. “In 2022, ENISA estimated the median direct cost of major cyber incidents at 300,000 euros,” notes Lepassaar. The cost of a coordinated attack, however, has not yet been assessed. Of particular concern is the growing interdependence of production systems. Fifty-five per cent of organisations surveyed by the European Agency cite ransomware as one of the main threats, whilst 47 per cent cite attacks on supply chains. Excluding the banking sector, over a third of the organisations surveyed say they feel unprepared to deal with cyber risks linked to supply chains. In the IT service management sector, 45 per cent of those surveyed take more than three months to install critical security updates on equally critical systems. “These are companies that provide services to other businesses, which therefore remain vulnerable throughout this period,” says Lepassaar.

A breach in a single supplier’s systems can therefore spread throughout entire supply chains, with cross-border consequences. The Cyber Resilience Act, the European regulation introducing common cybersecurity requirements for digital products placed on the EU market – which will be fully applicable from December 2027 – aims to reduce this exposure by introducing security obligations right from the design stage of digital products. Brussels, therefore, is seeking to tackle the threat through regulation and investment: 1.4 billion between 2021 and 2027 via the Horizon Europe and Digital Europe programmes. In light of this, the European Cybersecurity Index gives the EU an average score of 71.53 out of 100, with 22 Member States showing a high level of maturity and two an advanced level. However, a common response to the threat still seems a long way off. “There is a solid framework for crisis management. What is still missing is a shared, real-time picture of the situation,” says Lepassaar.