ENISA has released its Threat Landscape 2026 report, giving IT and security teams more reasons to revisit unresolved vulnerabilities and exposed systems. If a fix has been postponed because other work took priority, the report's examples of real attacks can help explain why it deserves attention now.
Below, we look at the report's main findings and what they mean for the systems you manage and your day-to-day work.
What is the ENISA Threat Landscape 2026?
The ENISA Threat Landscape 2026 is the yearly threat report of the European Union Agency for Cybersecurity (ENISA). Published on 22 September 2026, it analyses 8,257 cyber incidents recorded from 1 January to 31 December 2025. It describes the main threats, the groups behind them, how they got in, and which sectors they hit.
You can read the full ENISA Threat Landscape 2026 for free on ENISA's website.
ENISA built the dataset mainly from open sources, plus anonymised information from EU Member States and partners. Many incidents rest on claims made by the attackers themselves. ENISA warns that more reports of a threat do not always mean more activity.
ENISA appreciates that open sources and information shared voluntarily do not constitute a complete picture of the cyber threat landscape.
The report also uses fixed words for probability. "Highly likely" means above 90%, and "likely" means 60 to 90%. This summary keeps ENISA's wording wherever it makes a forecast.
What is the biggest threat in the ENISA Threat Landscape?
By count, the biggest threat in the ENISA Threat Landscape 2026 is DDoS, at 51.3% of recorded incidents. By impact, it is financially motivated activity, led by ransomware and data theft, which ENISA calls "the most impactful threat to EU organisations in the short-term."
DDoS: the most frequent incident type
A DDoS attack floods a website or service with traffic until it stops responding. Most of these attacks came from hacktivists, groups driven by politics or ideology. Almost nine in ten hacktivist claims were DDoS.
ENISA says ideology-driven claims "did not result in large-scale or significant impact." In a separate ENISA survey, representatives of high-criticality organisations called DDoS "noise," while ransomware dominated their concerns.
Ransomware and data theft: the biggest short-term threat
Financially motivated attacks were fewer than ideology-driven ones, but ENISA assesses their impact as greater. Among claims of financially motivated attacks, ransomware made up 47.3% and data breaches 36%. These percentages describe that subset of claims, not all incidents in the report.
ENISA sees a likely shift in ransomware from locking data towards stealing it and threatening to publish it. In the EU, the report adds, incident reporting and GDPR duties are likely to push some victims to pay to protect their reputation.
Cybercrime will highly likely remain one of the most impactful threats to business continuity for organisations operating in the EU as well as EU organisations operating abroad, ultimately having an economic impact on the EU market.
What does ENISA expect next?
ENISA assesses that criminal, hacktivist and state-linked groups are likely to use the same vulnerabilities, platforms and tools. Fixing a shared weakness can therefore prevent access by groups with different motives.
As a result, organisations may increasingly face different threats gaining unauthorised access through similar pathways, reinforcing the importance of addressing common weaknesses in addition to efforts to increase collective situational awareness.
The 2025 data already shows groups sharing tools. A state-linked group tracked as Moonstone Sleet deployed Qilin, a ransomware strain run by criminal gangs.
You can act without knowing who is attacking. Identify exposed systems and unresolved vulnerabilities, assign the fixes, and verify the results.
AI: faster attacks and new exposure
ENISA says attackers in 2025 mainly used consumer AI tools to improve existing skills and adapt attack methods, rather than to achieve breakthrough capabilities. Better AI models have already sped up finding and exploiting vulnerabilities.
AI also adds exposure inside companies. ENISA notes that AI systems built into company environments create a new attack surface, especially where they can reach files, credentials or browser sessions. Looking ahead, ENISA says AI "will highly likely increasingly support malicious operations."
How did attackers get in? Five entry points
The ENISA Threat Landscape 2026 points to five recurring ways in during 2025. They are exposed edge devices and business software, years-old flaws, misconfiguration and forgotten assets, suppliers and software dependencies, and stolen credentials. These five groups are our own grouping of the report's findings, and they overlap.
Entry points are hard to see in open-source data. Among incidents involving unauthorised access to systems or data, ENISA could identify how attackers got in for only 5.2%. Within that small group, 60.4% exploited a vulnerability and 20.7% came from misconfiguration or accidental exposure. Those percentages cannot tell us how common each entry point was across all incidents.
Edge devices and business software
Edge devices, such as VPN (virtual private network) gateways and firewalls, sit between your network and the internet. Ransomware groups got in through flaws in Fortinet, SonicWall and Cisco appliances. Some also used stolen credentials and password guessing against VPNs.
State-linked groups exploited flaws in Ivanti Connect Secure, Cisco firewalls, SAP NetWeaver and on-premises Microsoft SharePoint. ENISA explains the appeal: these systems "compress many sensitive trust relationships into a small number of exposed systems."
If you run any of these products and they face the internet, they belong at the top of your list. Keeping a current inventory of internet-facing systems is the job of attack surface monitoring.
Years-old flaws still exploited
Not every attack needs a new flaw. State-linked groups in the EU also exploited flaws that were years old. Examples include a 2017 Windows file-sharing flaw, a 2017 Microsoft Office flaw, Log4j from 2021, and Roundcube webmail flaws from 2020 to 2023.
ENISA also found 33 EU organisations that were targeted repeatedly, mostly by ransomware and data breaches. The report assesses it is likely "that the repeated targeting was enabled by a lack of restoration practices following incident response."
For routine vulnerability remediation, our recommendation is to confirm each fix with a rescan and keep the result in the vulnerability management lifecycle. That verifies the specific fix. It does not establish that an organisation has fully recovered from an incident.
Misconfiguration and forgotten assets
Misconfiguration can expose systems without any software flaw. Of the 5.2% of unauthorised-access incidents where ENISA identified the entry point, 20.7% involved misconfiguration or accidental exposure.
Forgotten subdomains are one example. Drawing on third-party research, ENISA describes a group called Hazy Hawk that takes over abandoned subdomains of real organisations. It uses DNS (Domain Name System) records that still point to services the owner stopped using, then hosts scams and malware there.
Abandoned subdomains can also leak credentials. Our article on how forgotten subdomains become breach paths explains that risk.
Suppliers and software dependencies
Attackers went after suppliers to reach many victims at once. ENISA judges it "highly likely" that criminals targeted third-party providers "as an opportunity to optimise the efficiency of their attacks." One ransomware attack on a Swedish IT supplier affected around 200 municipalities and regional authorities.
Software dependencies are a way in too. ENISA reports rising compromise of popular open-source libraries and npm packages (the main JavaScript package registry), including the Shai-Hulud campaign. ENISA published advice on using package managers safely in March 2026.
As organisations continue integrating third-party services into their operations, opportunities for threat groups to achieve broader impact through a single compromise are likely to increase.
If a customer asks how you manage supplier risk in a customer security questionnaire, explain how you track vulnerabilities in the software and services you depend on. Include records of the checks and follow-up actions.
Stolen credentials and social engineering
Many attacks start by tricking a person. Phishing made up 77.8% of the social engineering techniques ENISA observed. ClickFix is growing: fake "verify you are human" prompts that trick users into running an attacker's commands.
Some groups phoned staff while posing as IT support to steal single sign-on (SSO) passwords and multi-factor authentication (MFA) codes. Infostealer malware took credentials and session cookies, and leaked chats show such credentials feeding ransomware attacks.
What should you check this quarter?
We recommend these checks based on the entry points described above:
- Internet-facing systems: list every system that faces the internet and name an owner for each.
- Edge devices: check VPN, firewall and remote-access appliances against the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog, then patch or isolate what matches.
- Overdue fixes: review open known-exploited vulnerabilities and overdue fixes, and confirm each fix with a rescan rather than a ticket status.
- DNS records: remove records that point to services you no longer use.
- Suppliers and dependencies: ask key suppliers how they handle vulnerabilities, and keep a list of the open-source packages your software uses.
- Sign-in: protect admin and remote access with phishing-resistant sign-in.
Known exploitation matters more than severity alone when you decide what to fix first. Our piece on risk-based prioritisation explains why.
What does the report mean under NIS2?
Most recorded incidents hit organisations that NIS2 covers. ENISA reports that about 73% of recorded events affected essential and important entities under the NIS2 Directive, the EU law that sets cybersecurity and incident-reporting duties for critical sectors.
The report also examines a separate dataset of notifications under NIS2. EU Member States reported 1,954 events for 2025, as of 14 July 2026. These include significant incidents, other incidents, cyber threats and near misses. Of the 941 that involved malicious action, around half had an unknown root cause. That figure does not tell us why the cause was unknown or establish that the organisations kept poor records.
Under NIS2, an in-scope entity must send an early warning within 24 hours of becoming aware of a significant incident, and a notification within 72 hours. Records built before an incident, such as an asset list and a history of scans and fixes, can support the investigation and reporting. Our guide to NIS2 compliance covers the full requirements.
Frequently asked questions
What does ENISA do?
ENISA is the European Union Agency for Cybersecurity. It works with EU countries and institutions to raise the level of cybersecurity across the EU, and publishes the ENISA Threat Landscape every year. Since November 2025 it has also been a CVE (Common Vulnerabilities and Exposures) Root, helping assign identifiers to new vulnerabilities.
What will the cyber threat landscape look like in 2026?
ENISA assesses that AI will highly likely support more malicious operations, and that in 2026 AI is likely to directly enable more phases of an attack. Cybercrime will highly likely remain one of the most impactful threats to business continuity. Criminal, hacktivist and state-linked groups are likely to exploit the same vulnerabilities, and attacks on third-party providers are likely to reach more victims through a single compromise.
Is the ENISA Threat Landscape relevant outside the EU?
Yes. The data covers incidents affecting the EU, so its percentages describe the EU. The products attackers exploited, such as Fortinet, Cisco and SharePoint, and methods such as phishing and supplier attacks, are used worldwide.
Where can I read the full ENISA Threat Landscape 2026?
The full report is free on ENISA's website. Unless otherwise noted, you can reuse ENISA-owned content and charts under CC BY 4.0 with credit to ENISA and a note of any changes. Third-party material may require separate permission. The cover image is excluded.
Turn the findings into assigned work
Start with the internet-facing systems you own. Review their known-exploited vulnerabilities, assign an owner and deadline to each unresolved finding, and retain the verification results. That gives your next security review a record of what was fixed and what still needs attention.
Read-only access · Working scan data deleted after each scan · EU-hosted
