ENISA's report titled "The State of Cyber Security Together", published every two years, reveals the EU's current capacity in the field of cyber security, the threats it faces and policy priorities for the future.
The report states, "The level of cyber threat to the EU remains high. Although the cyber security situation of the EU has improved in general, the entire ecosystem is in change." statements were included.
The report noted that cyber attack activities continued significantly in 2025 and 2026, and stated that the threat environment is becoming increasingly complex.
"While ideology is the main cause of cyber incidents, artificial intelligence has a multiplier effect."
The report states, "While ideology continues to be the main cause of cyber incidents, geopolitical developments are effective in shaping cyber activities. While activities aimed at financial gain maintain their influence, activist hacker groups continue to dominate in terms of the number of attacks." information was given.
In addition, the report points out that artificial intelligence creates a multiplier effect that increases both attack and defense capacities, adding: "Advances in artificial intelligence models accelerate the detection of security vulnerabilities and exploiting these vulnerabilities." warning was given.
In the report, it was noted that in the light of these developments, simultaneous trends came to the fore in the field of EU's cyber security policies.
The report noted that progress has been made in the implementation of the Network and Information Security Directive (NIS2), Cyber Resilience Act and Cyber Solidarity Act across the EU and added: "However, the interaction between cross-border activities and different legislative regulations is becoming increasingly important. This situation brings about efforts to simplify and reorganize the legislation." evaluation was included.
On the other hand, the report noted that geopolitical conditions and technological developments have led to the launch or update of various initiatives, including the proposal for the second version of the Cybersecurity Act (Cybersecurity Act 2) and the recently announced EU Cybersecurity and Artificial Intelligence Action Plan.
"The majority of EU countries have advanced cyber security capacity"
The report stated that the EU Cyber Security Index developed by ENISA contributes to the assessment of the maturity level of member countries' cyber security capacities and resources, and that the EU-wide average of the index, which is scored between 0 and 100, was calculated as 71.53 points in 2026.
The report stated that member countries are generally at a compatible level with each other, most of them have reached mature or more advanced cyber security capacity and are on the way to reaching a common, high level of cyber security across the EU.
The report noted that most of the member countries have reached a mature or advanced level in policy implementation at the national level, and the average score in this field was stated to be 66.72.
"Progress must occur on an equal basis"
In the report, five basic strategic directions for the future of the EU were identified and policy recommendations based on them were developed.
It was stated in the report that the focus should be on facilitating cross-border activities and issues related to different legislative regulations among member countries in the field of transition to effective implementation, and that all relevant actors should participate in the "2025 Road Map" and that capacities and information sharing should be better organized and developed in order to adopt comprehensive operational capacity in crisis situations.
It was stated that in order to improve the preparedness and resilience capacity of critical infrastructures, progress should be made equally in the operational conditions of the sectors.
In the field of managing supply chains and cross-border dependencies at the EU level, it was underlined that supply chain risks and cross-border dependencies are gaining increasing importance with their consequences extending beyond the technical dimension.
"Challenges continue"
ENISA Executive Director Juhan Lepassaar, whose statements are included in the report, stated that the "State of Cyber Security Together" Report reflects the joint effort and determination of the EU to become more resilient.
"However, challenges remain. Recent developments in advanced artificial intelligence models, as well as cyber incidents in cooling systems across the EU, reveal operational deficiencies and the need for timely information sharing and coordination," Lepassaar said. he warned.
Noting that common situational awareness should be strengthened and the harmony between policies for critical sectors should be increased, Lepassaar said, "Progress has been made, but now we must build on this foundation and update our strategies to respond to the increasingly complex cyber security environment." he said.
