Overview 

The European Union’s cybersecurity framework continues to evolve in response to mounting threats, rapid digital transformation, and complex geopolitical challenges. The 2024 ENISA report on “The State of Cybersecurity in the Union” offers an evidence-based assessment of Europe’s cybersecurity maturity, capabilities, and the measures needed to address pressing challenges.  

This inaugural report reflects a collective effort to strengthen the Union’s cybersecurity framework, enhance cooperation among Member States, and safeguard the digital environment for all citizens. 

A Mandate to Assess Cybersecurity Across Europe 

Under Article 18 of the NIS2 Directive, ENISA was entrusted with preparing a biennial report to evaluate the state of cybersecurity in the EU. The inaugural 2024 report provides evidence-based insights into the Union’s cybersecurity maturity, critical sector capabilities, and societal preparedness. 

Juhan Lepassaar, Executive Director of ENISA, emphasized the importance of this initiative: 
“Since its establishment, ENISA has been steadfast in its commitment to providing expertise and strategic support to EU Member States. Amidst growing cybersecurity threats, technological advancements, and a complex geopolitical landscape, it is vital to assess our capabilities. This process allows us to evaluate our maturity levels and strategically plan the next steps. The first report on the state of cybersecurity in the Union reflects on our ongoing collective efforts and underscores our shared goal to bolster security and resilience across the EU.” 

The report integrates insights from multiple sources, including the EU Cybersecurity Index, ENISA’s Threat Landscape report, and extensive consultations with the European Commission and all 27 member states. 

Cybersecurity Capabilities: Progress with Room for Improvement 

The EU has made strides in strengthening its cybersecurity posture, but disparities among member states and sectors persist. The Union-level risk assessment revealed a substantial cyber threat level to the EU. Threat actors, ranging from cybercriminals to state-aligned groups, exploit vulnerabilities in critical sectors and governmental systems. Key challenges include: 

• Persistent ransomware and Distributed Denial of Service (DDoS) attacks. 
• Geopolitically motivated disinformation campaigns and cyber espionage. 
• Increasing reliance on supply chains, which remain a significant target for attackers. 

Figure 1. Different types of cyberattacks targeted at EU (Source: ENISA) 

Ransomware remains one of the most significant threats in the EU, with attackers shifting from encryption to data exfiltration, ENISA noted. Small and medium-sized enterprises (SMEs) are increasingly targeted, and double extortion tactics are now standard among established ransomware groups. 

Cybercriminals exploit social engineering, such as phishing emails with malicious links and social media scams, to steal credentials. The use of AI to generate phishing emails and deepfakes has intensified these efforts. 

Hacker-for-hire services are on the rise, driving the professionalization of cybercrime and aiding state-nexus actors. Despite high-profile arrests and takedowns by law enforcement disrupting these networks, many criminal groups are reorganizing, likely pivoting to new business models to sustain profitability. 

National Capabilities: Aligning Strategies 

Member states have developed national cybersecurity strategies, with varying levels of maturity: 

• Nine countries have third-generation strategies, reflecting advanced planning and execution. 

• Four member states are still implementing their first-generation strategies. 

Figure 2. National cybersecurity strategy maturity and implementation in EU (Source: ENISA) 

Although most strategies share common objectives, supply chain security is notably underrepresented. This gap points to the need for continuous updates to address emerging threats. 

Sector-Specific Progress: Leading and Lagging Sectors 

Key sectors like telecommunications, finance, and energy lead in cybersecurity maturity, supported by strong regulatory frameworks and proactive risk management. However: 

• The health and transport sectors exhibit moderate maturity, grappling with legacy systems and fragmented oversight. 
• The oil sector lags significantly, requiring urgent attention to enhance its cybersecurity capabilities. 

Figure 3. Cybersecurity of top 10 critical sectors in EU (Source: ENISA) 

Figure 4. Public and Transport were the most targeted sectors in EU (Source: ENISA) 

Policy Recommendations: Building a Unified Approach 

One of the core objectives of this study from ENISA on EU’s state of cybersecurity is to address shortcomings in policy execution. ENISA identified four priority areas to guide policy recommendations: 

1. Policy Implementation 
2. Cyber Crisis Management 
3. Supply Chain Security 
4. Cybersecurity Skills 

Recommendations to Strengthen the EU’s Cybersecurity Framework 

ENISA outlined six actionable recommendations to bolster Europe’s cybersecurity posture: 

1. Support for Key Stakeholders: Provide technical and financial assistance to EU institutions, national authorities, and entities within the NIS2 Directive’s scope to ensure harmonized policy implementation. 

2. Revise the EU Blueprint: Update the EU’s framework for managing large-scale cyber incidents, focusing on enhanced situational awareness and operational cooperation. 

3. Expand the Cyber Workforce: Launch initiatives under the Cybersecurity Skills Academy, including standardized training and an EU-wide certification scheme, to close the skills gap. 

4. Fortify Supply Chains: Conduct coordinated risk assessments and develop comprehensive policies addressing cybersecurity challenges in supply chains across sectors. 

5. Tailored Sectoral Support: Leverage the Cybersecurity Emergency Mechanism to enhance preparedness in weak or vulnerable sectors, as identified through risk assessments. 

6. Promote Awareness: Harmonize national efforts to improve cybersecurity awareness and cyber hygiene among citizens and professionals, regardless of demographic or geographic differences. 

Education and Workforce Development: Addressing the Skills Gap 

The EU’s ability to counter cyber threats hinges on its talent pool, according to ENISA. It identified significant disparities in cybersecurity education and workforce development: 

• Education Program Availability: While most member states offer cybersecurity programs at the university level, access and funding mechanisms vary widely. 

• Digital Skills Deficit: Nearly half of EU citizens lack basic digital skills, limiting their ability to navigate online risks effectively. 

• Workforce Initiatives: Programs like the Cybersecurity Skills Academy aim to standardize training and attract talent to close the cybersecurity skills gap. 

These efforts must be complemented by targeted campaigns and incentives to upskill citizens and professionals. 

Preparing for Emerging Challenges 

The future of cybersecurity in the EU will be shaped by emerging technologies and evolving threats. Two areas demand immediate attention, according to ENISA: 

• Artificial Intelligence (AI): AI-powered tools are increasingly used in cyberattacks, from generating fake content to automating phishing campaigns. Addressing AI risks requires a balanced approach to innovation and regulation. 

• Post-Quantum Cryptography: As quantum computing advances, traditional encryption methods may become obsolete. Investing in quantum-resistant technologies is essential to secure sensitive information. 

The evolving dependency on emerging technologies like quantum computing and AI is adding complexity to the threat landscape, necessitating enhanced preparedness. The ENISA study points to the trends in cybersecurity threats through 2030, emphasizing the growing influence of non-state actors. 

Figure 5. Cyberthreats to lookout for in the EU through 2030 (Source: ENISA) 

While risks like supply chain compromises and advanced disinformation campaigns may slightly decline, they remain significant. Conversely, threats from human error, exploited legacy systems, unpatched software, and environmental disruptions impacting critical infrastructure are expected to intensify. 

Advanced hybrid threats—combining interference, social engineering, and disinformation—pose top-tier risks, particularly in contexts like elections. Skills shortages and AI’s potential to disrupt or enhance cyberattacks are also gaining attention, underscoring the need for ethical considerations in deploying emerging AI technologies. 

Conclusion 

The 2024 ENISA report marks a significant step in assessing and addressing the EU’s cybersecurity challenges. By fostering collaboration, implementing harmonized policies, and investing in education, the EU is laying the foundation for a secure and resilient digital future. 

As the Union navigates emerging threats and technologies, collective action and shared responsibility will be vital. With its robust policy framework and commitment to innovation, the EU is poised to set a global benchmark for cybersecurity excellence. 

References: 

https://www.enisa.europa.eu/news/eus-first-ever-report-on-the-state-of-cybersecurity-in-the-union
https://www.enisa.europa.eu/topics/state-of-cybersecurity-in-the-eu

Related