Cybersecurity capacity across the European Union has improved, but the bloc’s cyber threat level remains “substantial,” the European Union Agency for Cybersecurity (ENISA) said Tuesday. The agency cited frontier AI models and cyber incidents involving refrigeration systems in calling for stronger information sharing and coordination.
ENISA’s 2026 Report on the State of Cybersecurity in the Union found that the EU’s overall cybersecurity posture had improved. Its 2026 EU Cybersecurity Index gave member states an average score of 71.53 out of 100 for cybersecurity maturity, capabilities and resources. ENISA said most countries had reached mature or advanced levels.
The index score and threat rating describe different parts of the assessment: the index tracks member states’ cybersecurity maturity and resources, while the rating describes risks facing organizations and public institutions. Under ENISA’s definition, organizations may be directly targeted or exposed to breaches exploiting recently discovered vulnerabilities. The rating also means serious disruption is a realistic possibility for essential and important entities, as well as EU institutions, bodies and agencies.
ENISA linked its call for more information sharing and coordination to frontier AI models and incidents affecting refrigeration systems. Executive Director Juhan Lepassaar said the findings showed “the need for timely information sharing and coordination.” He also called for a more unified understanding of cyber risks and closer policy alignment in critical sectors.
A separate 2026 ENISA Threat Landscape report reviewed activity observed during 2025. It said geopolitical developments continued to shape cyber activity affecting the EU and that emerging AI models were expected to appear more often in malicious operations. The report also said cyber dependencies widen the attack surface and ransomware remained the incident type with the greatest short-term impact.
