ENISA Threat Landscape 2026: Frequency Is Not Impact

On 22 September 2026, the European Union Agency for Cybersecurity (ENISA) published the ENISA Threat Landscape 2026, its annual account of the cyber threats affecting EU Member States and EU-based organisations. The report analyses 8,257 incidents recorded between 1 January 2025 and 31 December 2025, drawn mainly from open sources and supplemented by anonymised information from Member States and members of the ENISA Cyber Partnership Programme.

Most summaries of the report lead with one number: distributed denial of service (DDoS) attacks were 51.3% of recorded incidents. That is accurate and, read alone, misleading. The report's own argument is that the most frequent threat and the most damaging threat are different threats. DDoS dominates the count and ENISA calls it low-impact. Financially motivated activity, particularly ransomware, is 29.3% of incidents and ENISA calls it the most impactful in the short term. Exploited vulnerabilities dominate the intrusion entry points ENISA could identify. An executive team that allocates attention by incident count will fund the wrong program.

This piece reads the report for EU-exposed companies and deal teams: what the data says, what each figure is a share of, and what should move in budgets, NIS2 management-body oversight and cyber due diligence scope.

Key Takeaways

• Frequency: DDoS made up 51.3% of the 8,257 incidents ENISA recorded for 2025. ENISA describes these attacks as low-impact, and ideology-driven claims "did not result in large-scale or significant impact"
• Impact: financially motivated activities, 29.3% of all recorded incidents, "particularly ransomware, remained the most impactful incidents in the short-term". Ransomware was 47.3% of recorded financially motivated claims
• Entry: where ENISA could identify the intrusion vector in an unauthorised-access incident, 60.4% leveraged a vulnerability. The vector was identified in only 5.2% of those incidents, so this is a finding about a small subset
• Exposure: NIS2 essential and important entities represent 73% of recorded events. Public administration is the most targeted sector at 31.8%
• Claims versus reality: only 23.8% of the NoName057(16) DDoS claims ENISA assessed were validated by independent third-party availability checks
• AI: ENISA assesses AI will highly likely increasingly support malicious operations, and that it is likely 2026 will see more kill-chain phases directly enabled by AI. In 2025 the observed use was mostly augmentation of existing skills

What Did ENISA Count, and What Are the Limits of the Count?

Every figure in the report is a share of something, and the denominators differ. Before using any of them in a board paper, fix what was counted.

The dataset is 8,257 incidents, collected mainly from open sources. ENISA is explicit that open sources and voluntarily shared information "do not constitute a complete picture". Two biases matter for an executive reader. First, visibility: ransomware and DDoS are, in ENISA's words, immediately visible threats often claimed directly by their operators, while cyberespionage campaigns are typically documented with a delay "spanning from six months to more than four years". Second, attention: increased reporting of a threat "does not necessarily reflect an increased tempo of activity" and can reflect the audience's interest in a geopolitical context.

Two methodological changes also affect comparisons with last year. The reporting period moved to the calendar year, which creates a six-month overlap with the ENISA Threat Landscape 2025. And ENISA expanded the number of tracked cybercrime activities, including data breaches and fraud, which it says affected the numbers without substantially changing trends and rankings. Year-on-year deltas built from the two reports should be treated with care.

The Most Frequent Threat Is the Least Consequential

DDoS is the primary incident type at 51.3%. By assessed objective, ideology-driven incidents are 57.3% of the total, largely hacktivist-led DDoS campaigns against public-facing services tied to political developments, including support for Ukraine or Israel. ENISA's judgement on the consequence is plain: the distribution of incident types "remains dominated by low-impact DDoS attacks", and despite representing most incidents, ideology-driven claims "did not result in large-scale or significant impact". The report adds that in ENISA's NIS investments work, representatives of organisations in NIS sectors of high criticality characterise DDoS as "noise", while ransomware dominates their concerns.

The report also tests the claims themselves. ENISA analysed DDoS activity linked to the hacktivist group NoName057(16) and its DDoSia project between July and November 2025. The group's public claims generally aligned with the intended targeting, but only 23.8% of the claims assessed were validated through independent third-party availability checks. ENISA's reading is hedged and should stay hedged: the disparity "suggests that some claims may have served an influence objective by inflating perceptions of operational impact". The 23.8% is a share of the claims ENISA assessed from one group over five months. It is not a failure rate for DDoS in general.

The practical point is that a hacktivist DDoS campaign has two outputs, an outage that often cannot be verified and a headline that always can. Public administration, the most targeted sector at 31.8% of recorded events, absorbs most of both. For a company, the availability control is a solved engineering problem: upstream mitigation, tested failover and a communications line ready for the claim. It deserves competent, bounded spend, and it does not deserve half the threat briefing.

Ransomware Carries the Short-Term Impact, Espionage the Long-Term

ENISA's impact ranking runs against its frequency ranking. Financially motivated activities account for 29.3% of all recorded incidents, and "particularly ransomware, remained the most impactful incidents in the short-term". Within recorded financially motivated claims, ransomware is 47.3% and data breaches 36%, followed by fraud and impersonation at 13.3%. ENISA notes these categories overlap, since exfiltrated data is advertised in forums and reused in later fraud and ransomware. Manufacturing, business services and public administration were among the sectors most affected by cybercrime-related activity.

The second-largest incident type, unauthorised access at 39.5%, is where this activity concentrates: 63.9% of unauthorised-access incidents were financially motivated, 15.3% ideology-driven and 13.6% cyberespionage. Among social engineering techniques, phishing remains the prevalent one at 77.8%, with ENISA highlighting the growth of ClickFix, SMS phishing and phishing-as-a-service kits.

State-nexus cyberespionage is 5.9% of recorded activity. The small share is a product of the visibility bias above, and ENISA says so directly: while hacktivist claims remain numerous, "the threat of cyberespionage represents a more impactful threat in the long term". For an acquirer, that documentation delay of six months to more than four years is the relevant fact. An espionage compromise of a target's intellectual property is unlikely to appear in a public dataset before signing.

Exploited Vulnerabilities Lead the Identified Entry Points

Here the denominator needs the most care. ENISA could identify an intrusion vector in only 5.2% of unauthorised-access incidents. Within that subset, 60.4% leveraged a vulnerability and 20.7% involved misconfiguration or accidental exposure. The finding is therefore that exploitation dominates the cases where the entry point is known, not that 60.4% of all incidents, or of all unauthorised access, began with an exploit. For roughly nineteen in twenty unauthorised-access incidents in the dataset, the way in was not identified.

The supporting evidence in the vulnerabilities chapter points the same way. More than 48,000 new vulnerabilities were published with CVE identifiers in 2025, a 22% increase on the previous year, and 71% of documented vulnerabilities carried a network attack vector. ENISA reports confirmed attacks against enterprise infrastructure, edge devices and developer tooling, and states that attackers continued to weaponise newly disclosed vulnerabilities "within a constantly decreasing time span". That is the dynamic we set out in the Velocity Gap doctrine: the exposure that matters is the interval between weaponisation and containment, and it is the one interval the executive team can shorten.

Dependencies are the other entry route the report stresses. ENISA records continued targeting of third-party providers and the digital supply chain, and singles out "the increase in compromises of popular libraries or npm packages, as seen with the Shai-Hulud campaign". Its outlook is that opportunities to achieve broader impact through a single compromise are likely to increase as organisations integrate more third-party services.

What Does ENISA Actually Say About AI?

The report is more measured than its coverage. On observed activity, ENISA writes that reporting over 2025 "indicates that attackers primarily use consumer-grade AI tools to augment existing skills and adapt attack vectors rather than to achieve breakthrough capabilities", with AI often "in a supporting role rather than as a primary capability". It also notes that model improvements "have already been seen accelerating vulnerability discovery and exploitation".

On the outlook, the probability words carry the meaning. ENISA assesses that artificial intelligence "will highly likely increasingly support malicious operations". It assesses that it is "likely 2026 will see an increased number of the kill chain's phases being directly enabled by AI, with possible experimentation of Human-out-of-the loop proof of concepts". And it expects AI will "highly likely continue to primarily act as a force multiplier". In the report's assessment matrix, highly likely corresponds to confidence above 90% and likely to 60% to 90%.

Read precisely, that is a high-confidence forecast of more AI support, a moderate-to-high-confidence forecast of more attack phases enabled by AI during 2026, and a description of autonomy as possible experimentation. It supports the control priorities in our February board briefing on AI-powered attacks. It does not support a claim that AI-run attacks drove the 2025 numbers. ENISA places the topic alongside the Commission's Action Plan on Cybersecurity and Artificial Intelligence, which we read in July as Brussels ending the separation of AI governance and cyber compliance.

What Share Falls on NIS2 Entities, and What Follows for the Management Body?

ENISA's sectoral analysis states that, although recorded events include non-NIS2 sectors, "essential and important entities represent 73% of the total number of recorded events, confirming the relevance of the NIS2 approach". The 73% is a share of recorded events. It says the regime's scope matches where recorded activity lands. It is not the likelihood that a given entity is hit.

For entities in scope, the data sharpens two existing duties in Directive (EU) 2022/2555. Article 20 requires management bodies to approve the cybersecurity risk-management measures, oversee their implementation, and follow training, and provides that they can be held liable for infringements. Article 21(2) lists the measures, including supply chain security and vulnerability handling and disclosure. The report's two leading entry routes, exploited vulnerabilities and compromised dependencies, are named items on the list the board signs. National transpositions carry the same accountability, as with Sweden's Cybersecurity Act (2025:1506). Product manufacturers have a parallel clock, since CRA Article 14 reporting of actively exploited vulnerabilities now applies.

What This Changes for the Executive Team and the Deal Team

Report impact, not incident counts. A dashboard that counts blocked DDoS events reproduces the dataset's frequency bias inside the company. The management body should see time to remediate exploited and internet-facing vulnerabilities, ransomware recovery time tested against real backups, and the number of critical third parties with verified controls.

Re-weight the budget toward the impact and entry findings. The ENISA data argues for holding availability spend at a competent baseline and directing marginal spend to ransomware resilience, to patch and exposure management on edge devices and internet-facing systems, and to software supply chain controls over packages and build pipelines. This is our reading of the data, not a recommendation ENISA makes.

Put Article 21(2) items on the oversight agenda by name. Vulnerability handling and supply chain security should each have an owner, a metric and a reporting cadence the board has approved. Oversight that is limited to an annual policy sign-off does not match the entry routes the report documents.

Keep the AI briefing calibrated. Tell the board what ENISA assessed, with its probability words intact. The decision it supports today is faster remediation and stronger identity controls, because augmentation makes existing techniques quicker.

Scope diligence to the impact drivers. In a transaction, the questions that follow from this report are specific: what is exposed to the internet and how long exploited vulnerabilities stay open, whether ransomware recovery has been tested, which dependencies could carry a compromise downstream, and whether the target is an essential or important entity with a functioning management-body record. A target's DDoS history tells an acquirer little. These questions fit the infrastructure, incident response, third-party risk and compliance domains of our cybersecurity due diligence framework. The absence of a known espionage incident should be recorded as unknown, given the documentation delay ENISA describes.

How Innovaiden Approaches It

The ENISA Threat Landscape 2026 gives boards a rare thing: an official dataset that separates what is frequent from what is costly, with its own limits stated. The useful response is to test whether your program is weighted the same way. Innovaiden's Threat-Weighted Oversight Review maps budget, management-body reporting and third-party coverage against the report's impact and entry findings, and produces a short list of reallocations and oversight changes with owners. For deal teams, the same lens sets the scope of cyber diligence on an EU-exposed target. If your reporting still leads with incident counts, the Threat-Weighted Oversight Review is the place to start.