Compliance and Audits

ENISA on the state of EU cybersecurity: index 71.53 out of 100, CSIRT maturity lowest, AI accelerates flaw detection

On November 10, 2026, ENISA published the second edition of the report on the state of cybersecurity in the Union, prepared every two years based on Art. 18 of the NIS2 Directive. The average EU cybersecurity index is 71.53 points out of 100. The agency continues to assess the threat level for the Union as significant.

  • SourceENISA
  • Source publicationNovember 10, 2026
  • TypeRegulations and standards

What happened

The report is adopted by ENISA in cooperation with the European Commission and the NIS Cooperation Group. This year’s edition introduces a “strategic compass”: five directions with assigned recommendations. These include effective implementation of regulations, operational capacity in the event of a crisis, critical infrastructure resilience, risk and dependency management in supply chains, and long-term societal resilience built on skills.

The index shows where member states are strong and where they are not. Supply chain management by essential and important entities scored 89.91 points, while policy implementation at the national level scored 66.72. CSIRT maturity was rated at 54.76 points and is uneven across countries. National certification systems received 55.56 points.

ENISA reports that regulatory compliance is the main driver of cybersecurity investment in critical sectors (70%). The number of countries with a national coordinated vulnerability disclosure policy increased from 7 to 17. The agency also writes that AI “industrializes” vulnerability detection and requires greater handling capacities. Executive Director Juhan Lepassaar named incidents in refrigeration systems across the EU among recent signals.

Key findings

  • EU Cybersecurity Index 2026: 71.53 out of 100; most countries reached a mature level or higher.
  • Highest: supply chain management (89.91) and research and development (79.24).
  • Lowest: CSIRT maturity (54.76), primary and secondary education (55.44), certification (55.56).
  • Motivations: according to ENISA, the main cause of incidents is ideology, and hacktivists are responsible for the highest number of attacks.
  • According to a Cloud Security Alliance review, the report identifies vulnerability and patch management, business continuity, and supply chain risk as the most challenging areas of NIS2.

Why it matters

SafeWave CommentaryThe report is addressed to states and institutions, but it shows what supervisory authorities will be looking at. The high supply chain rating is based on state declarations, and the three areas identified as the most difficult are those where evidence is hardest to produce during an audit: who patches and in what timeframe, when recovery was last tested, and what is known about suppliers. What to do before an audit under Poland’s KSC Act: measure the time from patch publication to deployment for critical systems; practice recovery and record the result; compile a list of ICT providers with a risk assessment; establish an escalation path for vulnerabilities exploited within hours. We covered the refrigeration incidents ENISA refers to in our analysis of the attacks on refrigeration systems. More: Compliance and Audits.