SOC, XDR, and Threat Intelligence

ENISA Threat Landscape 2026: phishing, vulnerabilities, and vendor dependencies – AI enters new attack stages

The annual ENISA report covered 8,257 incidents from 2025 concerning the European Union. DDoS dominates in numbers, but financially motivated cybercrime still causes the most damage – and ENISA estimates that in 2026, AI will directly support more stages of the attack chain.

  • SourceENISA
  • Source PublicationSeptember 22, 2026
  • TypeThreats and Incidents

What happened

In September 2026, ENISA published the ENISA Threat Landscape 2026. For the first time, the analysis period coincides with the calendar year – from January 1 to December 31, 2025. Analysts collected and analyzed 8,257 incidents involving EU member states and organizations.

Key findings

  • DDoS accounts for 51.3% of incidents, and unauthorized access for 39.5%. Phishing remains the most common social engineering technique (77.8%), increasingly supported by ready-made kits and services. ENISA notes an increase in ClickFix techniques and smishing.
  • In cases of unauthorized access where the entry path was determined, 60.4% involved the exploitation of vulnerabilities (known and zero-day), and 20.7% were due to misconfiguration or accidental exposure.
  • Financially motivated incidents represent 29.3% of the total, but – especially ransomware – have the greatest impact in the short term. Ideological actions (mainly hacktivist DDoS) account for 57.3%, and state-sponsored espionage for 5.9%.
  • The most frequently attacked sector is public administration (31.8%), followed by business services (8.5%), transport (8%), manufacturing (6.9%), and finance (5.6%). Essential and important entities as defined by NIS2 account for approximately 73% of recorded incidents.
  • Attacks through dependencies are growing: digital service providers, repositories, browser extensions, and npm libraries (Shai-Hulud campaign). ENISA assesses that in 2026, AI will directly support more stages of the attack chain, with possible experiments conducted without human intervention.

Why it matters

SafeWave Commentary

The report confirms that in Europe, simple vectors still win most often: phishing, unpatched vulnerabilities, and misconfigurations. The pace and scale are changing – phishing services, automation, and AI mean these same techniques work faster and cheaper, and a single vendor becomes a gateway to many companies at once.

For organizations covered by NIS2 and Poland’s KSC Act, this is a practical list of priorities: phishing-resistant authentication, rapid patching of edge systems, cloud configuration reviews, and vendor risk management – including libraries and packages in the software development process. ENISA itself notes that low-impact DDoS dominates in numbers, so the percentage share is not a measure of actual damage.