ENISA Threat Landscape 2026: ransomware most impactful in the short term, dependencies widen risk

The European Union Agency for Cybersecurity, ENISA, published the ENISA Threat Landscape 2026 report on 22 September 2026. According to the agency's announcement, the report covers incidents observed between 1 January and 31 December 2025 and argues that growing reliance on connected digital services widens the attack surface, so organisations need to be more watchful.

• Low-impact DDoS attacks made up 51 percent of recorded cases; more than 89 percent of 4,709 hacktivist claims against EU Member States involved DDoS.
• Ransomware stood out as the most impactful incident type in the short term; ransomware deployment made up 40 percent of the cybercrime events analysed.
• Among unauthorised access incidents whose intrusion vector could be identified (5 percent of such incidents), 60 percent involved a vulnerability; more than 48,000 new CVEs were published in 2025, up 22 percent on the previous year.
• Public administration was the most targeted sector at 32 percent, followed by business services and transport at 8 percent each, manufacturing at 7 percent and finance at 6 percent.

Why it matters

According to ENISA, attacks that come through suppliers and third parties tend to end in large-scale or high-impact incidents. Essential and important entities under NIS2 made up 73 percent of targeted organisations. Turkish companies that supply software, components or services to businesses in the EU can be seen as links in that chain, so reviewing their vulnerability management and access controls could be worthwhile.

The report also says social engineering is still widely used to exploit trust, with phishing kits backing a growing share of phishing campaigns, and that attackers are turning to the ClickFix technique more often. ENISA expects new AI models to play a growing role in malicious operations, and adds that AI systems built into business environments also widen the attack surface.