Security / Regulation / AI Governance
ENISA's 2026 State of Cybersecurity report puts EU cyber maturity index at 71.53 out of 100
The biennial NIS2 report finds an improved but uneven EU posture, reports compliance as the main driver of security investment and warns AI can widen gaps between sectors.
ENISA has published the 2026 edition of its biennial Report on the State of Cybersecurity in the Union, required under Article 18 of the NIS2 Directive and prepared with the European Commission and the NIS Cooperation Group. It judges the threat level to the EU as substantial, while overall posture has improved.
The EU Cybersecurity Index averaged 71.53 points out of 100. Supply chain management for essential and important entities scored 89.91. CSIRT maturity (54.76) is described as established but uneven, national certification ecosystems (55.56) as split, and primary and secondary education (55.44) as an area to improve. National coordinated vulnerability disclosure policies rose from 7 to 17 countries since 2024.
The report sets out five directions with policy recommendations, including smoother cross-border and cross-legislative implementation, stronger crisis cooperation, and developing sector maturity according to criticality with resilience strategies for AI-enabled threats. Regulatory compliance was reported as the main driver of cybersecurity investment across critical sectors’ organisations (70%).
Why it matters
With compliance reported as the main investment driver, security and governance teams in NIS2-covered entities should expect continued emphasis on supply chain risk and vulnerability handling, which ENISA says AI has industrialised. Organisations operating in several Member States should review how NIS2, the Cyber Resilience Act and the Cyber Solidarity Act apply to them, as ENISA names cross-border and cross-legislative implementation as a key direction. AI governance leads should treat AI-accelerated vulnerability discovery as an input to model and tool risk assessments.
Status: Published. Biennial report mandated by Article 18 of NIS2
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- CISO
- Legal & compliance
- AI governance lead
- CDO