Europe’s Cyber Defence Only Partly Effective – Special Report

Set Trending Topics as a preferred source on Google.

The EU has built a dense web of cybersecurity structures over the past years: a network for computer emergency response teams, a crisis management network, a cybersecurity reserve, a Europe-wide alert system. The European Court of Auditors recently examined what this architecture delivers when an attack actually hits. Its verdict in Special Report 19/2026: the cooperation framework is making progress, yet it only partly facilitates the detection of serious cyber incidents and the response to them. The auditors attribute this mainly to limited information sharing between member states, gaps in reporting, and significant delays in implementation.

The audit covers the period from 2022 to 2025 and draws on document analysis, audit visits to Ireland, Greece and Italy, and interviews with authorities and project participants.

Few Incidents Reported, Almost None Across Borders

The clearest finding concerns reporting practice. Between 2018 and 2021, member states reported between 100 and 500 incidents a year to the EU cybersecurity agency ENISA, rising to 1,276 in 2024. Over a comparable window, ENISA identified around 4,800 cybersecurity incidents for its threat landscape report using open sources alone, such as news articles. The gap cannot be resolved precisely, because the data submitted by member states is anonymised. The auditors nonetheless read it as strong evidence that a substantial share of significant incidents goes unreported.

The picture is thinner still for cross-border attacks. In 2025, seven member states reported a combined 14 significant cross-border incidents. There were two in 2024, none in 2023 and three in 2022. For context, ENISA counted 322 incidents in 2024 alone that specifically targeted two or more member states.

And since 2016, no member state has ever classified a cyber incident as “large-scale”. As a result, the escalation procedure of the EU crisis network EU-CyCLONe has never been fully triggered.

The Collins Aerospace Case as a Lesson

The auditors illustrate how this plays out with the ransomware attack on Collins Aerospace’s passenger processing software last year. Several major European airports had to revert to manual check-in, with London Heathrow, Brussels, Berlin Brandenburg and Dublin hit hardest. Numerous delays and cancellations followed.

Formally, no member state treated the incident as a significant cross-border security incident. Neither ENISA nor other member states were officially notified, and the CSIRTs network also left EU-CyCLONe in the dark. Coordinated European incident management therefore never happened.

The report names several causes. A common taxonomy is missing for when an incident counts as significant or large-scale. The authorities involved often cannot tell whether an attack has a cross-border dimension. And there is no EU-wide platform where reports converge in real time and can be correlated across sectors or technical indicators of compromise.

NIS2 as the Bottleneck

One structural reason for the thin data lies in the delayed transposition of the NIS2 directive. The deadline for moving it into national law expired in autumn 2024, and according to the auditors two member states met it. As long as transposition is pending, the companies and entities covered carry no legal obligation to report. The jump in scope is considerable: the Commission estimated that around 15,500 entities fell under the old NIS directive, while more than 110,000 fall within the scope of NIS2. Public administration, which ENISA identifies as the most heavily affected sector in the EU, sat entirely outside the reporting duty under the old rules. Austria moved its own transposition forward this year.

Legal limits compound the problem. If a member state classifies information about attacks on critical entities as restricted, it is under no obligation to share it. An EU-wide analysis of how strongly national security legislation constrains that exchange has yet to be carried out. The auditors recommend exactly that.

Alert System Still Not Operational

The European Cybersecurity Alert System, created by the Cyber Solidarity Act, is meant to improve threat detection by having smaller groups of member states work closely together in cross-border cyber hubs. Two such hubs exist: ATHENA, with Bulgaria, Greece, Cyprus and Malta, and ENSOC, with Spain, Italy, Luxembourg, the Netherlands, Austria, Portugal and Romania. A third hub received funding this year, bringing the network to 20 countries.

At the time of the audit, neither existing hub was operational. The two-stage procurement procedures for the necessary detection tools dragged on, and 18 months after they started, no contract had been signed for a single lot. The grant agreements were extended by 15 and 18 months respectively. Without tools, hub activities stalled and the alert system remains non-functional. Cooperation arrangements, a common taxonomy and interoperability standards are also still missing, even as the cross-border hubs add further layers of communication to an already complex landscape.

Reserve Tends to Be Used for Preparedness

The EU Cybersecurity Reserve is funded with 36 million euros for 2025 to 2027 and is designed to support member states in responding to serious incidents and recovering from them. ENISA signs pre-commitment contracts with private providers, which enables rapid deployment. The auditors rate this mechanism positively in principle.

They raise two caveats. First, funds are divided evenly among member states without regard to their individual needs: if one country does not call off its reserved services, they cannot be redirected to another. Second, experience from the predecessor programme shows that member states prefer to channel the money into preparedness. In 2023, 84 percent of spending went to preparedness, and for the 2024 to 2026 period only nine member states requested on-call response services. The report therefore flags a risk that the reserve ends up serving preparedness rather than the response purpose it was created for.

Duplication at the Cyber Situation Centre

The auditors are also critical of the Cyber Situation Centre set up in 2022 within the Directorate-General for Communications Networks. A contract worth almost 18 million euros over four years was awarded to external service providers to run it. The situational awareness and threat monitoring work delivered there partly overlaps with what ENISA already does on a permanent basis, the audit found. The potential for streamlining was insufficiently exploited when the centre was established. The contract expires at the end of 2026, and at the time of the audit there was no comprehensive plan for what comes after.

Funding Programme With Weak Controls

Cybersecurity in the current financial framework is funded mainly through the Digital Europe Programme, which totals 8.1 billion euros, of which 1.4 billion is earmarked for cybersecurity. The auditors examined eleven projects. All pursue relevant objectives, and some deliver tangible results, among them a security operations centre for Greek SMEs and an Irish funding scheme that provided more than 50 small companies with roughly 1.8 million euros for cybersecurity measures. Of the projects that could be assessed, four were rated satisfactory, two showed weaknesses and three fell short.

A security-sensitive point concerns ownership verification. Cybersecurity funding can be restricted to legal entities established in the EU and controlled by member states or EU nationals. Between 2022 and 2025, 7 percent of all applicants for Digital Europe cybersecurity grants, or their subcontractors, failed that assessment. Where money is passed on as financial support to third parties, however, the project beneficiaries carry out the checks themselves, using their own methodology. The European Cybersecurity Competence Centre neither validates that methodology nor runs spot checks. The auditors see a significant risk here, one that could expose sensitive infrastructure, operational data and security-critical technologies.

Finally, the report attributes fundamental weaknesses to the performance framework. Milestones and indicators are frequently unmeasurable or defined without target values, and one project works with 52 indicators. Of seven projects required to file a mid-term report, three reported on the programme indicators, two of them incorrectly. The Commission’s programme performance statements present the cybersecurity indicators as on track. The auditors could not reconstruct how those figures were calculated and consider the reported data uninformative.

Five Recommendations

The Court puts forward five recommendations. The Commission, supported by ENISA, should have an analysis carried out of which national security provisions are slowing information sharing, and develop solutions for real-time incident reporting to ENISA. The situational awareness capacities of the Commission and ENISA should be consolidated. The European Cybersecurity Alert System needs cooperation arrangements and interoperability standards. The Competence Centre should secure ownership assessments for funds passed on to third parties and overhaul the programme’s performance monitoring framework. Target dates range from 2026 to 2028.