The cyber threat landscape in ENISA's 2026 report: the loud attacks are not the costly ones

What the cyber threat landscape report actually counted#

The fox listens for the quiet step beneath the loud one, and reads every rustle in the hedgerow twice. That habit suits ENISA's Threat Landscape 2026, published on 22 September, because it reads like a report written by someone who has heard a great deal of noise and learned to ignore most of it. The EU agency's cyber threat landscape covers incidents from 1 January to 31 December 2025, drawn from open sources and from anonymised information shared by member states, as its press release explains.

The headline split is stark. In the full ENISA report, DDoS attacks make up 51.3 per cent of what was recorded and unauthorised access 39.5 per cent. Motive tells the same story of volume without weight: threats targeting or affecting the EU were ideology-driven in 57 per cent of incidents, while almost 30 per cent were financially motivated.

Now the sentence that matters most to anyone selling security. ENISA notes that representatives of EU organisations in high-criticality NIS sectors characterise DDoS as noise, while ransomware dominates their concerns. The finding rests on a survey published separately, ENISA's NIS Investments 2025, whose sample was mainly large enterprises (83 per cent) with a smaller share of SMEs (17 per cent). So it is a view from the big end of the market, and honest copy says so.

Two cautions keep the reading honest. First, a count of recorded incidents is a count of what was visible in open sources and shared by states, not a census of everything that happened. Second, ENISA itself calls ransomware the most impactful incident type in the short term, a reminder that frequency is not impact, and Digital Watch's summary notes the report's central message is the convergence and scaling of existing threats rather than anything brand new.

• 8,257

  incidents analysed for the 2025 window

• 51.3%

  of them DDoS attacks

• 39.5%

  unauthorised access

• 4,709

  hacktivist claims against EU states

• 73%

  of targeted organisations were NIS2 essential or important entities

Those last two figures deserve a moment. The press release counts 4,709 claims against EU member states, more than 89 per cent of them DDoS, which is why hacktivist attacks fill the headlines without filling the loss column. And because 73 per cent of targeted organisations are essential or important entities under NIS2, the people reading the report are exactly the regulated buyers a security vendor wants to reach.

Where the damage really sits: ransomware, flaws and suppliers#

If DDoS is the moth at the lantern, the harm hides in the undergrowth behind it. In this cyber threat landscape, ENISA lists ransomware as the most impactful incident type in the short term, and cybercrime overall covered 36 per cent of total events. Anyone tracking ransomware trends will notice that the report describes persistence, not novelty, with extortion, data theft and encryption layered on the same old routes in.

Those routes matter more than the labels. Across the unauthorised-access incidents where ENISA could identify an intrusion vector, which was only 5.2 per cent of them, 60.4 per cent were seen leveraging a vulnerability, and 20.7 per cent involved misconfiguration or accidental exposure. That is a small subset, so nobody should read it as 60 per cent of all break-ins. It still points one way, and 2025 also saw more than 48,000 new vulnerabilities published, 22 per cent more than the year before.

The independent evidence agrees. Verizon's 2026 Data Breach Investigations Report says nearly a third of breaches, 31 per cent, start with vulnerability exploitation, the first time in 19 years that it has passed stolen credentials as the biggest point of entry. Its sample is large: 31,000 incidents, more than 22,000 of them confirmed breaches.

The supplier is part of your attack surface#

ENISA's headline is dependency. The report says the targeting of cyber dependencies, including supply-chain and third-party attacks, continued to be observed, with several large-scale and impactful incidents. Verizon puts a number on it: third-party involvement in breaches reached 48 per cent, up from 30 per cent last year, a 60 per cent relative rise.

Read the two reports side by side and the pattern in the cyber threat landscape is plain. ENISA counts recorded events across the EU, Verizon counts confirmed breaches globally, and they measure different things. They agree only on direction: flaws left unpatched and suppliers left unwatched carry the cost, while volume attacks carry the headlines.

One flaw, two months: how a supplier bug becomes ransomware#

A single recent case shows how the damage curve unfolds across the cyber threat landscape. JetBrains disclosed a critical authentication bypass in TeamCity, a build server many software suppliers run, on 27 July. Its follow-up update says that since the announcement it had received reports of active exploitation, as well as attempted exploitation, against unpatched servers.

CISA listed the flaw, CVE-2026-63077, in its Known Exploited Vulnerabilities catalogue on 5 August. On Wednesday 23 September it updated the entry again, flagging the bug as abused by ransomware gangs, as BleepingComputer reported. Note the wording: this was an update to an existing entry, not a new addition, and CISA had not shared details of the attacks.

The two bars use CISA's own listing date and the date BleepingComputer reports for the ransomware flag, counted from JetBrains' 27 July announcement. The arithmetic makes the marketing point: a supplier flaw does not stay news for a week. It becomes a customer's incident report eight weeks later, down a trail the vendor could have marked, which is exactly the moment a buyer decides whether they trust the vendor who warned them.

For folkfox's earlier reading of how a vendor's own flaw reshapes its marketing, see the Check Point zero-day piece, and for the software supplier angle, the Brevo supply chain attack.

What a security brand should say when the buyer has read the report#

Regulated buyers who study the cyber threat landscape are not naive. They have read the agency report, they know the clocks, and they will test a vendor's claim against it. Under NIS2, an essential or important entity must submit an early warning within 24 hours of becoming aware of a significant incident, and an incident notification within 72 hours. Under the Cyber Resilience Act, manufacturers must submit an early warning within 24 hours of becoming aware and a full notification within 72 hours.

So a vendor's copy is judged against two questions. Does it describe the harm the buyer actually fears, and does it help them meet the clock they actually face? A page that boasts of blocking billions of attacks answers neither. A page that explains how a customer moves from a flaw in a supplier's software to a notified, contained incident within seventy-two hours answers both.

The second lesson deserves its own table, because cybersecurity statistics travel badly through a thicket of near-identical claims. The three most quoted datasets this month count different things, and a careless brochure that stitches them together will be caught by the first analyst who reads it.

• ENISA Threat Landscape 2026

  Recorded EU incidents, 2025

  Counts

  8,257 open-source and member state events

  Strength

  EU scope, sector split

  Best for

  • Regulated EU buyers
  • Threat-mix context

• Verizon DBIR 2026

  Confirmed breaches, global

  Counts

  31,000 incidents, 22,000+ breaches

  Strength

  Entry points, third parties

  Best for

  • Vulnerability and supplier claims

• FBI IC3 2025

  US victim complaints

  Counts

  1,008,597 complaints, $20.877bn

  Strength

  Reported losses

  Best for

  • Fraud and loss framing, US only

The FBI figure is a good example of a number that is easy to misuse. The 2025 IC3 report counts 1,008,597 complaints and $20.877 billion in losses, a 26 per cent rise on 2024. It is real, and it is self-reported American complaint data, so it says nothing about the EU incident mix and should never sit beside ENISA's count as if the two were one series.

How to write a threat page a buyer will cite#

A cyber threat landscape page is among the most linked assets a security brand owns, and among the most careless. Begin with a patient prowl through the report's method pages. The fox does not leave a scent it cannot defend. A page that a buyer, a journalist or an answer engine will quote needs self-contained sentences, sourced numbers and a stated method.

That post, from a Brussels-based account summarising the report, is a fair distillation of the damage curve. It also shows how a good sentence travels: short, attributed and self-contained. That is the register a threat page should aim for.

Start with the headline a buyer will search for, and answer it in the first forty words. Then give the number, the dataset and the year, and link the number to the regulator's own page. If the report is inconsistent with itself, as parts of ENISA's PDF are on the exact financial-motive share, say almost 30 per cent and move on. Precision you cannot defend is worse than a rounded truth, and a cyber threat landscape summary should never outrun its source.

For teams that want this rhythm built rather than described, folkfox's cybersecurity marketing work pairs regulator-grade sourcing with content marketing that reads like evidence, and SEO and GEO that keeps a threat page findable when a buyer asks a question of an answer engine. The Cyber Resilience Act reporting clock piece shows the same discipline applied to a single deadline.

One more caution for any cyber threat landscape brief. ENISA's report covers 2025, not the present month, and cybersecurity statistics age quickly. Date every figure in the prose, not only in a footnote, and re-check it whenever the next report lands. A page that says what was measured and when will outlive one that claims to describe now.

Frequently asked questions#