ENISA’s 2026 State of Cybersecurity in the Union report says EU defences have improved, but the agency still rates the threat level as substantial, and implementation of NIS2 remains patchy. For UK organisations with European customers, subsidiaries or supply chains, the report is a useful preview of where regulators on both sides of the Channel will look next.
What happened
On 10 November 2026 the European Union Agency for Cybersecurity (ENISA) published its 2026 Report on the State of Cybersecurity in the Union. The report comes out every two years and is required by Article 18 of the NIS2 Directive. It is adopted in cooperation with the Commission and the NIS Cooperation Group, is aimed primarily at the European Parliament, and covers July 2024 to July 2026.
The headline number is a new EU Cybersecurity Index score of 71.53 out of 100, averaged across member states. Most countries now rate as mature or better, though a changed methodology means no direct comparison with 2024. Its overall verdict is “cautious confidence”. Defences have improved, but the threat level is unchanged at substantial, and the agency points to frontier AI models and this autumn’s attacks on supermarket refrigeration systems across Europe as signs of operational gaps. Executive Director Juhan Lepassaar said that “common situational awareness must be strengthened”.
The report also confirms an uncomfortable fact: two years after the 17 October 2024 transposition deadline, not every member state has written NIS2 into national law.
The detail
The index hides a lot of variation. Member states score well on how essential and important entities manage their supply chains (89.91) and on cyber research and development (79.24). National policy implementation sits at 66.72 and supervision at 68.33. National incident response teams (CSIRTs) average only 54.76, and their maturity varies widely between countries. National certification ecosystems (55.56) and cyber education in primary and secondary schools (55.44) are also weak.
The organisation-level survey data is more telling. ENISA draws on its 2025 NIS Investments study, which found that 70% of organisations named regulatory compliance as the main reason for their security spending. Asked which NIS2 duties were hardest, half pointed to patching and vulnerability handling, 49% to continuity and recovery, and 37% to supply-chain risk. Supply-chain attacks were the second most-cited concern (47%), behind ransomware (55%). Outside banking, more than a third of organisations said they felt predominantly unprepared for supply-chain risks.
The weakest results came from ICT service management providers, the businesses that run systems for other people. According to ENISA, 43% of those surveyed ran no cybersecurity assessment during 2024, and 45% needed over a quarter to deploy critical fixes on their most important systems. As Help Net Security notes, attackers can now weaponise freshly published flaws in days, and sometimes in hours.
On the positive side, member states with a national coordinated vulnerability disclosure policy rose from seven in 2024 to 17 in 2026.
The report sets out five policy directions:
- effective implementation, with smoother cross-border and cross-legislative rules
- a full operational capacity for crises
- critical infrastructure resilience
- managing supply-chain and cross-border dependencies
- long-term skills and awareness
The recommendations include a common incident reporting template, with the NIS2 template as the baseline, and using NIS2, the Cyber Resilience Act and the AI Act together to deal with risks from the most advanced AI models.
Why it matters for UK organisations
NIS2 does not apply to the UK as a country, but it does apply to many UK businesses. A UK managed service provider, cloud host or data centre operator with EU customers or an EU establishment may already be inside one or more member states’ NIS2 regimes. When ENISA says supply-chain risk management is the requirement organisations struggle with most, that means more supplier questionnaires, more audit clauses and more evidence requests arriving at UK suppliers.
The timing matters at home too. The UK’s Cyber Security and Resilience Bill finished its Lords stages on 2 November and is back in the Commons for MPs to consider the Lords amendments. It brings managed service providers, data centres and designated critical suppliers into the UK regime for the first time. It would also introduce a 24-hour initial incident notification followed by a full report within 72 hours. UK regulators may well draw on ENISA’s findings when deciding where to concentrate supervision, and the EU’s weakest group, ICT service management providers, matches the group the UK is about to bring into scope.
Reporting overlap matters too. A UK group regulated in several EU countries, and soon at home, could face several incident clocks and templates for one event. ENISA’s single-template idea would help, but it is only a recommendation.
Expert view
The most useful part of this report is not the 71.53. It is the finding about providers that look after everyone else’s systems. In my experience, when we test managed service providers, the security of the remote management platform is usually far behind what the provider promises its customers. Critical patches waiting in a change queue for a quarter are common. Every one of those customers inherits that risk, whether or not they know it.
The figure on compliance as the driver of spending should also give boards pause. Regulation is a fine way to win budget, but patching, recovery and supplier assurance are the areas organisations themselves rate hardest, and they are where attackers find a way in. A certificate on the wall does not shorten a 90-day patch cycle.
Nor would I over-read the national scores. Weak response teams and supervisors still mapping who is in scope mean today’s light enforcement will not last.
What to do now
- Work out your EU exposure. List where you have EU establishments or provide services in sectors covered by NIS2, and check which national transposition applies. Do the same against the scope of the Cyber Security and Resilience Bill, especially if you are a managed service provider.
- Measure patch latency, not policy. Track the time from release to deployment for critical fixes on internet-facing and management systems. This is the heart of the Cyber Essentials security update management control, which expects high-risk and critical updates within 14 days.
- Tighten supplier assurance. Ask key providers for evidence of patching times and their most recent independent assessment, not just policy statements. Put those expectations in your contracts.
- Prepare for several reporting clocks. Build one incident playbook that maps NIS2, DORA, UK GDPR and the forthcoming UK 24-hour and 72-hour deadlines, with named decision-makers.
- Lock down remote administration. Apply MFA, privileged access controls and secure configuration to RMM and admin tooling. This maps to the Cyber Essentials user access control and secure configuration controls.
- Test recovery. Continuity was the second-hardest NIS2 area. Run an exercise that assumes a key supplier is unavailable.
Bottom line
ENISA’s report shows Europe making real but uneven progress, with service providers and supply chains as the weakest links. For UK firms, regulatory pressure is building on both sides of the Channel, and much of it will reach them through their supply chains. Organisations that can show evidence of short patch cycles, tested recovery and real supplier assurance will be in a good position under both regimes.
Sources
- ENISA: ENISA reveals the State of Cybersecurity in the Union
- ENISA: 2026 Report on the State of Cybersecurity in the Union (PDF)
- Eunews: European cybersecurity is improving, but gaps remain in coordination and crisis management
- Help Net Security: EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch
- IEU Monitoring: ENISA warns of persistent cyber threats despite improving EU resilience
- Precursor Security: Cyber Security and Resilience Bill clears the Lords
