The European Union Agency for Cybersecurity (ENISA) has issued a stark warning: artificial intelligence is transforming the cyber threat landscape, industrialising attacks and compressing the time defenders have to respond. The report, released today, comes amid a wave of high-profile incidents across the continent, from government website takedowns to attacks on supermarket refrigeration systems.
“When we look at the threats landscape, the picture is not so rosy,” said ENISA Executive Director Juhan Lepassaar at a press conference. He pointed to recent events, including the PHP vulnerability that forced several EU governments to shut down their web portals, and the coordinated attacks on fridges in supermarkets and blood banks in France and eight other countries, which exploited outdated software.
The report describes AI as a “force multiplier” that expands the capabilities of both attackers and defenders. For hackers, it enables large-scale vulnerability scanning and more convincing phishing campaigns using deepfake audio, video, and messages. For companies, it offers the potential to proactively identify and patch weaknesses before they are exploited. But the race is tightening: “Data synthesised by researchers shows that the time between discovery and weaponisation is approaching zero,” the report states, meaning organisations may soon have virtually no window to protect themselves once a vulnerability is disclosed.
Geopolitics and profit drive the threat landscape
ENISA’s analysis of incidents in 2025 found that 57.3% were ideologically motivated, linked to geopolitical tensions such as Russia’s war in Ukraine and the Middle East conflict, though most had limited impact. Financially driven attacks accounted for 29.3%, with ransomware remaining the most damaging to businesses. The agency warns that the easy availability of ransomware kits is “fuelling a professional criminal ecosystem.”
State-sponsored actors are also active, conducting cyberespionage campaigns across European countries to steal intelligence and intellectual property. Hacktivists, meanwhile, dominate in sheer volume, mostly through low-impact distributed denial-of-service (DDoS) attacks.
The report highlights that AI is sharpening existing attack tools. For instance, attackers can use AI to craft highly personalised phishing lures, using deepfakes to impersonate executives or colleagues, and to “feed wrong data into systems to disrupt corporate operations.”
Europe’s response: rules exist, but gaps remain
The EU has built a dense regulatory framework to bolster cybersecurity, but ENISA argues implementation is lagging. The cornerstone, the NIS2 Directive, has been in application since October 2024, yet not all member states have transposed it into national law. The recent attacks on supermarket fridges in nine EU countries exposed weaknesses in how sectors define and protect critical infrastructure.
Cybersecurity experts note that many businesses, such as supermarkets, still view security through a traditional financial lens, leaving connected systems to maintenance teams with separate budgets and priorities. The supermarket freezer attacks illustrate this disconnect.
The Cyber Resilience Act, adopted in 2024 and fully applicable by December 2027, introduces mandatory reporting through a single portal to speed up information sharing. The Cyber Solidarity Act, in force since February 2025, established the European Cybersecurity Alert System, an Emergency Mechanism, and an EU Cybersecurity Reserve to improve detection and response.
But ENISA warns that even the best rules are useless without people to enforce them. The report cites a 2025 NIS Investment study showing that 45% of surveyed organisations struggle to hire professionals with the right cybersecurity skills. This talent shortage risks creating a divide, where wealthier companies can outbid others for a limited pool of experts.
As Europe faces an AI-driven cyber arms race, the agency urges faster coordination and investment in human capital. The message is clear: the continent’s defences are only as strong as its ability to adapt to a threat that is evolving at machine speed.
