2024 report on the state of cybersecurity in the Union

This document marks the first report on the state of cybersecurity in the Union, adopted by ENISA in cooperation with the NIS Cooperation Group and the European Commission, in accordance with Article 18 of the Directive (EU) 2022/2555 (hereinafter NIS2). The report aims at providing policy makers at EU level with an evidence-based overview of the state of play of the cybersecurity landscape and capabilities at the EU, national and societal levels, as well as with policy recommendations to address identified shortcomings and increase the level of cybersecurity across the Union. The drafting of this report precedes the transposition date of NIS2. As a result, some of the data presented here may not fully reflect cybersecurity capabilities following the transposition deadline of 17 October 2024. Still, this report includes several data points unlikely to change in the short- and mid-term and serves as a snapshot of the state of cybersecurity in the Union just before NIS2 is fully implemented by EU Member States (MSs). The recent past has been characterised by horizontal policy initiatives including but not limited to NIS2, CRA, CSOA and EUDIF that improve the EU cybersecurity policy framework and establish all necessary structures and processes to allow for targeted improvements at the Union level of cybersecurity moving forward. Sectorial policy initiatives (e.g. DORA, NCCS, Aviation) were adopted in parallel to address specific sectorial challenges. At the same time the volatile geopolitical landscape has influenced the goals and tactics employed by state and non-state threat actors, while an assessment of the threat landscape reveals an increase in cybersecurity incidents in the EU with ransomware and DDoS attacks getting the lion's share among the various types of attack observed. This report concludes that the maturity of the EU cybersecurity policy framework has reached a considerable level and that the following period could place emphasis on supporting private and public sector entities with the implementation of the legislation by EU MSs, with the support of the European Commission and ENISA. The plethora of mechanisms, processes and platforms for collaboration established within this framework, such as the NIS Cooperation Group, EU-CyCLONe and the CSIRTs Network to name but a few, provide a solid basis and a comprehensive toolbox to address the shortcomings identified in key policy areas, namely Policy Implementation, Cyber Crisis Management Skills and Supply Chains.