“They could also hit household appliances and routers”: the EU agency’s warning on cyberattacks

Lepassaar declined to comment directly on France’s attribution that Iran was behind the wave of refrigerator attacks in October, but said that Chinese, Iranian, North Korean and Russian “state-aligned actors” are known to target Europe. “Safety should not and cannot be an afterthought. Today it was refrigerators, tomorrow it could be routers, the day after tomorrow it could be appliances, and so on“he said during an interview in Brussels.

The threat assessment at community level confirms that the level of cyber risk for the EU remains high. Although the Union’s cybersecurity preparedness has improved, the entire ecosystem is going through a phase of profound change. This is what we read in the EU Cybersecurity Index developed by Enisa, the EU Cybersecurity Agency.

The point on cybersecurity in the EU

Enisa assessed the level of maturity of cybersecurity capabilities and resources in Member States. The overall average score of the EU Index for 2026 stands at 71.53 points on a scale from 0 to 100. The majority of Member States have reached a mature or higher posture level, proceeding in line with the objective of ensuring a high and shared standard of cybersecurity across the Union. In the meantime, however, the ecosystem that those same countries have to face is changing, enhanced by AI. Intrusion activities remained intense and diverse in 2025 and 2026, amid an increasingly complex threat landscape, the report said.

Ideology remains the primary driver of cyber incidents, geopolitical tensions continue to shape hostile operations, for-profit activities maintain a significant impact, and hacktivists continue to dominate overall attack volumes. At the same time, AI acts as a multiplier of both offensive and defensive capabilities, while the evolution of AI models is accelerating the identification and exploitation of vulnerabilities, we read in the Enisa report.

Enisa executive director Juhan Lepassaar said that “challenges persist and recent developments – not only in border AI models, but also in cyber incidents affecting refrigeration systems across the EU – highlight operational gaps and the need for coordination and timely information sharing. It is crucial to consolidate common situational awareness and increase policy alignment in critical sectors. Progress has been made, but we must now build on this foundation to update our strategies and address an increasingly complex cybersecurity scenario”.

The majority of member states have reached a mature or advanced level of posture in implementing policies at the national level (66.72 points), the report reads. Almost all Member States declare that they have achieved an advanced level in the management of the supply chains of their essential and important subjects (89.91 points), while the maturity of the Computer security incident response teams (Csirt) is consolidated (54.76 points), although there remain differences between Member States. The integration of cybersecurity into education pathways, particularly at primary and secondary levels, has further room for improvement (73.59 points in higher education, 55.44 points in primary and secondary education). National certification ecosystems appear divided between mature and less mature contexts, with Member States distributed at the extremes of the evaluation scale (55.56 points). The majority of Member States have achieved an advanced posture in terms of Research and Development (R&D) priorities and initiatives in the cybersecurity field (79.24 points), highlighting a growing coherence in the Research and Innovation landscape.

The key lines for the future

The Report traces five key directions for the future of the Unionon the basis of which the policy recommendations were developed: focus on the harmonization of cross-border and inter-regulatory aspects, so that entities operating in multiple Member States can count on a coherent, functional and integrated context; adopt an integrated operational capacity in case of crisis; strengthen the preparedness and resilience of critical infrastructures although the report shows cybersecurity maturity in critical sectors showing constant improvement, but progress remains uneven and sector operational realities are not uniform and AI risks amplifying the risk exposure gap.

Furthermore, risks linked to supply chains and cross-border dependencies are taking on growing importance, with implications that go well beyond the purely technical dimension. Since 2024, most Member States have made progress in the maturity of vulnerability disclosure policies, and the number of countries with a national Coordinated Vulnerability Disclosure (CVD) policy has risen from 7 to 17. AI has had a profound impact on the management of vulnerabilities, industrializing their identification and requiring a strengthening of response capabilities. Enisa recalls that the Global cybersecurity outlook 2025 of the World Economic Forum highlights a widening of the skill gap in the cyber sector, which has grown by 8% compared to 2024.

In this context, the EU cybersecurity policy landscape is characterized by converging trends. The Union as a whole is progressing in the implementation of the main sector regulations, in particular the Nis2 Directive, the Cyber ​​resilience act and the Cyber ​​solidarity act. Nonetheless, cross-border dynamics and intersections between different regulatory frameworks are taking on ever greater weight, pushing towards legislative simplification and recalibration efforts. At the same time, we observe how the geopolitical framework and technological developments have triggered the launch or update of various initiatives, including the proposal for the Cybersecurity Act 2 and the recent EU Action Plan on Cybersecurity and AI.