Europe’s cybersecurity landscape is becoming more regulated, but it is not becoming less complex.
The expansion of EU cybersecurity legislation, including NIS2 and the Cyber Resilience Act (CRA), is changing what is expected from organisations, manufacturers and public authorities. At the same time, the threat environment they are expected to manage continues to evolve. Several findings from ENISA’s latest threat landscape illustrate the scale of that challenge.
Critical organisations remain firmly in the line of fire
One of the most significant findings is that essential and important entities represent 73% of the total number of recorded events in ENISA’s analysis.
The figure is important because it illustrates the threat exposure of many of the organisations that fall within the scope of NIS2.
Legislation establishes obligations. Organisations still have to translate those obligations into processes, controls and everyday cybersecurity decisions. That means understanding which requirements apply, assessing current compliance, identifying gaps and deciding what actions should be prioritised.
This practical implementation challenge is one of the areas DETANGLE is designed to address with its planned NIS2 Compliance Tracker Component featuring capabilities focusing on automating gap analysis, tracking compliance at an organization level and effectively reporting detected incidents. Â These capabilities will be tested within the scope of DETANGLE by critical organizations operating in the healthcare and energy domains.
More vulnerabilities also mean harder decisions
Another number provides a different perspective on the same problem.
More than 48,000 new vulnerabilities were published in 2025 with assigned CVE identifiers, representing an increase of 22% compared with the previous year.
For cybersecurity teams, more information does not necessarily make decision-making easier. They have to determine which vulnerabilities are relevant to their systems, understand the potential impact, prioritise remediation and consider how technical vulnerabilities relate to their broader cybersecurity and compliance obligations.
ENISA also observes continued convergence in the operational practices of different threat actors and assesses that the same vulnerabilities, platforms and toolsets are likely to be exploited regardless of motivation. The same weaknesses can therefore become relevant across multiple types of attack.
This reinforces the need to connect vulnerability information with compliance, certification, incident management and actionable cybersecurity knowledge rather than addressing each area in isolation.
DETANGLE’s planned architecture follows this interconnected approach. Its services combine compliance support with incident management, certification assistance and exchange of knowledge resources and threat-intelligence in an effective and compliant manner.
Response is not enough if organisations remain exposed
ENISA also identified 33 EU organisations as targets of repeat victimisation, with the incidents involving ransomware (44%) and data breaches (40%).
ENISA assesses that some of these activities were likely operationally linked and that repeated targeting was enabled by a lack of restoration practices following incident response. This highlights an important distinction between responding to an incident and building resilience from it.
Containment is essential, but organisations also need to understand what happened, address the underlying weakness and use what they learned to improve their future response.
There is also value beyond the affected organisation. Information about vulnerabilities, attack patterns and incidents can help other organisations prepare. Provided it can be shared securely and in a useful form.
DETANGLE’s planned services include incident management and reporting, post-incident analytics that generate reports for situational awareness and compliance insights, and collaborative threat-intelligence mechanisms. Furthermore, simulation tools are also planned to allow stakeholders to test preparedness against scenarios such as ransomware and supply-chain breaches.
Cybersecurity is increasingly a collective challenge
Finally, ENISA’s analysis demonstrates the diversity of actors operating against European targets. Among its findings, the agency identified 52 distinct State-nexus intrusion sets active in the EU during the reporting period, alongside cybercrime and extensive ideology-driven activity.
No individual organisation operates outside this wider environment. And when infrastructure, supply chains and digital services extend across countries, cybersecurity incidents and vulnerabilities can have consequences far beyond the organisation where they were first identified.
This makes trustworthy information sharing and cross-border cooperation increasingly important.
DETANGLE aims to address this need by creating an interoperability and security layer for collaboration between organisations and Member States. To this end, the project’s planned EU-Wide Cybersecurity Collaboration Hub will support the sharing of knowledge resources and threat-intelligence sharing while at the same time empower the conduction of crisis simulations in a collaborative manner
The common thread: implementation
These findings concern different parts of cybersecurity, but there is a common thread running through them.
- Knowing that a requirement exists is different from implementing it.
- Knowing that a vulnerability exists is different from managing it.
- Responding to an incident is different from adapting to it.
- Having information is different from being able to act on it and share it effectively
This is the space in which DETANGLE is working.
The project aims to bring together compliance, certification support, incident management, trustworthy information sharing and cross-border collaboration within a more unified cybersecurity framework. To this end, it focuses on the development and validation of capabilities that can support organisations and authorities in the implementation of compliance requirements in a manner that directly improves their cybersecurity posture.