Luxembourg, 21 September 2026
- €1.4 billion from the 2021-2027 EU budget allocated to cybersecurity
- EU networks enable member state cooperation, but limited information-sharing reduces their added value
- European Cybersecurity Alert System not yet operational
EU measures suffer from shortcomings when it comes to detecting and responding to significant and large-scale cybersecurity incidents, according to a new report by the European Court of Auditors (ECA). The EU auditors call for improvements in how information is shared, for better coordination to avoid duplication of work among the various bodies involved, for the European Cybersecurity Alert System to be up and running, and for stronger security checks of beneficiaries of EU funding.
Cybersecurity incidents can disrupt public services, businesses, critical infrastructure, and the EU’s internal market. Although responsibility for responding to these incidents lies mainly with the member states, the EU also plays an important role. This is the case particularly when such incidents cause major disruption, significant financial losses, or substantial harm to people or organisations (significant cybersecurity incidents), or when they affect several member states and go beyond the capacity of a single country to respond effectively (large-scale cybersecurity incidents).
To tackle these threats, the EU has increasingly been investing in strengthening cybersecurity. Under the 2021-2027 EU budget, the Digital Europe Programme is the main source of cybersecurity funding, with €1.4 billion allocated.
“The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should,” said George-Marius Hyzler, the ECA Member in charge of the audit. “When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value.”
In the auditors’ view, the Achilles heel of the entire system is the insufficient exchange of information. The Cyber Blueprint, which was adopted in 2025, largely clarifies roles and responsibilities by setting out how the EU should manage major cybersecurity crises. However, the way the two EU cyber networks work together has still not been formally defined. This hampers the cooperation of the CSIRTs network, which brings together national teams dealing with cyber incidents, and EU-CyCLONe, an EU network for cyber crisis cooperation.
In addition, some countries are still implementing the EU’s updated cybersecurity rules (such as the NIS 2 Directive), while national security laws restrict what information can be shared. This means that EU networks may struggle to detect threats early and coordinate an effective response.
The auditors also found overlap between some EU bodies responsible for monitoring cybersecurity threats. The European Commission’s cyber situation centre was set up in 2022, and is largely supported by external providers. The work they do for the centre partly duplicates the European Union Agency for Cybersecurity (ENISA)’s existing capacity in monitoring threats and building situational awareness.
At the time of the audit, the European Cybersecurity Alert System was not yet operational. The two hubs examined by the auditors – ATHENA and ENSOC – had not started operations because of procurement delays. In addition, the necessary cooperation agreements, a common classification system, and technical standards needed for the system to work were still lacking.
The auditors also identified weaknesses in the way some organisations in receipt of EU cybersecurity funding were checked. These checks are intended to mitigate the risk of intrusion or influence by non-EU states, and to prevent sensitive security information from being shared with non-EU authorities. However, although grant beneficiaries are responsible for assessing the ownership and control of third parties in receipt of financial support, the European Cybersecurity Competence Centre does not verify these assessments. As a result, sensitive infrastructure, operational data, and security-critical technologies could be exposed to security risks.
Background information
The EU cybersecurity landscape involves numerous public and private bodies at regional, national and EU level. Cybersecurity is also a key element of national security and defence.
The audit assessed whether EU actions effectively facilitate the detection of and response to significant and large-scale cybersecurity incidents. It covered the period from 2022 to 2025, and included audit missions to Ireland, Greece and Italy.
Related links
- Special report 19/2026: Detecting and responding to cybersecurity incidents – EU cooperation framework progressing, but only partially effective due to implementation delays and limited information sharing
- Key facts and findings
Source – ECA