Standfirst: The European Union Agency for Cybersecurity says artificial intelligence is accelerating both cyberattacks and defensive responses across Europe. Its latest threat assessment highlights growing risks from ransomware, phishing, geopolitical activity and weaknesses in connected infrastructure, while warning that Europe still lacks enough cybersecurity specialists.
Artificial intelligence is changing the pace of cyberattacks across Europe, with the time between a vulnerability being discovered and being exploited increasingly approaching zero, according to the latest assessment from the European Union Agency for Cybersecurity, known as ENISA.
The agency says AI is acting as a “force multiplier” for attackers and defenders. Criminal groups can use advanced systems to identify weaknesses at scale, create more convincing scams and improve malicious software, while organisations can deploy AI to detect vulnerabilities and accelerate patching.
AI is compressing the window for cybersecurity responses
ENISA Executive Director Juhan Lepassaar said the current threat picture remains serious, pointing to both advances in frontier AI models and recent attacks affecting connected refrigeration systems across the European Union.
The agency’s findings suggest that companies may soon have little or no time to respond after a software flaw becomes known. This creates a major challenge for organisations that rely on manual vulnerability assessments, lengthy approval processes or delayed software updates.
AI is being used by attackers to:
- Search for weaknesses across large numbers of systems;
- Improve the speed and scale of cyber reconnaissance;
- Produce convincing phishing emails, audio and video;
- Support ransomware and other malware operations;
- Feed misleading information into systems and disrupt business processes.
However, ENISA also stresses that the same technology can support cyber defence. AI tools can scan systems proactively, prioritise the most serious vulnerabilities and help security teams respond before criminals exploit them.
Ransomware and geopolitical activity remain major risks
ENISA’s assessment identifies geopolitically motivated activity as the largest share of reported cyber incidents in 2025. The report attributes 57.3% of incidents to ideological motives linked to geopolitical events, including Russia’s war against Ukraine and the conflict in the Middle East. Many of these operations had limited impact, but their volume remains a concern.
Financially motivated incidents accounted for 29.3% of those recorded. Ransomware continued to be the most damaging type of incident for businesses, while the easy exchange of malicious tools has helped create a more professional criminal ecosystem.
The agency also reports that attacks resembling state-backed campaigns have targeted European countries for cyberespionage, intelligence gathering and intellectual-property theft. Hacktivist groups generated the highest volume of reported attacks, although many were relatively low-impact distributed denial-of-service operations.
Connected infrastructure exposes overlooked weaknesses
Recent incidents involving refrigeration systems in supermarkets and blood banks across nine countries demonstrated how internet-connected equipment can become an entry point for disruption. The episode also highlighted a recurring problem: organisations may protect conventional IT systems while giving less attention to operational technology managed by maintenance or facilities teams.
That division can leave connected equipment operating with outdated software, separate budgets and different security priorities. ENISA’s warning is therefore relevant beyond banks, government departments and technology companies. Supermarkets, hospitals, logistics firms and other operators of essential services may also face serious exposure.
EU cybersecurity rules are expanding, but implementation is uneven
The European Union has introduced several measures intended to strengthen cyber resilience and improve coordination between member states. Their effectiveness depends heavily on national implementation and on whether organisations understand which systems and services should be treated as critical.
The main elements include:
- NIS2 Directive: The directive requires broader economic sectors to introduce stronger cybersecurity safeguards. Although it entered into application in October 2024, it had not been transposed into national law in every EU member state at the time covered by the report.
- Cyber Resilience Act: Adopted in 2024, the legislation establishes cybersecurity requirements for products with digital elements. It is scheduled to become fully applicable in December 2027 and includes reporting arrangements intended to improve information sharing.
- Cyber Solidarity Act: This framework strengthens the EU’s ability to detect, prepare for and respond to cyber incidents through measures including a European Cybersecurity Alert System, a Cybersecurity Emergency Mechanism and an EU Cybersecurity Reserve.
These are EU-level measures, but national authorities and private organisations remain responsible for much of the practical implementation. The gap between formal rules and day-to-day protection is one of the central issues raised by ENISA.
Europe faces a shortage of cybersecurity specialists
Regulation alone cannot protect networks if organisations lack the expertise to apply it. ENISA says employers across sectors are struggling to recruit and retain cybersecurity professionals, including specialists who understand both artificial intelligence and operational technology.
The report cites a 2025 NIS Investment study in which 45% of surveyed organisations reported difficulty finding people with the necessary cybersecurity skills. A shortage of experts could give larger and wealthier organisations an advantage, leaving smaller companies and public bodies more exposed.
ENISA is calling on EU member states to expand training, education and other European cybersecurity programmes. Building a stronger workforce will be important as AI makes both attacks and defensive monitoring faster.
What the ENISA warning means for Ireland
Ireland is covered by the wider EU cybersecurity framework, including the NIS2 Directive and the Cyber Resilience Act. The practical effect depends on national implementation, the organisations covered and the specific systems they operate.
Irish businesses and public bodies that rely on connected equipment should not limit cybersecurity planning to office networks or financial systems. The ENISA assessment points to the importance of updating operational technology, sharing threat information and ensuring that maintenance teams and security specialists work together.
For consumers, the report does not identify a single new obligation. Its broader message is that digital services and connected products need stronger protection as criminals gain access to more capable AI tools.
What happens next?
The immediate challenge is to reduce the time between identifying a vulnerability and fixing it. That will require faster information sharing, better coordination between national authorities and stronger investment in cybersecurity personnel.
EU rules provide a framework, but ENISA’s findings show that legislation must be matched by effective enforcement, modern equipment management and practical expertise. AI can help organisations defend themselves, but it also gives attackers greater speed, scale and precision.
The key takeaway is that Europe’s cyber risk is no longer defined only by the number of attacks. It is also defined by how quickly vulnerabilities can be turned into operational threats—and whether organisations can respond in time.