What happened
ENISA, the EU Agency for Cybersecurity, released its 2026 state‑of‑cybersecurity report, noting a 300 percent increase in vulnerabilities detected over the past three months compared with the same period in 2025. The agency attributes the surge to artificial‑intelligence tools that can scan and identify flaws at scale, shifting vulnerability discovery from specialist researchers to automated processes. The report also highlights that public‑sector entities remain the most targeted, that DDoS attacks dominate incident types, and that ransomware and supply‑chain attacks pose the greatest business‑continuity risks. ENISA is partnering with the European Commission’s Joint Research Centre to build a secure AI‑testing platform aimed at speeding defensive responses.
ENISA’s 2026 report, produced with the European Commission and member‑state input, documents a 300 percent rise in vulnerabilities detected in the last quarter versus the same period a year earlier. The agency cites artificial‑intelligence tools as the primary driver, enabling industrial‑scale identification of flaws that previously required manual research.
The report paints a mixed picture: while the EU’s overall cyber‑resilience score improves to 71.53 out of 100, the public sector remains the most exposed, accounting for 31.8 percent of incidents. Ideologically motivated DDoS attacks dominate (51.3 percent of incidents), especially against public‑sector targets (81.8 percent of those DDoS events). Ransomware and supply‑chain attacks are flagged as the most damaging to business continuity.
ENISA highlights operational gaps, noting that 45 percent of IT service‑management firms take longer than three months to apply critical security updates, leaving downstream customers vulnerable. The agency also points to fragmented information‑sharing across member states as a barrier to a unified response.
In response, ENISA is collaborating with the European Commission’s Joint Research Centre to develop a secure platform for testing AI applications in cybersecurity. The goal is to accelerate defensive measures and create a shared, real‑time picture of emerging threats.
Source details: en.ilsole24ore.com
Why it matters
The rapid, AI‑driven rise in discovered vulnerabilities shortens the window for organisations to patch weaknesses before they can be weaponised, effectively compressing the defensive timeline to near‑zero. This shift raises systemic risk across Europe’s digital economy, especially for public‑sector bodies and critical‑infrastructure providers that already face the highest incident rates. By quantifying the scale of AI‑enabled flaw detection, the ENISA report underscores the need for new regulatory and operational measures—such as the upcoming Cyber Resilience Act and coordinated AI‑testing platforms—to ensure that defensive capabilities keep pace with the accelerating threat landscape. Without such interventions, the EU could see more frequent, higher‑impact cyber incidents that disrupt services, erode public trust, and impose substantial economic costs.
The AI‑enabled acceleration of vulnerability discovery compresses the time between flaw identification and potential exploitation, threatening to outpace traditional patch‑management cycles. This creates a systemic security gap that could be exploited by state‑backed or ideologically motivated actors, especially given the heightened geopolitical tensions cited in the report.
The public‑sector’s disproportionate exposure means essential services—healthcare, transport, and government operations—are at heightened risk of disruption, which could have cascading effects on the broader economy and public safety.
The report’s data supports the EU’s push for the Cyber Resilience Act, which will impose security‑by‑design obligations on digital products from 2027. Understanding the scale of AI‑driven vulnerability discovery helps policymakers calibrate the stringency and enforcement mechanisms needed to protect the digital market.
By establishing an AI‑testing platform, ENISA aims to create a shared defensive capability that can quickly validate AI tools for security use, fostering a coordinated European response and reducing reliance on fragmented national systems.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
A public chatbot and an internal agent with write access are being assessed. Why need separate threat models?
What to watch next
Watch for the rollout of ENISA’s AI‑testing platform, the finalisation of the Cyber Resilience Act in 2027, and any EU‑wide initiatives to share real‑time threat intelligence across member states. Monitoring how quickly public‑sector organisations can reduce patch‑deployment times will also indicate whether the EU can mitigate the heightened risk posed by AI‑accelerated vulnerability discovery.
Implementation timeline and scope of the Cyber Resilience Act, particularly how it mandates AI‑related security controls in product design.
Progress and accessibility of the ENISA‑JRC AI testing platform, including which organisations will be eligible to use it and how it integrates with existing incident‑response workflows.
Development of EU‑wide real‑time threat‑intelligence sharing mechanisms, especially any standards or protocols adopted to overcome regulatory and terminology differences.
Trends in patch‑deployment speeds among IT service‑management firms, as reductions would indicate improved resilience against the rapid exploitation enabled by AI.