EU Auditors Warn Information-Sharing Gaps Are Hindering Cyber Incident Response
EU auditors criticize the bloc's cybersecurity strategy for critical information-sharing gaps hindering incident response.
The EU Court of Auditors issued a report criticizing the bloc's €1.4bn cybersecurity budget for suffering from insufficient information exchange, which hinders detection and response to large-scale cyber incidents. The report highlights a lack of formally defined roles between national CSIRTs and EU-CyCLONe, slow NIS2 transposition into national law, and restrictions from national security laws. It also identified duplication of effort between the European Commission's cyber-situation centre and ENISA, and noted that the European Cybersecurity Alert System's two hubs remain non-operational due to procurement delays and a lack of necessary cooperation agreements and technical standards.
- EU Court of Auditors criticizes insufficient information exchange hindering cyber incident response.
- Slow NIS2 transposition and national security laws restrict information sharing between CSIRTs and EU-CyCLONe.
- Duplication of effort found between Commission's cyber-situation centre and ENISA.
- European Cybersecurity Alert System hubs delayed due to procurement and missing cooperation agreements.
Full article445 words · extracted from infosecurity-magazine.com · click to collapse
The EU’s top audit institution has criticized the union for various “shortcomings” that are hindering its detection and response to large-scale cyber incidents.
The EU Court of Auditors said in a new report that the bloc’s €1.4bn ($1.6bn) budget for cybersecurity is doing some good, but that it suffers from an Achilles heel, “The insufficient exchange of information.”
A lack of formally defined roles is hampering cooperation between country-level CSIRTs and European Cyber Crisis Liaison Organisation Network (EU-CyCLONe), it warned.
The slow transposition of NIS2 into national law is also having a negative impact, while national security laws restrict what information can be shared.
Read more on EU cybersecurity: ENISA to Coordinate €36m EU-Wide Incident Response Scheme
The auditors also found duplication of effort between the European Commission’s cyber-situation centre – founded in 2022 and supported by external providers – and the work done by EU security agency Enisa in monitoring threats and building situational awareness.
The report criticized delays to the European Cybersecurity Alert System; with two hubs (ATHENA and ENSOC) having still not begun operations due to procurement delays.
“In addition, the necessary cooperation agreements, a common classification system, and technical standards needed for the system to work were still lacking,” it said.
The audit also warned that, at the time of inspection, organizations receiving EU cybersecurity funding were not being vetted, leaving them exposed to “risk of intrusion or influence” by non-EU states, and potentially leading to sensitive security information being shared with non-EU authorities.
Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, said the EU should take a leaf out of CISA’s book.
“CISA’s Automated Indicator Sharing moves machine-readable indicators and defensive measures in real time,” he explained.
“The Joint Cyber Defense Collaborative adds playbooks and rapid exchanges across government, industry, and international partners. Europe needs those functions tied to its existing institutions, with shared rules for confidence, urgency, and action.”
ENISA Warns of Cyber Dependencies
The news comes as a new ENISA report published on September 22 warned that dependencies in the supply chain are expanding the region’s attack surface.
The ENISA Threat Landscape 2026 report claimed that low-impact DDoS attacks accounted for 51% of recorded incidents last year, driven mainly by geopolitical tensions. However, ransomware remained the highest impact short-term threat.
For the small number of intrusion-related incidents for which a vector was identified (5%), ENISA said 60% of these attacks stemmed from vulnerability exploitation.
Public administration remained the most impacted sector (32%), followed by business services (9%), transport (8%), manufacturing (7%) and finance / banking (6%).
The report is based on analysis of 8257 incidents in the 2025 calendar year.