ENISA threat landscape 2025 shows phishing and DDoS convergence

At a glance

What this is: Semgrep’s summary of ENISA’s 2025 threat landscape says 5,000 EU incidents point to phishing as the main entry path, DDoS as the dominant attack type, and AI-supported campaigns becoming more industrialised.

Why it matters: It matters because IAM, security, and resilience teams need to design controls around the attacker behaviours that dominate real incidents, not the ones that are most discussed.

By the numbers:

• ENISA’s 2025 threat landscape analysis covers 5,000 incidents across the European Union.
• DDoS attacks make up over 75% of all incidents in the analysis.

Context

ENISA’s 2025 threat landscape is best read as a governance signal, not just a threat summary. The article shows how phishing, DDoS, ransomware, and AI-supported tactics are converging into patterns that cut across technical, human, and operational controls. For IAM teams, the identity angle is straightforward: the most common entry paths still exploit people, accounts, and trust relationships rather than purely technical weaknesses.

The report’s value is in helping organisations prioritise. When attack volume, automation, and blended motivations increase at the same time, security programmes need to separate the most frequent access paths from the most damaging outcomes. That is as relevant to NHI governance and human identity controls as it is to wider resilience planning.

The article also reflects a typical enterprise reality, not an edge case. Many organisations still treat phishing, DDoS, and ransomware as separate problems, when the article shows they are increasingly part of the same threat environment.

Key questions

Q: What should security teams do first when phishing keeps leading to account takeover?

A: Start with the journeys most exposed to credential replay, then replace phishable factors with phishing-resistant authentication where the business impact is highest. After that, add adaptive step-up controls so suspicious logins can be challenged in real time. Training still matters, but it should support controls that remain effective after a user clicks.

Q: Why do AI phishing attacks create more risk than traditional phishing?

A: AI lowers the cost, time, and skill needed to produce personalised lures, so attackers can run more campaigns and iterate faster. That increases both exposure and realism. The result is a higher probability that a target will trust a message long enough to hand over credentials or payment information.

Q: What breaks when organisations treat DDoS only as a network availability problem?

A: They miss the operational and investigative effects. A DDoS event can exhaust response capacity, obscure parallel intrusion activity, and delay decisions about whether the campaign is a distraction, a standalone attack, or part of a wider extortion effort.

Q: How should security teams prepare critical services to keep operating when ransomware disrupts core systems?

A: Security teams should assume core platforms can fail and prebuild manual operating procedures, offline communications, and clear restoration priorities. The goal is not to preserve every workflow during an attack, but to keep essential services moving while systems are isolated and recovered. In healthcare, utilities, and other critical environments, resilience depends on rehearsed fallback processes, not improvisation during the incident.

Technical breakdown

Why phishing still dominates initial access

Phishing remains effective because it targets the identity layer before technical controls can engage. In practice that includes email phishing, vishing, malspam, and malvertising, all of which exploit human trust and rushed decision-making. AI-supported phishing raises the quality and scale of these lures by improving language, targeting, and reconnaissance, but the underlying mechanism is unchanged: attackers seek a credential, token, approval, or session handoff that lets them enter the environment under legitimate-looking access. For IAM and fraud teams, the relevant control question is not whether a message looks convincing, but whether the organisation can verify the actor and contain the resulting trust transfer.

Practical implication: Strengthen identity verification, phishing-resistant authentication, and user reporting paths where initial access is most likely to occur.

How DDoS and hacktivism converge

DDoS is not just a volumetric nuisance. In the article’s framing, it is the dominant expression of hacktivist activity and part of a broader campaign model that can distract defenders, damage service availability, and create cover for other operations. A modern DDoS campaign often uses automation, distributed infrastructure, and recurring targeting rather than a one-off burst. That matters because the defender’s problem is not only bandwidth management. It is also service continuity, response coordination, and the ability to distinguish noise from parallel intrusion attempts. In a blended threat environment, availability attacks can be both the objective and the diversion.

Practical implication: Treat DDoS as a resilience and detection problem, not only a network capacity problem.

What industrialised ransomware changes for defenders

The article’s discussion of ransomware points to a service model in which operators specialise, scale, and reuse infrastructure and tradecraft. That industrialisation compresses the time between access, persistence, and impact, especially when ransomware is paired with data theft and leak threats. State-linked and financially motivated actors can also blur into one another, which complicates attribution and response priorities. For defenders, the key change is that ransomware is no longer only a payload at the end of an intrusion. It is part of a repeatable business model that rewards rapid access, privilege escalation, and operational disruption.

Practical implication: Align incident response, privilege controls, and backup recovery around faster attacker dwell times and dual-extortion pressure.

Threat narrative

Attacker objective: Attackers aim to gain trusted access, disrupt services, extract value through ransomware or theft, and scale campaigns across multiple organisations.

1. Entry begins with phishing, vishing, malspam, or malvertising that persuades a user to hand over access or execute attacker-controlled content.
2. Escalation follows when AI-supported social engineering or repeated campaign pressure turns initial access into broader trust exploitation and footholds for intrusion or persistence.
3. Impact lands as DDoS disruption, ransomware, data leakage, or information manipulation, depending on the actor’s goal and target sector.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing remains the most important identity-control failure mode in this landscape. The article shows that initial access still starts with trust exploitation, whether through email, voice, social channels, or AI-assisted targeting. That makes identity assurance, user verification, and response speed more relevant than generic awareness slogans. For practitioners, this is a human identity governance problem as much as a security operations problem.

Attack convergence is the real strategic signal, not any single tactic. The article describes actors that blend hacktivism, ransomware, espionage, and automation depending on opportunity. That weakens the value of programme design built around clean categories of threat actor or one-control-one-threat thinking. For teams, the right response is to build controls that hold up when motivations and methods change mid-campaign.

DDoS now functions as both an attack and a distraction layer. In a blended threat environment, availability attacks can mask intrusion, stretch analyst capacity, and create false confidence that the incident is only operational. This is where resilience, detection, and incident coordination need to be integrated rather than run as separate disciplines. Practitioners should plan for simultaneous disruption and compromise.

Industrialised ransomware has turned attacker operations into a repeatable service economy. Once access, persistence, and payload delivery are commoditised, the defender is no longer fighting a unique event but a scalable process. That means the programme must reduce attacker reuse opportunities, compress dwell time, and make privilege movement materially harder. The practitioner conclusion is clear: govern for repeatable adversary workflow, not isolated incidents.

What this signals

Convergence is the programme-level lesson. Security teams should stop planning as though phishing, DDoS, ransomware, and AI-supported attacks live in separate lanes. The article points to a threat environment where one campaign can combine human deception, automated scale, and disruption, so detection, identity controls, and resilience planning need to be coordinated.

Phishing-resistant identity controls now sit at the front of resilience planning. If initial access still starts with trust exploitation, then user verification and privileged account protection become incident reduction controls, not just login improvements. That shifts priority toward identity assurance, reset governance, and response speed across the whole organisation.

For practitioners

• Harden initial access paths Prioritise phishing-resistant authentication, mailbox protections, and verified help-desk reset processes for users and high-risk accounts.
• Reassess DDoS response as resilience planning Test service continuity, escalation, and communications playbooks against sustained DDoS pressure and simultaneous intrusion alerts.
• Shorten attacker dwell time Tighten detection, alert triage, and privilege review so intrusion attempts are contained before ransomware operators can pivot to impact.
• Plan for blended campaigns Coordinate SOC, IAM, fraud, and communications teams around attacks that combine phishing, automation, and disruption across multiple channels.

Key takeaways

• The report shows that the main threat challenge is not a single attack type but a converging mix of phishing, DDoS, ransomware, and AI-supported activity.
• The evidence in the article points to a heavily skewed threat environment, with 5,000 incidents analysed and DDoS accounting for over 75% of all attacks.
• For practitioners, the implication is to prioritise identity assurance, resilience, and faster incident containment over isolated controls aimed at one threat at a time.

Key terms

• Phishing-Based Initial Access: A compromise path where an attacker uses a convincing message or login lure to trick a user into revealing credentials or authorizing access. It remains effective because it targets human trust and legitimate workflows, often creating an entry point that later supports broader account or extension abuse.
• DDoS endurance campaign: A DDoS endurance campaign is a sustained denial-of-service effort designed to keep defenders under pressure for hours or days, not just trigger a short outage. The goal is often to exhaust capacity, response time, and operational attention rather than simply overload a single control point.
• Industrialised Ransomware: Ransomware operated as a repeatable service model, with specialised roles for access, persistence, encryption, and extortion. This model increases scale and speed, and it makes response dependent on limiting reuse of credentials, infrastructure, and operational patterns.
• AI-assisted phishing: AI-assisted phishing is social engineering where generative models help create more convincing, tailored, or higher-volume lure content. The risk is not only better wording, but faster iteration, which lets attackers adapt messages until they evade filters or persuade a target to act.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and secrets management for practitioners who need to connect identity controls to broader security outcomes. It helps security and IAM teams build a shared foundation for reducing trust exploitation across the organisation.