Topic starter
02/08/2026 12:20 pm
TL;DR: ENISA’s 2025 threat landscape analysis of 5,000 incidents shows phishing remains a dominant initial access path, DDoS accounts for more than 75% of incidents, and ransomware plus AI-supported attacks are reshaping adversary behaviour across Europe, according to Semgrep. The security shift is from reactive controls to intelligence-driven resilience, where attacker convergence and automation matter as much as raw volume.
Editorial analysis by NHI Mgmt Group, based on content published by Semgrep: “7 Things We Learned from the EU’s Cybersecurity Threat Landscape 2050 Report”.
By the numbers:
- ENISA’s 2025 threat landscape analysis covers 5,000 incidents across the European Union.
- DDoS attacks make up over 75% of all incidents in the analysis.
Key questions
Q: What should security teams do first when phishing keeps leading to account takeover?
A: Start with the journeys most exposed to credential replay, then replace phishable factors with phishing-resistant authentication where the business impact is highest.
Q: Why do AI phishing attacks create more risk than traditional phishing?
A: AI lowers the cost, time, and skill needed to produce personalised lures, so attackers can run more campaigns and iterate faster.
Q: What breaks when organisations treat DDoS only as a network availability problem?
A: They miss the operational and investigative effects.
Practitioner guidance
- Harden initial access paths Prioritise phishing-resistant authentication, mailbox protections, and verified help-desk reset processes for users and high-risk accounts.
- Reassess DDoS response as resilience planning Test service continuity, escalation, and communications playbooks against sustained DDoS pressure and simultaneous intrusion alerts.
- Shorten attacker dwell time Tighten detection, alert triage, and privilege review so intrusion attempts are contained before ransomware operators can pivot to impact.
Bottom line: The report shows that the main threat challenge is not a single attack type but a converging mix of phishing, DDoS, ransomware, and AI-supported activity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:20 pm
Phishing remains the most important identity-control failure mode in this landscape. The article shows that initial access still starts with trust exploitation, whether through email, voice, social channels, or AI-assisted targeting. That makes identity assurance, user verification, and response speed more relevant than generic awareness slogans. For practitioners, this is a human identity governance problem as much as a security operations problem.
A question worth separating out:
A: Security teams should assume core platforms can fail and prebuild manual operating procedures, offline communications, and clear restoration priorities. The goal is not to preserve every workflow during an attack, but to keep essential services moving while systems are isolated and recovered. In healthcare, utilities, and other critical environments, resilience depends on rehearsed fallback processes, not improvisation during the incident.
👉 Read our full editorial: ENISA threat landscape 2025 shows phishing and DDoS convergence