Public Sector Cyber Statistics Guide: Incidents and Readiness in Government

Government bodies are the most targeted sector in Europe and among the most breached in the United States, yet the figures used to argue for public sector cyber funding are often unsourced or years out of date. This page brings together the official and primary figures: the ENISA Threat Landscape 2025 for the EU, the UK National Audit Office (NAO) report on government cyber resilience and the National Cyber Security Centre (NCSC) Annual Review 2025, the US Office of Management and Budget (OMB) FISMA report to Congress and Government Accountability Office (GAO) work on federal cyber security, and the public administration figures from Verizon's 2025 Data Breach Investigations Report (DBIR). Each figure carries its publisher, edition and period. It is for public sector CISOs, risk owners, auditors and suppliers who need defensible numbers for business cases, risk registers and audit committee papers. Last reviewed: November 2026.

Key takeaways

• Public administration tops the EU target list. 38.2% of the 4,875 incidents ENISA analysed between July 2024 and June 2025 hit public administration, five times the next sector, transport at 7.5% (ENISA Threat Landscape 2025).
• Most of that is hacktivist denial of service. DDoS made up 77% of incidents in the ENISA data set and hacktivism almost 80%, so incident counts overstate impact and understate quieter intrusions.
• UK government is behind its own target. The NAO found at least 228 legacy systems in use in March 2024, 53% without fully funded remediation plans, and one in three cyber roles vacant or filled by temporary staff in 2023-24.
• US federal incidents keep rising. Federal agencies reported 32,211 incidents in FY2023, up 9.9% on FY2022, including 11 major incidents (OMB FISMA report for FY2023).
• Government breaches mix money and espionage. In public administration breaches in the 2025 DBIR, 76% had a financial motive, 29% espionage, and ransomware was present in 30%.

How to read public sector cyber statistics

• Incidents, breaches and "significant" incidents are different units: ENISA counts observed incidents, Verizon separates incidents from confirmed data breaches, and NCSC grades incidents by national significance. Never add them up.
• "Public sector" varies: ENISA's public administration covers national, regional and local government; FISMA covers US federal agencies; NAO covers UK central government departments. Local councils, health and education often sit elsewhere. For schools and universities see Education Sector Cyber Statistics; for health see Healthcare Data Breach Statistics.

European Union: public administration under sustained attack

• Volume is political: public administration leads because hacktivist groups target government websites around elections, summits and geopolitical events. Most of these are short website outages. See DDoS Attack Statistics.
• Intrusions follow the general pattern: phishing (60%) and vulnerability exploitation (21.3%) remain the main ways in, the same controls priority as for any sector.
• NIS2 brings public administration into scope: with more than half of incidents touching NIS2 essential entities, central government bodies in many member states now face NIS2 risk management and reporting duties. See the Central Government Cybersecurity Programme Guide.

United Kingdom: government resilience and national incidents

• Missing the 2025 goal: the Government Cyber Security Strategy of January 2022 aimed for key government organisations to be significantly hardened to cyber attack by 2025. The NAO concluded the threat was severe and advancing quickly and that resilience had not kept pace.
• Legacy is the structural risk: systems that cannot be patched or monitored, with no funded plan, will remain exposed whatever policy says. See the UK Government Functional Standard GovS 007 Security Guide and the NCSC Cyber Assessment Framework (CAF) Guide, which underpins GovAssure.
• Skills depend on contractors: temporary specialists carry knowledge out of the organisation and often hold privileged access that outlives the contract.

United States: federal incidents and oversight

• Improper usage leads: violations of acceptable use by authorised users are the largest category in both years, which points at identity and access governance as much as perimeter defence.
• Phishing doubled in the reported data: email and phishing incidents rose from 3,011 to 6,198, while "other or unknown" halved, so part of the rise is better classification.
• Endpoint visibility: by the end of FY2023, 76 agencies met the threshold of at least 80% endpoint detection and response (EDR) coverage, with over 750,000 of 1.2 million procured EDR licences deployed across 54 agencies (OMB FY2023 FISMA report).
• Audit backlog: GAO has made over 4,400 cyber security recommendations to federal agencies since 2010; more than 730 were not fully implemented as of February 2026, 48 of them priority recommendations. Information security has been on GAO's High-Risk List since 1997.
• Monitoring gaps: in GAO-25-107470, 21 of 23 CFO Act agencies had not fully implemented CDM network security and data protection capabilities, 20 reported data integration and quality issues and 16 reported hardware inventory issues.

Breaches in public administration

• Insiders and errors matter more here: a third of breaches involve internal actors and miscellaneous errors (misdelivery, misconfiguration, publishing errors) sit among the top patterns. Government holds large volumes of citizen data handled by many staff.
• Secrets are a target: 17% of breaches compromised secrets such as credentials and keys. The BeyondTrust and US Treasury incident shows how one stolen API key for a remote support service led to a major federal incident.
• Espionage is real: 29% espionage is far above most private sectors. The Storm-0558 key breach, in which a stolen signing key was used to forge access to government email, is the reference case. See also the Government Threat Actors Guide.

Where identity fits

Three of the strongest signals in the data are about identity: improper usage as the top federal incident category, a third of public administration breaches involving insiders, and 17% of breaches compromising secrets. Government estates also run large numbers of service accounts, integration keys and supplier access paths, often on the legacy systems the NAO flagged. Prioritise phishing-resistant MFA for staff and administrators, an inventory of service accounts and API keys on legacy and supplier-connected systems, and removal of contractor access on exit. See the Local Government Identity Security Guide and the Taiwan government SSO incident, where weak credentials let automated agents take over government accounts and pivot through single sign-on.

What the numbers mean for defenders

1. Absorb DDoS cheaply: with hacktivist DDoS the most common EU incident, put public websites behind upstream DDoS protection and agree a communications line for outages before an election or summit.
2. Fund legacy exit plans: list every legacy system, its owner and its compensating controls, and do not accept "no funded plan" without a risk owner's signature.
3. Harden email and identity: phishing leads initial access in ENISA's data and doubled in federal reporting. Enforce DMARC, phishing-resistant MFA and conditional access.
4. Patch internet-facing services first: vulnerability exploitation is the second intrusion route. Track known exploited vulnerabilities against a fixed deadline.
5. Close the skills gap deliberately: build permanent roles for security architecture and require knowledge transfer and access removal in contractor terms.
6. Measure and report: agree a short set of metrics with the audit committee and report them quarterly, as below.

Metrics to track

• Legacy exposure: number of legacy systems without a funded remediation plan, and the share with compensating monitoring.
• Phishing-resistant MFA coverage: percentage of staff, administrators and supplier accounts covered.
• KEV remediation time: median days to remediate known exploited vulnerabilities on internet-facing systems.
• EDR coverage: percentage of endpoints reporting, against the 80% federal threshold used by OMB.
• Workforce stability: share of security roles filled by permanent staff.
• Open audit findings: number of open security audit recommendations and their age.

Common failure patterns when using public sector statistics

• Treating ENISA's 38.2% as "breaches": most are DDoS incidents, not data compromises.
• Quoting NCSC totals as government incidents: the NCSC figures cover all UK sectors.
• Comparing DBIR incident counts year on year: Verizon itself says the drop reflects a missing data contributor.
• Using the FY2023 FISMA total as current: state the fiscal year; later reports may change categories.
• Mixing central and local government: NAO and FISMA findings do not describe councils, police or health bodies.

Practitioner checklist

• Quote each figure with publisher, edition, period and the scope of "public sector" it covers.
• Keep a register of legacy systems with owners, funding status and compensating controls.
• Put all public websites behind DDoS protection and rehearse the outage message.
• Enforce phishing-resistant MFA and DMARC across the organisation.
• Inventory service accounts, API keys and supplier access, and remove contractor access on exit.
• Remediate known exploited vulnerabilities on internet-facing systems to a fixed deadline.
• Track open audit recommendations and report their age to the audit committee.
• Refresh figures when ENISA, NCSC, NAO, OMB, GAO and Verizon publish new editions.

Standards and references

• ENISA: Threat Landscape 2025, EU consistently targeted by diverse yet convergent threat groups
• NAO: Cyber threat to UK government is severe and advancing quickly
• NCSC: UK experiencing four nationally significant cyber attacks every week
• OMB: Federal Information Security Modernization Act Annual Report to Congress, FY2023
• GAO: Cybersecurity
• GAO: Cybersecurity, Network Monitoring Program Needs Further Guidance and Actions (GAO-25-107470)
• Verizon: 2025 DBIR Public Sector Snapshot

Related NHI Mgmt Group resources: Cybersecurity for Local Government Guide · FISMA Guide · AI Security in Government and Public Sector · Cybersecurity Statistics Guide