Cybersecurity planning becomes difficult when every risk is described as urgent. ENISA’s 2026 Threat Landscape helps restore priorities. Its message for European growing businesses is not that one exotic attack has replaced all others. It is that familiar threats remain effective, while dependencies on suppliers, cloud platforms and connected services allow one weakness to spread further.
What happened
The EU Agency for Cybersecurity published its 2026 Threat Landscape on 22 September. The analysis covers incidents and events observed from 1 January through 31 December 2025, using open sources plus anonymised information from EU Member States and the ENISA Cyber Partnership Programme.
ENISA identifies ransomware as the incident type with the greatest short-term impact. Social engineering remained a common enabling tactic, supported by phishing kits and criminal service ecosystems. Exploitation of known and zero-day vulnerabilities remained a prevalent intrusion path. The report also highlights supply-chain and third-party attacks, which can create large-scale incidents because many organisations depend on the same digital services.
The report says 73% of targeted organisations in its dataset were essential or important entities under NIS2 definitions. Public administration represented 32% of cases, followed by business services and transport at 8% each, manufacturing at 7%, and finance and banking at 6%. These figures describe ENISA’s observed dataset, not the probability that any individual SME will be attacked.
AI has a dual role. ENISA expects malicious groups to use emerging models to support operations, while business adoption of AI creates additional systems, identities and data flows that defenders must understand.
Why this matters for growing businesses
SMEs rarely operate alone. Payroll may be outsourced, email is cloud-hosted, the ERP connects to payment and logistics services, and a managed provider may administer endpoints. This makes dependency mapping a business-continuity task, not a procurement footnote. A supplier outage or compromised integration can stop operations even when the company’s own network is intact.
The report also argues against waiting for a spectacular new threat. Patch delays, weak authentication, phishing and untested recovery remain enough to cause serious damage. Growing firms should therefore resist buying isolated security products before fixing ownership and process. A dashboard cannot compensate for a critical server nobody knows is exposed.
NIS2 directly applies only to organisations within its scope, but its operating logic is useful more broadly: management accountability, risk-based controls, incident handling, supply-chain security and evidence that controls work. Customers and larger partners increasingly ask smaller suppliers to demonstrate the same basics.
Practical actions for the next quarter
- Build a dependency register. List critical services, data owners, technical owners, suppliers, integrations and recovery alternatives. Include identity, DNS, email, ERP, payment, backup and connectivity. Rank each dependency by operational impact and maximum tolerable downtime.
- Patch by exposure and exploitation. Combine asset inventory with vulnerability information and active-exploitation alerts. Internet-facing systems and vulnerabilities known to be exploited should outrank a long list sorted only by severity score.
- Protect identity first. Require strong multi-factor authentication, separate administrator accounts, remove dormant users and review privileged access quarterly. Log sign-ins and keep enough history to investigate an incident.
- Make backups recoverable. Keep protected copies separated from normal administrator credentials. Test a real restore of ERP data, documents and configuration. Recording “backup successful” is not the same as proving the business can resume.
- Control third-party access. Give providers named accounts, minimum permissions and time-bounded access where possible. Contractual clauses should cover incident notification, evidence preservation, subcontractors, data return and secure offboarding.
- Exercise one plausible scenario. Choose ransomware, supplier outage or account compromise. Include management, operations, finance, communications and the technical provider. Capture decisions, missing contacts and recovery assumptions.
A simple measurement framework
Management needs a short risk view, not a wall of alerts. Useful monthly measures include the share of critical assets with a named owner, high-priority patches completed within policy, privileged accounts protected by strong authentication, restore tests passed, critical suppliers reviewed, and incident exercises completed. Add time-to-detect and time-to-recover once the underlying logging and recovery data are reliable.
For each metric, define the source, owner and threshold that triggers action. Avoid vanity percentages that hide exceptions. “Ninety-eight percent patched” sounds reassuring until the missing two percent is the public VPN gateway.
How VDS Consultoria can help
VDS Consultoria can turn the ENISA findings into a proportionate security roadmap for an SME. We map systems and suppliers, connect technical findings to business impact, design practical identity and backup controls, and organise incident exercises. Where Odoo is the operational core, we also review integrations, administrator access, hosting dependencies and recovery procedures so cyber resilience supports the actual way the company works.
The right outcome is not fear or compliance theatre. It is a small set of owned controls, tested recovery paths and management decisions based on evidence.