The first EU-wide figures on what actually gets reported

A number where there was none

Article 23 has been describable since 2022: a 24-hour early warning, a 72-hour notification, a final report within a month. What has never been describable is what goes into it. Entities file to their national CSIRT or competent authority, the filings are confidential, and nothing aggregated had been published under NIS2. That changed this month.

The NIS Cooperation Group has published the "2025 Annual overview: NIS2 Cybersecurity Incident Reporting", a 23-page document carrying September 2026 on its cover, built on ENISA's analysis of the quarterly summaries member states submit. It is the first edition covering events reported under NIS2. The previous editions in the same series covered NIS1, the European Electronic Communications Code and eIDAS — different legislation, different populations, not a comparable baseline.

It is a reporting document, not a regulatory one. It imposes nothing and changes no obligation. What it does is let you calibrate your own assumptions against what the rest of the Union actually filed.

Read the denominator first

The headline figure is 1,954 events reported in 2025, against 1,508 in 2024 — an increase of almost 30 percent. Taken alone that reads like a surge in incidents. It is not, or not only.

In the same year the number of member states submitting data through CIRAS fell to an average of 20, from 24 the year before: 21 in the first two quarters, 19 in the last two. The report attributes this to the wider set of sectors now in scope and to transposition still being under way in several countries. Both effects pull in opposite directions on the same number.

Most of what is filed is not what the directive requires

By type, the largest category is incidents, at 913 — and their notification is voluntary, under article 30. Significant incidents, the ones article 23 makes mandatory, come second at 857. The Union's incident picture is built more than half from filings nobody was obliged to make.

The report also notes that incidents, near misses and cyber threats have in some cases been categorised as mandatory reporting in the data submitted, which it reads as a sign that entities and member states do not share one understanding of what article 23 requires. If you have ever argued internally about whether an event met the significance test, that argument is happening across 27 jurisdictions at once.

Attacks overtook failures, and failures still hurt longer

Malicious actions became the most reported root cause in 2025, at 48 percent of events, displacing system failure and malfunction at 22 percent. For five years running, the leader had been system failure. About a quarter of events record an unknown root cause, and the report is careful to say that this jump is partly artificial: in previous years member states could not report a root cause as unknown at all.

Then comes the finding worth taking to a continuity review rather than a threat briefing.

Nearly six times longer. The report draws the conclusion itself: the largest operational impact comes not from the most frequent events but from those with the longest recovery times. Article 21(2)(c) asks for business continuity and crisis management, and it is not a subordinate clause next to the attack-facing measures. On this data it is the one that addresses the longest outages.

Half the detail is missing, and that is a finding

Where the data thins out is instructive. For 52 percent of the root causes reported as malicious actions, the technical sub-cause is unknown — and for significant incidents alone, the ones subject to a mandatory final report a month after the notification, it rises to 71 percent. Among the cases where a cause is named, the leaders are DoS and DDoS attacks at 12 percent, intrusions at 11 percent and ransomware at 7 percent.

Affected assets are recorded as "other" or "unknown" for 53 percent of events. The known ones, in order, are applications, servers and domain controllers, websites, mailboxes, and switches and routers. System failures are better characterised: software compatibility or configuration at 30 percent, software performance at 24 percent, hardware capacity and performance at 13 percent.

The report reads these gaps as a possible need to update the taxonomies. There is a second reading that concerns you more directly: the final report is where the technical cause is supposed to land, and in the majority of significant incidents it does not. Whatever your national form asks, a final report that answers "unknown" on the cause is the norm across the Union, not an outlier — and it is a poor foundation for the supervisory conversation that follows.

Sector order changes when you filter for significance

Across all event types the most affected sectors are public administration at 27 percent, health at 18 percent and digital infrastructure at 12 percent, followed by banking, transport, energy and digital providers. Space is the only sector with no reported events at all.

Filter to significant incidents only and the ranking rearranges: health first, digital infrastructure second, banking third, public administration down to fourth. On affected users and user-hours lost, the leaders are digital infrastructure, digital providers and banking. Volume and consequence are not the same axis, and a sector benchmark drawn from the wrong one will mislead a board.

Two details qualify all of this. Reporting is heavily concentrated: two member states account for about 85 percent of all public administration events, and three for 90 percent of health events. What the sector shares measure is partly which national authorities report diligently. And in health, third-party failure rises from 15 percent of all events in the sector to 25 percent of significant incidents — the clearest supply-chain signal in the document, in the sector where it is hardest to switch supplier.

Cross-border, and the named vulnerabilities

Eight member states reported 41 cross-border events, 21 of them significant incidents. In 2024 the figure under NIS was two. That is not a forty-fold rise in cross-border incidents; it is the first year the question was asked of a population this size. The report notes that only eight member states reported any, and suggests a harmonised process may be needed. Banking, digital providers, digital infrastructure and energy were the sectors most affected.

The document also lists twelve CVEs disclosed as associated with reported events, each cross-referenced to the EU Vulnerability Database. The vendors named are Microsoft, Cisco, Fortinet, Citrix, VMware, SonicWall and Roundcube; the report gives the CVE identifier, the EUVD identifier and the vendor, and nothing further. If your vulnerability management has a "was this actually reported in Europe" tier, this is a short, official list to check it against — then go to the vendor advisory for what each one is, because the report does not say.

What to do with it

Not benchmarking. The gaps are too large for that, and the report says so about its own data. Use it instead to test two assumptions you are probably carrying. That your longest outage will be an attack — on this evidence it will more likely be a failure, lasting five times longer. And that your final report will explain the cause — across the Union, most of them do not.

The series is annual, which means the 2026 edition will be the first with a materially complete set of member states behind it. Read this one as the baseline it is, with its holes visible, rather than as the picture it will become.