Threat landscape and Joint Cyber Unit status
ENISA Threat Landscape 2026, published on 22 September 2026, covers 1 January to 31 December 2025. It provides a current reference for assessing threats, rather than a record of every incident in the current year. The European Commission proposed the Joint Cyber Unit in 2021; its official factsheet was updated on 30 January 2023. The proposal document alone does not establish implementation or current operational status.
Sources, entry points and reduced exposure
Confirm the context in primary sources first, then reduce account takeover and the exploitation of known vulnerabilities.
ENISA 2026 report
The ENISA report presents threats observed in 2025 and their impact on organisations in the European Union.
Joint Cyber Unit - Commission source
The factsheet describes the Commission's 2021 proposal and purpose; it is not proof of the initiative's current operational status.
Identity and access
MFA for administrators, email, VPN and cloud, separate privileged accounts, access reviews and prompt revocation.
Vulnerabilities and exposure
Inventory, risk priority, a remediation deadline, formal exceptions and retesting shorten system exposure.
Response, resilience, audit and operations
These areas connect threat detection with service recovery, gap assessment and the daily operation of safeguards.
Detection and decision
An alert needs asset context, an owner and an escalation threshold, and must lead to isolation, communication and evidence preservation.
Service recovery
Segregated copies and regular recovery tests limit the impact of an event that preventive controls did not stop.
Audit and evidence
An audit structures critical services, gaps, priorities and control evidence for management, customers or regulators.
Managed operations
Ongoing support is needed when alerts, updates, backups and access require daily ownership rather than a one-off project.
Incident detection must lead to a decision
An alert alone does not limit an attack. The organisation needs asset context, an accountable person, escalation criteria and a prepared follow-up action. Monitoring should connect to incident handling, communication, evidence preservation and the decision to restore a service.
SOC, SIEM and response instructions
Define log sources, detection scenarios, priorities, on-call coverage, response times and event-closure instructions.
Email and phishing
Protect the channel attackers use to take over accounts, redirect payments or convince users to run a file.
Backup and recovery
Segregated copies and regular recovery tests are needed when preventive protection does not stop an event.
A minimum resilience plan for business
Begin with critical services and real business impact. Only then select tools, logging scope and work order. Every action should have an owner, a deadline and evidence of completion.
- Identify critical services, data, administrator accounts, external connections and suppliers with environment access.
- Enforce MFA and separate standard and administrator accounts; schedule reviews and prompt access revocation when staff leave.
- Establish a vulnerability detection, prioritisation, remediation and retest cycle with an exception-acceptance process.
- Enable logs for defined scenarios and exercise escalation, isolation, communication and evidence preservation.
- Test service recovery from backups and update the plan after infrastructure, supplier or business-process changes.
When an audit or managed service is needed
An audit helps when an organisation does not know its complete asset scope, lacks a shared priority list or must demonstrate control operation to a customer, board or regulator. A managed service is needed when alerts, updates, backups and access require daily accountability rather than a one-off project.
NIS2 audit
Assessment of risk, incidents, continuity, ICT suppliers, technical measures and control evidence.
Cybersecurity programme
Identity, endpoint, network, email, monitoring, vulnerability and response measures in one plan.
IT outsourcing
Account, device, backup, update and ticket management with assigned operational responsibility.
