Reading the ENISA Threat Landscape 2025 report

Reading the ENISA Threat Landscape 2025 report, published on 6 October 2025, portrays a convergent and persistent EU cyber threat landscape driven by ransomware, AI-enabled phishing, and state-backed espionage. The report analyses events from July 2024 to June 2025, recording nearly 4,900 verified incidents, with phishing remaining the primary intrusion vector at 60% and vulnerability exploitation at 21.3%.

It highlights rapid vulnerability exploitation, professionalisation of cybercrime, and growing convergence between criminal, state-aligned, and hacktivist operations, noting that hacktivist activities account for almost 80% of all recorded incidents, largely in low-impact DDoS campaigns. Public administration remains the most targeted sector (38%), followed by transport, with disruptions in maritime and logistics infrastructure and in aviation and freight operations.

The document also details how AI is used to automate social engineering, with over 80% of observed global activity in AI-assisted phishing and related impersonation by early 2025, and it mentions the rise of Ransomware-as-a-Service and access brokers as fuelling the criminal marketplace, according to ENISA Threat Landscape 2025 report.