Europe’s critical sectors are maturing, but seven still sit in ENISA’s risk zone

Editor’s Note: Europe’s regulators set out to make critical infrastructure harder to break, and ENISA’s third NIS360 report offers a clear read on whether that effort is working. Maturity is rising across the high-criticality sectors named under NIS2, with three reaching the top band this year, while seven remain in a risk zone where societal importance outpaces preparedness.

For cybersecurity, data privacy, regulatory compliance, and eDiscovery professionals, the report is a map of where obligations and exposure now concentrate. It connects compliance frameworks such as NIS2 and DORA to measurable changes in how organizations spend, patch, test recovery, and vet suppliers, the same controls that shape breach response and downstream legal risk. The water, public administration, and ICT service management findings deserve close reading because those sectors touch records, citizens, and supply chains that compliance and discovery teams support daily.

The risk-zone roster will be worth watching in the next edition, as sectors newest to regulation test whether capacity can be built faster than criticality climbs.

Industry News – Cybersecurity Beat

Europe’s critical sectors are maturing, but seven still sit in ENISA’s risk zone

ComplexDiscovery Staff

Europe’s critical sectors are getting better at defending themselves, yet several industries that society depends on most still cannot keep pace with the cyber risks they carry. That is the central reading of the third annual NIS360 report, released May 28 by the European Union Agency for Cybersecurity, known as ENISA.

The assessment measures two things for every high-criticality sector named under Annex I of the NIS2 Directive: how mature each sector’s cybersecurity is, and how critical that sector is to the economy and daily life. Where criticality outruns maturity, ENISA draws a line and calls the space inside it the risk zone. This year that zone holds seven sectors: health, railway, maritime, ICT service management, space, public administrations, and drinking and waste water.

What the agency measured, and why it matters

NIS360 does not score individual companies. It grades whole sectors, treating each as a mix of actors and rules: the legislation and how well it works, the companies and how prepared they are, the national authorities and their institutional capacity, and the sector’s collaboration structures. ENISA built the methodology in-house and refines it each year, drawing on surveys of organizations and supervising authorities along with EU-level data from sources such as Eurostat and the agency’s own NIS Investments study. Those maturity scores rest substantially on self-reported surveys of organizations and the authorities that supervise them, so they capture reported preparedness rather than independently tested resilience. The report was authored by Jurgita Skritaite, Eleni Philippou and Ugne Komzaite-Kraujale of ENISA.

That sector-wide lens is what separates NIS360 from a typical maturity model, and it is why the report works as a prioritization tool for policymakers deciding where to send attention and money.

ENISA Executive Director Juhan Lepassaar framed the results as encouraging. The findings “provide grounds to be optimistic,” he said, crediting the EU’s broader cybersecurity framework, and NIS2 in particular, with driving real gains in the resilience of critical infrastructure.

Who climbed, and who slipped backward

ENISA finds the maturity picture improved across the board, though unevenly. Three sectors moved into the high maturity band this year: trust services, aviation, and financial market infrastructures, or FMIs. Four more strengthened their standing within the moderate band: gas, road, maritime, and health. Banking, electricity, and telecommunications again held the top spots as the most mature and most critical sectors at once.

The risk zone tells the harder story. Three sectors that sat right at its boundary a year ago have now fallen inside it: railway, drinking water, and waste water. ENISA attributes the shift partly to a moving target. As overall maturity rises, the cross-sector average rises with it, and sectors that fail to keep up find themselves below the line even without sliding in absolute terms.

There was one clear exit. The gas sector has started moving out of the risk zone, a change ENISA credits to better information sharing, stronger collaboration, and more consistent implementation of risk management measures.

Criticality shifts toward space and rail

The report states that criticality scores tend to hold steady from year to year because the factors behind them, such as digitalization, socioeconomic impact, and time-criticality, change slowly. Even so, ENISA revised two sectors upward. Space joined the most critical group, reflecting its deepening role across other sectors and the dependency that role creates. Railway climbed in criticality as well, driven by its expanding part in military logistics and a heightened exposure to cyber threats.

The most critical sectors now include banking, electricity, aviation, space, and the digital-by-default services that everything else runs on: telecommunications, cloud, and data centers. ENISA’s point about that last group is pointed. As every sector digitalizes, dependence on cloud and data centers grows, which makes their maturity a shared concern rather than a private one. Some cloud and data center providers serving financial clients now answer to both NIS2 and the Digital Operational Resilience Act, or DORA, a tangle that the report says is not always easy to interpret or operationalize.

How regulation is changing behavior

One of the report’s more useful conclusions is that regulation appears to be changing behavior, not just paperwork. ENISA points to its 2025 NIS Investments study, in which 70 percent of surveyed organizations named compliance with frameworks such as NIS2, DORA and the Cyber Resilience Act as the main driver of their cybersecurity spending in 2024.

What organizations did with that spending matters as much as the figure. The areas they reported as hardest, namely vulnerability and patch management, business continuity and disaster recovery, and supply-chain risk management, are substantive controls rather than cosmetic ones. ENISA reads that as evidence the law is steering attention toward real risk. On supply chains specifically, 90 percent of surveyed organizations reported putting controls in place to manage third-party exposure, and supply-chain attacks ranked as the second most cited future concern at 47 percent, behind ransomware at 55 percent.

For practitioners, the practical takeaway sits in plain sight. The controls regulators reward and the controls attackers test are converging, so teams that treat patch cadence, tested recovery plans, and supplier due diligence as live operational disciplines, rather than annual audit items, are the ones moving their sectors up the curve.

Independent breach data points the same way on the risks ENISA flags, and the trend has sharpened. Verizon’s 2026 Data Breach Investigations Report, its largest yet at over 31,000 security incidents and 22,000 confirmed breaches across 145 countries, found that breaches involving a third party climbed to 48 percent, a 60 percent jump in a single year on top of a doubling the year before. Ransomware reached 48 percent of breaches, the highest in the report’s 19-year history. For the first time in that span, vulnerability exploitation overtook stolen credentials as the leading way attackers break in, even as the median time to fully patch a flaw slipped to 43 days. Those findings track closely with the two areas organizations told ENISA were hardest to manage: supply-chain risk and vulnerability and patch management.

A gap between the law and its rollout

There is daylight between the report’s optimism and the state of the law it credits, though the gap is closing. NIS2’s transposition deadline passed in October 2024 with only four member states, Belgium, Croatia, Italy and Lithuania, meeting it. By May 2025, the European Commission had issued reasoned opinions to 19 of the bloc’s 27 member states for failing to fully write the directive into national law, warning that unresolved cases could be referred to the Court of Justice of the European Union. Since then, tracker-based reporting indicates that national adoption has advanced, although counts vary depending on whether a country is measured by draft status, enactment, full transposition, entry into force, or operational enforcement. One May 2026 tracker placed the count at 22 of 27 member states with adopted transposing legislation, leaving France, Ireland, Luxembourg, the Netherlands, and Spain still in the legislative process. ENISA attributes maturity gains partly to NIS2 even as its rollout remains uneven, a reminder that a framework can shape behavior while it is still being translated into national law across the EU.

Three forces reshaping the work

ENISA closes its cross-sector view by naming three dynamics that sit behind every sector’s effort. Artificial intelligence is sharpening both defense and offense, with the agency warning that the benefits are landing faster for attackers, who use it for more convincing social engineering and faster vulnerability discovery. Supply chain and third-party dependence keeps widening the blast radius of any single compromise. And geopolitical volatility, from sanctions to export controls to regional conflict, is pulling organizations into the crossfire of nation-state activity.

Those forces fall hardest on the least-resourced. ENISA reports that small and midsize enterprises in critical sectors consistently faced greater difficulty than larger peers across every dimension it measured. Skill shortages, legacy operational technology, and cross-border complexity round out the list of reasons progress stays uneven within sectors, not just between them.

The data current as of the May 2026 report suggests the direction is right even where the pace is slow. ENISA assesses that more sectors will leave the risk zone as legislation, threat exposure, and ecosystem pressure keep pushing investment. The open question for the year ahead is whether the sectors newest to regulation, public administrations and water among them, can build capacity faster than their criticality rises, and whether the member states still behind on NIS2 can close that gap before the threats do.

News sources

• NIS360: The bigger picture on maturity and criticality of NIS critical sectors (ENISA)
• ENISA NIS360 2026 (ENISA)
• NIS Investments 2025 (ENISA)
• ENISA NIS360 2024 report: A comprehensive look at cybersecurity maturity and criticality of NIS2 sectors (ENISA)
• What’s Driving Cybersecurity Investments and where lie the challenges? (ENISA)
• NIS2 Directive transposition in EU countries (European Commission)
• 2026 Data Breach Investigations Report (Verizon)
• NIS2 Transposition in 2026: Where Every EU Member State Stands (Viktoria Compliance)

Assisted by GAI and LLM technologies

Additional reading

• When the worm targets the assistant: Miasma turns AI coding agents into the trigger
• Glasswing widens: Anthropic puts Mythos inside power, water and hospital operators across more than 15 countries
• Canvas breach moves from disclosure to demand as ShinyHunters sets May 12 deadline
• CISA’s CI Fortify rewrites the disconnection playbook for critical infrastructure
• A 48-month federal benchmark resets the incident-response insider question
• Data collection in occupied territory: A closer read of Cyber Law Toolkit scenario 35
• Cyber Law Toolkit tests surveillance and data collection under occupation
• The router on the shelf is now a national security problem
• Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery
• When Your Legal Tech Vendor Gets Breached: DocketWise Incident Exposes 116,666 Immigration Records and a Profession’s Blind Spot
• The DOJ’s Cyber FCA Playbook Is Working as Enforcement Triples and Shows No Signs of Slowing
• FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
• White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
• The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.