Editor’s Note:  The ENISA NIS Investments 2024 report provides essential insights into Europe’s cybersecurity progress and challenges at a critical juncture. As the NIS 2 Directive is transposed into national laws, the report offers policymakers, industry leaders, and cybersecurity professionals a detailed snapshot of investment trends, workforce gaps, and sectoral readiness. It is an indispensable tool for guiding informed decisions and fostering a more resilient digital ecosystem across the EU. This report not only captures where we are but also lays the groundwork for evaluating the future impact of NIS 2 on Europe’s cybersecurity landscape.


Content Assessment: The ENISA NIS Investments 2024 Report: A Cybersecurity Crossroads for Europe

Information - 94%
Insight - 92%
Relevance - 92%
Objectivity - 94%
Authority - 95%

93%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "The ENISA NIS Investments 2024 Report: A Cybersecurity Crossroads for Europe."


Industry News – Cybersecurity Beat

The ENISA NIS Investments 2024 Report: A Cybersecurity Crossroads for Europe

ComplexDiscovery Staff

The NIS 2 Directive signifies a shift in Europe’s approach to cybersecurity,” declared Juhan Lepassaar, Executive Director of the European Union Agency for Cybersecurity (ENISA), as announced in the ENISA NIS Investments 2024 report on November 22, 2024. His statement encapsulates the transformative moment facing Europe’s cybersecurity ecosystem. The report, a detailed survey of 1,350 organizations across all 27 EU Member States, offers a critical pre-implementation snapshot of how organizations are preparing for compliance under the expanded scope of the Network and Information Systems Directive 2 (NIS 2).

At the heart of this pivotal study is a pressing question: Is Europe ready to meet the heightened demands of cybersecurity amid a rapidly evolving threat landscape? The report not only captures the current state of readiness but also provides a roadmap for navigating the challenges ahead.

A Story of Rising Investments

The ENISA NIS Investments 2024 report highlights a key trend: cybersecurity investments in the EU are on the rise. In 2023, organizations allocated a record 9% of their IT budgets to cybersecurity, up from 7.1% in 2022. Median IT spending rose to €15 million, while information security budgets doubled from €0.7 million to €1.4 million. This growth reflects increasing recognition of the importance of robust digital defenses in the face of rising cyberattacks and regulatory pressures.

Despite these positive trends, the report reveals significant gaps in advanced investments. While baseline cybersecurity capabilities are being strengthened, emerging areas like post-quantum cryptography remain underfunded. Only 4% of surveyed organizations have invested in this cutting-edge technology, with another 14% planning future investments. These figures suggest that while cybersecurity awareness is growing, there is a need to balance immediate priorities with forward-looking strategies.

Sectoral Readiness: A Mixed Picture

The transition to NIS 2 brings a broader range of sectors under regulatory scrutiny, including manufacturing, wastewater management, and public administration. However, readiness across these sectors varies significantly. Entities already covered under the original NIS Directive—such as banking, energy, and health—demonstrate higher levels of cybersecurity maturity. These organizations have had years to adapt to regulatory requirements and benefit from a more ingrained culture of risk management.

In contrast, sectors newly included under NIS 2 lag behind. The report finds that 38% of manufacturing entities and 40% of wastewater management organizations remain unaware of NIS 2 provisions. This gap points to an urgent need for targeted awareness campaigns and capacity-building initiatives to ensure compliance and resilience.

Compliance challenges are not limited to awareness. Nearly half of surveyed organizations cite business continuity planning and vulnerability management as particularly difficult requirements. These challenges are compounded by ongoing workforce shortages, which have become a critical obstacle to achieving cybersecurity goals.

A Workforce in Crisis

One of the most alarming findings of the report is the acute shortage of cybersecurity professionals. Despite increased budgets, the percentage of IT full-time equivalents (FTEs) dedicated to cybersecurity has fallen to 11.1%—its fourth consecutive year of decline. Recruitment challenges are widespread, with 32% of organizations reporting difficulties in hiring across all domains. For small and medium enterprises (SMEs), the situation is even more dire, with 59% struggling to secure qualified talent.

The report underscores a dual problem: a lack of sufficient candidates and a shortage of specialized skills. Technical roles in cybersecurity architecture and engineering are particularly hard to fill, and 76% of cybersecurity staff lack formal certifications. The growing reliance on artificial intelligence and cloud technologies exacerbates these gaps, leaving many organizations unable to keep pace with emerging threats.

This workforce crisis is not just a numbers game; it has profound implications for compliance and resilience. With 89% of organizations indicating they will need additional staff to meet NIS 2 requirements, the need for comprehensive workforce development programs has never been more urgent.

Rising Threats and Patchy Preparedness

The report comes against the backdrop of an escalating cyber threat landscape. A staggering 90% of surveyed organizations expect an increase in cyberattacks in 2024, both in volume and cost. Despite this, preparedness efforts remain largely internal. Only 26% of organizations participate in EU-level cybersecurity initiatives, highlighting a critical gap in cross-border collaboration.

This lack of coordinated efforts is particularly concerning given the interconnected nature of modern cyber risks. Effective management of large-scale incidents requires robust national and EU-level preparedness, yet the report finds that most entities focus exclusively on their own organizational efforts. This siloed approach risks leaving Europe vulnerable to complex, multi-sectoral cyber incidents.

Digital Infrastructure and Space: Sectoral Insights

The ENISA NIS Investments 2024 report also offers deep dives into specific sectors, providing valuable insights into the challenges and opportunities they face.

In the digital infrastructure sector, 55% of entities are subject to national reporting obligations but have not yet experienced a reportable incident. This sector relies heavily on technical guidelines from ENISA and other bodies to implement cybersecurity measures. However, uncertainty about national restrictions on high-risk vendors and inconsistent supply chain security practices remain areas of concern.

The space sector, meanwhile, is marked by widespread cloud adoption, with 61% of organizations relying on public cloud services. However, emerging security technologies like Zero Trust Architecture and post-quantum cryptography are underutilized. This sector’s heavy reliance on third-party suppliers for cybersecurity and risk management adds another layer of complexity to its preparedness.

Why This Report Matters

The ENISA NIS Investments 2024 report is more than a survey; it is a critical tool for understanding Europe’s cybersecurity landscape at a pivotal moment. By providing a detailed pre-implementation snapshot of NIS 2 readiness, the report serves as a baseline for assessing the Directive’s future impact. It offers data-driven insights to guide policymakers, help businesses benchmark their preparedness, and identify areas that require immediate attention.

As Juhan Lepassaar noted, “The proper implementation of NIS 2 requires adequate investments and especially into the new sectors which fall under the scope of the updated Directive.” This report provides the evidence needed to make those investments strategic and impactful.

The Road Ahead

The findings of the ENISA NIS Investments 2024 report make one thing clear: the shift under NIS 2 is both an opportunity and a challenge. While rising investments and growing awareness signal progress, persistent gaps in workforce, advanced technology adoption, and collaborative preparedness must be addressed.

Europe’s cybersecurity future depends on coordinated action at all levels—policy, industry, and society. The question is no longer whether the shift will happen but how effectively it will be managed. As Europe stands at this crossroads, the decisions made today will shape its digital resilience for years to come.

As Lepassaar’s opening remark reminds us, “The NIS 2 Directive signifies a shift in Europe’s approach to cybersecurity.” But as the ENISA NIS Investments 2024 report shows, this shift demands more than compliance; it requires collective action and unwavering commitment. Will Europe rise to the challenge? The clock is ticking.

News Source


Assisted by GAI and LLM Technologies

Additional Reading

Source: ComplexDiscovery OÜ

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is a highly recognized digital publication focused on providing detailed insights into the fields of cybersecurity, information governance, and eDiscovery. Based in Estonia, a hub for digital innovation, ComplexDiscovery OÜ upholds rigorous standards in journalistic integrity, delivering nuanced analyses of global trends, technology advancements, and the eDiscovery sector. The publication expertly connects intricate legal technology issues with the broader narrative of international business and current events, offering its readership invaluable insights for informed decision-making.

For the latest in law, technology, and business, visit ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, DALL-E2, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).

ComplexDiscovery also provides a ChatGPT-powered AI article assistant for its users. This feature leverages LLM capabilities to generate relevant and valuable insights related to specific page and post content published on ComplexDiscovery.com. By offering this AI-driven service, ComplexDiscovery OÜ aims to create a more interactive and engaging experience for its users, while highlighting the importance of responsible and ethical use of GAI and LLM technologies.