Cover of the CSIS Security Group Threat Matrix Report, Autumn 2026 Edition.

EUROPE’S THREAT LANDSCAPE

Threat Matrix Report · 2026 Edition

The Threat Matrix Report from CSIS Security Group gives a holistic view of Europe's security landscape: cyber threats and the geopolitical events that drive them. It's built on frontline cybersecurity data and geopolitical reporting and analysis from SecAlliance, our threat intelligence division. This edition covers the first half of 2026. It also looks ahead, with forecasts for the months and years to come. Download it to see what the evidence says about the threats you face, and what our analysts expect next.

What's inside

Geopolitical overview (page 8): US-Europe relations, the war in Ukraine and EU-China trade tensions, and what they mean for cyber risk.

Regulatory updates (page 12): Where NIS2, DORA, the AI Act, the Cyber Resilience Act and other EU rules stand now.

Event timeline (page 16): The key political, military, economic, legal, technological and social events of the first half of 2026.

Metrics (page 18): CSIS data on malware, stolen logins, ransomware, what attackers do once they're inside, phishing and card fraud, with Europe compared to the rest of the world.

Trends (page 36): How attack methods are changing, including AI-assisted attacks, attacks on cloud services and user accounts, and the most exploited software weaknesses.

Insights (page 48): A real business email fraud investigation, the pace of AI change, and the wave of attacks on open-source software.

Assessments (page 55): State threats from China, Russia, the US, North Korea and Iran, plus commercial spyware, hybrid threats, influence operations, Europe's push to rely less on foreign technology, ransomware and supply chain attacks.

Forecasts (page 68): Rated forecasts on AI, Europe's technology independence, cybercrime, Russia, China and the US.

One day

Attackers study security updates, then target organisations slow to install them. Using AI, state-backed hackers can build attacks on browsers and firewalls in about a day. In 2025, it took about a week.

Page 39

100.4 million

Stolen logins are one of the main ways attackers break into organisations. In the first half of 2026, CSIS tracked 100.4 million stolen usernames and passwords from Europe and the UK.

Page 20

4,828

Ransomware and extortion gangs name their victims on leak sites. In the first half of 2026, they claimed 4,828 organisations, up 18% on the previous year. Nearly a quarter were European.

Page 65

3.08

Relative to its population, Northern Europe is hit hardest by ransomware. It had 3.08 cases for every million people, ahead of Central Europe (2.28) and Western Europe (2.10).

Page 22

46 minutes

Attackers hide malicious code in open-source software. In one case, poisoned versions were online for just 46 minutes, during which they were downloaded 47,000 times.

Page 53

259%

The EU's diplomatic service investigates foreign disinformation. The number of cases where it found AI being used rose by 259% in 2025 (147 cases).

Page 63

3d-europe-map-grayscale-topographic-relief

GEOPOLITICAL AND CYBER

European threat focus

"A new Europe-focused threat landscape report that provides a more holistic view of geopolitical and cyber threats directly affecting Europe."

Daniel Shepherd, CEO, CSIS Security Group

Europe's security picture is continually changing. In the first half of 2026 alone, relations with the US grew more strained, the Russian threat kept growing, and competition with China sharpened. Meanwhile, AI is making attacks faster and easier to carry out.

These threats are connected. They create both physical and cyber challenges for security teams. So, this report covers them holistically. It shows the overall trends and spotlights specific issues. Use it to brief your leadership and plan ahead.

ACTIONABLE

Prediction highlights

The report doesn't just describe what has happened; it also sets out what our analysts expect next. These forecasts apply a standard scale of terms — the 'Uncertainty Yardstick' — that are based on probability. They also use clear definitions for time frames: short term = three months to one year; medium term = one to three years.

Examples include:

●

REMOTE CHANCE

China carries out cyber sabotage against Europe in the short term.

●

HIGHLY UNLIKELY

Putin's regime falls in the short term.

●

UNLIKELY

A Democratic win in November's US midterm elections significantly changes the direction of US foreign policy.

●

REALISTIC POSSIBILITY

European intelligence services limit what they share with the US on more issues where their views differ.

●

LIKELY

An AI-driven computer worm (malicious software that spreads by itself and adapts as it goes) causes a widespread attack in the short to medium term.

●

HIGHLY LIKELY

Trade relations between the EU and China get worse in the short term, raising the cyber threat to European trade, foreign and finance ministries.

●

ALMOST CERTAIN

Europe's new, independent security and intelligence structures become priority targets for hostile states' intelligence services.

Find more forecasts throughout the report, with the full set from page 69.

CASE STUDY

From the frontline: the fraud that MFA didn't stop

Many organisations rely on multi-factor authentication (MFA) to keep attackers out of Microsoft 365. In this case, it didn't.

An attacker spent months inside a professional services firm's email, without malware and without any obviously suspicious login. Then they tried to use what they'd learned to defraud one of the firm's major customers.

If your organisation uses Microsoft 365, this case is essential reading. Our incident responders explain how the attacker got in, how they stayed hidden, and what you can do to stop the same thing happening to you.

Read the full case study on pages 49–50.

About Threat Matrix Reports

CSIS Threat Matrix Reports give a clear, evidence-based view of Europe's security landscape.

Each report looks at cyber threats alongside the geopolitical events that shape them, including state activity, regulation, cybercrime and new technology. The reports are built on data from our own detection, incident response and monitoring work, and on analysis from our intelligence team.

The result is a holistic view of the threats facing Europe, written to support decisions in the boardroom as well as the security team.

About CSIS Security Group

CSIS Security Group A/S is a leading European pure-play provider of tech-enabled cybersecurity and intelligence services. Operating 24/7, we deliver Managed Detection & Response, Incident Response, Security Consulting across all sectors, and provide a world-class threat intelligence capability through our SecAlliance brand. Accredited by organisations including CREST, we actively support global security initiatives to positively impact the cyber community. CSIS is part of the Allurity Group.