EU member states increasingly recognise cybersecurity as an issue of economic resilience as well as national security.
There is a common proverb that security always feels excessive, right up to the moment that it is the only thing that matters. Europe’s leaders should bear this in mind as the continent’s security environment is changing. The threat is no longer confined to tanks, missiles and aircraft crossing national borders. In addition to drone strikes, sabotage of critical infrastructure, cyber espionage, ransomware and attacks on digital systems are becoming part of a broader and increasingly complex security landscape.
For Europe, the implications are profound. The distinction between military and civilian security is becoming harder to maintain because modern economies and armed forces depend on the same digital infrastructure. Electricity grids, ports, financial systems, telecommunications, hospitals, transport networks and government services are all potential targets.
The scale of the cyber challenge is already substantial. The latest European Union Agency for Cybersecurity (ENISA) Threat Landscape analysed incidents recorded during 2025 and found that ransomware remained the most impactful cyber threat facing the EU. Public administration was the most targeted sector, accounting for 32 per cent of targeted organisations, while 73 per cent of targeted organisations were classified as essential or important entities under the EU’s NIS2 framework. The economic consequences are equally significant. In 2024, 21.5 per cent of EU enterprises reported ICT-related security incidents that resulted in adverse consequences. Research by the insurance company Howden highlights that cyber attacks cost France, Germany, Italy and Spain alone EUR 300 billion over the past five years. Cybercrime itself imposes costs on companies, governments and individuals, while the European Commission and EU member states increasingly recognise cybersecurity as an issue of economic resilience as well as national security.
The physical and digital threats are also increasingly connected. Russia’s war against Ukraine has demonstrated how conventional military operations can be accompanied by cyber operations, disinformation and attacks against critical infrastructure. European governments therefore have to recognise that hostile states and other actors can seek to weaken societies without firing a conventional weapon.
The Baltic states have understood this reality for much longer than most. Estonia experienced a major wave of cyber attacks in April and May 2007, when government, banking, media and other online services were targeted. The incident was significant enough to prompt NATO defence ministers to agree on strengthened protection for critical information systems.
Almost two decades later, the attack surface is vastly larger. Cloud computing, software-as-a-service (SaaS) platforms, connected devices, remote working, mobile applications and artificial intelligence have created enormous opportunities for businesses – but also many more potential points of entry.
This environment has helped create a new generation of European cybersecurity companies. Lithuania, for example, has produced internationally recognised companies such as Nord Security, the parent company of NordVPN and also Buck4Bug, a cybersecurity startup that operates the first dedicated bug bounty and offensive security marketplace in the Baltic region.
The current reality and menace
The next phase of the cyber threat could be even more challenging because artificial intelligence is lowering the cost and increasing the sophistication of attacks. AI can help attackers create highly convincing phishing messages, automate social engineering and produce synthetic audio and video. ENISA has warned that emerging AI models are expected to be increasingly used to support malicious operations, while its latest threat landscape identifies AI-generated text, synthetic audio and video as increasingly important tools for hostile actors.
Malware itself is also becoming more adaptable. The possibility of increasingly automated and self-modifying malicious code means that defenders cannot simply rely on yesterday’s signatures and yesterday’s assumptions. There are governance problems too. Employees increasingly put sensitive information, source code, customer data and business documents into AI productivity tools. If those systems are poorly configured, compromised or used without appropriate controls, an organisation can inadvertently expand its own attack surface.
Then there is the supply chain. A company can have strong internal security and still be exposed through a software provider, managed service provider, cloud platform or other third-party supplier. ENISA has repeatedly identified supply-chain and dependency attacks as a major concern because one compromised provider can potentially create cascading consequences across many organisations.
Identity is another major weakness for companies and organisations. Stolen passwords, compromised credentials and impersonation attacks can provide attackers with apparently legitimate access to systems. Phishing remains one of the leading routes into organisations, accounting for 60 per cent of identified intrusion access points in ENISA’s 2025 analysis.
The uncomfortable reality is that many organisations simply do not have enough cybersecurity specialists, resources or continuous protection to deal with this environment alone. Dovilė Vyčinė, Managing Director of the British Chamber of Commerce in Lithuania highlights that for their members cybersecurity is increasingly becoming a business resilience and boardroom issue rather than simply an IT issue. Businesses are particularly concerned about phishing and social-engineering attacks, ransomware, vulnerabilities in their systems, and the security of their suppliers and partners, according to her. With AI making cyberattacks increasingly sophisticated and convincing, companies need to continuously test their defences and identify vulnerabilities before malicious actors find them. This is also particularly important for smaller businesses, which may not have large internal cybersecurity teams but can still become an entry point into larger organisations and supply chains, she states. Ultimately, cybersecurity is about business continuity, customer trust and the resilience of the wider business ecosystem.
Ethical hacking offers solutions
Given the elevated threat levels, a new model of cybersecurity can make a difference. The company Buck4Bug connects organisations with ethical hackers who can continuously test their digital assets, identify vulnerabilities and expose weaknesses before malicious actors find them. Rather than relying exclusively on periodic security assessments, organisations can establish an ongoing process of testing, reporting and remediation.
Furthermore, the bug bounty model allows vetted security researchers to test agreed systems and report vulnerabilities securely. Buck4Bug manages the process, including triage and reward payments, so organisations receive actionable intelligence while ethical hackers are rewarded for finding genuine weaknesses. The model also opens new opportunities for cybersecurity specialists. Instead of treating hackers solely as a potential threat, organisations can harness the skills of ethical researchers to strengthen their defences.
“With a community of more than 1,000 hackers, Buck4Bug demonstrates the potential of distributed security testing: many skilled researchers examining systems from different perspectives can identify weaknesses that a conventional, time-limited security audit might miss” says CEO Paulius Šliavas.
This approach matters because cybersecurity is ultimately about resilience. The question is not whether an organisation will ever face an attempted attack, but whether it can identify weaknesses, respond quickly and continue operating when one occurs. For Europe, the lesson is clear: cybersecurity cannot be treated as a technical issue that sits somewhere in the IT department. It is now part of national resilience and European defence.
Governments need secure infrastructure. Companies need resilient digital systems. Individuals need protection against fraud, identity theft and manipulation. And Europe needs a strong cybersecurity industry capable of developing the technologies and expertise required to stay ahead. Defence spending naturally focuses on aircraft, ships, missiles, drones and other hardware. But the systems that control, connect and support those capabilities are increasingly digital. Protecting them is just as important. Cybersecurity is therefore not an excessive, optional layer around European defence. It is an essential part of it.
Photo: Dreamstime.
Cybersecurity is an essential part of EU defence was originally published on Emerging Europe.
