The European Union’s cybersecurity landscape isn’t easy to get right. At least when it comes to detecting incidents and responding to them.
An audit report from the European Court of Auditors bears this out. It focused primarily on five arrangements:
- CSIRT Network: It brings together the national CSIRTs and CERT-EU. Established in 2016 under the NIS Directive.
- EU-CyCLONe Network: A network of national authorities responsible for cyber crisis management. It serves as an intermediary between the technical level (where the CSIRT network operates) and the political level (the Council of the EU). Launched informally in 2020, then formalized by NIS 2.
- Cyber Situation Centre: Created in 2023 at DG Connect to enable the European Commission to gain a better understanding of the situation.
- European Cybersecurity Alert System: Network of national and cross-border cyber poles. Implemented in 2025 by the Cyber Solidarity Regulation.
- EU Cybersecurity Reserve: A mechanism providing member states with precontractual capacities for preparedness and response. Also established in 2025 by the Cyber Solidarity Act.
The audit covered the period 2022-2025. Overall conclusion: the EU’s action only partially facilitates detection and response to cyber incidents. Information sharing remains limited. There is a framework for cooperation, but efforts to make it fully operational are ongoing.
EU-CyCLONe and the CSIRT network still need to align
Since 2025, the EU has had a cybersecurity blueprint. The European Court of Auditors finds that it presents “with great clarity” the roles and responsibilities in crisis management.
At the time of the audit, the CSIRT network and EU-CyCLONe had not yet finalized the procedural modalities of their collaboration. They had not agreed on the criteria the first must apply to inform the second of incidents. They also needed to agree on a common taxonomy. Both for severity levels and for key concepts such as “significant incident” and “major incident.”
Cross-border impact, hard to gauge
The delays in transposing NIS 2 do not help information sharing. Until the directive is in force, the entities concerned are not legally required to report incidents.
Another obstacle: the difficulty in determining whether incidents have cross-border impact. National authorities do not necessarily have the information needed. And there is no EU-level platform to correlate their reports.
The audit report cites as an example the incident affecting Collins Aerospace. Member states did not report it despite its significant cross-border impact. More broadly, since 2016, none of the 27 has considered an incident to be “major.” Despite WannaCry, NotPetya, or, more recently, the CrowdStrike episode.
National security laws themselves also block information sharing. So far, no EU-level analysis has been conducted on the impact of the member states’ legal frameworks.
A Cyber Situation Centre that seems somewhat duplicative
To operate its Cyber Situation Centre, the European Commission heavily relies on external service providers. By the end of 2022, it awarded them a contract worth nearly €18 million over four years.
The work of these providers partly duplicates ENISA’s capabilities, whose reports appear similar. They also draw on data already held by other Commission services—such as CERT-EU and the DG for Digital Services.
A questionable structuring for the EU’s cybersecurity reserve
The Cybersecurity Reserve has a budget of €36 million for 2025-2027. It is allocated equally among the member states. The tender process for bids has indeed been divided into 27 lots.
This approach has a drawback. If a country does not use the services covered by the pre-awarded contracts, the budget cannot be used to assist others.
The audit report also notes, indirectly, the risk that the mechanism could be used mainly for preparedness rather than for actual response, which is its intended purpose.
The alert system hampered by procurement delays
Participation in the cybersecurity alert system is voluntary. At the time of the audit, 13 member states had joined the loop. Two cross-border poles had been established: ATHENA and ENSOC (a third, NBCC, has since received funding).
The first two poles began operating in early 2024. To date, they have yielded no tangible results, due to procurement delays in acquiring tools and services.
This process was conducted in two phases to limit the dissemination of sensitive information (only candidates selected in the first phase had access to the detailed technical specifications).
The first phase started in May 2024 for ENSOC; in July 2024 for ATHENA. Interested companies had one month to submit a proposal. Yet the selected bidders were not informed until April 2025.
The entry into the second phase did not occur immediately, as pole members had not finalized the technical specifications needed to submit a bid. At the time of the audit—18 months after the market procedures were launched—no contract had been signed. In the absence of detection and sharing tools, the alert system was still not functioning.
Between cyber-poles and national CSIRTs, a clear distinction is lacking
The role of these cyber-poles is not clearly distinct from that of the national CSIRTs. As it stands, their tasks partially duplicate one another.
For cooperation, they lack a common taxonomy and interoperability guarantees. The CSIRT experience underscores the challenge this represents, according to the European Court of Auditors.
ENISA responded to the report. It regrets not being part of the cross-border cyber-poles network. This situation “significantly hinders” the effectiveness of information sharing.
