The EU's cybersecurity agency says household routers and appliances could be the next frontier after October's attacks on supermarket refrigeration systems. Juhan Lepassaar, executive director of Enisa, delivered that warning to AFP in Brussels on Tuesday, 10 November, and called on the Union to invest more against growing cyber threats.

Lepassaar declined to comment directly on France's attribution of the refrigerator attacks to Iran. But he was blunt about the wider picture: Chinese, Iranian, North Korean and Russian "state-aligned actors" (groups acting in line with government interests) are known to target Europe.

"Safety should not and cannot be an afterthought," Lepassaar said. "Today it was refrigerators, tomorrow it could be routers, the day after tomorrow it could be appliances, and so on."

What do the numbers say?

Enisa's EU Cybersecurity Index for 2026 puts the bloc's overall average at 71.53 points on a 0-100 scale. The majority of member states have reached a mature or higher posture level, in line with the goal of a high, shared standard across the Union. Preparedness has improved. The threat environment hasn't stood still.

The report, built on Enisa's assessment of member states' capabilities and resources, finds that intrusion activity stayed intense and diverse through 2025 and 2026. Ideology remains the primary driver of cyber incidents, geopolitical tensions continue to shape hostile operations, and hacktivists (hobbyist or activist hackers) dominate overall attack volumes. AI acts as a multiplier of both offensive and defensive capabilities, and the evolution of AI models is accelerating how quickly vulnerabilities are found and exploited.

"Challenges persist and recent developments – not only in border AI models, but also in cyber incidents affecting refrigeration systems across the EU – highlight operational gaps and the need for coordination and timely information sharing," Lepassaar said. He added that consolidating common situational awareness and increasing policy alignment in critical sectors is crucial, and that strategies must now be updated for "an increasingly complex cybersecurity scenario."

Where are the weak spots?

The index breaks maturity into strands, and the spread is wide:

• National policy implementation: 66.72 points, mostly mature or advanced.
• Supply chain management for essential and important entities: 89.91 points, with almost all member states at an advanced level.
• CSIRT maturity (Computer Security Incident Response Teams, national cyber emergency units): 54.76 points, consolidated but uneven across countries.
• Cybersecurity in education: 73.59 points in higher education, but only 55.44 points at primary and secondary level.
• National certification ecosystems: 55.56 points, split between mature and less mature contexts.
• Research and development priorities: 79.24 points, showing growing coherence across the Union.

Since 2024, most member states have also progressed on vulnerability disclosure. The number of countries with a national Coordinated Vulnerability Disclosure policy (a formal system for reporting security flaws) has risen from 7 to 17. AI has industrialized the identification of vulnerabilities, Enisa notes, forcing a strengthening of response capabilities. The agency also cites the World Economic Forum's Global Cybersecurity Outlook 2025, which shows the sector's skills gap widening by 8% compared with 2024.

What happens next?

The report sets out five key directions for the Union, which underpin its policy recommendations: harmonize cross-border and inter-regulatory aspects so entities operating in multiple member states face one coherent framework; adopt an integrated operational capacity for crises; and strengthen the preparedness and resilience of critical infrastructures.

That last goal carries a caveat. Maturity in critical sectors is improving constantly, but progress remains uneven, sector operational realities differ, and AI risks amplifying the exposure gap. Supply chain risks and cross-border dependencies are taking on growing weight, with implications well beyond the technical dimension.

On the regulatory front, the EU is progressing on the main sector rules: the NIS2 Directive (network and information security rules for critical sectors), the Cyber Resilience Act and the Cyber Solidarity Act. Cross-border dynamics and overlapping frameworks are nonetheless pushing Brussels toward legislative simplification and recalibration. Geopolitics and technology have already triggered new initiatives, including the proposal for a Cybersecurity Act 2 and the recent EU Action Plan on Cybersecurity and AI.

The message from Brussels is consistent. The EU has built a foundation, in Enisa's own framing, but the threat is compounding faster than the defenses.