ENISA

ENISA's 2026 threat landscape, based on 8,257 incidents in calendar 2025, assesses that AI will highly likely increasingly support malicious operations and that 2026 will likely see more kill-chain phases directly enabled by AI, with possible human-out-of-the-loop proofs of concept. It notes AI applications becoming targets where they hold files, credentials, sessions or development environment access.

The Commission presented an action plan responding to advanced AI models that can both improve and undermine cybersecurity. It plans an EU capacity to evaluate AI models, a European blueprint for structured access to advanced AI capabilities developed with ENISA, a secure ENISA-JRC platform to test AI for cybersecurity, AI-assisted vulnerability fixing, and a campaign to secure critical open-source software. ENISA published its own recommendations for the frontier AI era the same day.