ENISA NIS360 2026: Progress Across the Board, But the Sectors That Matter Most Are Still Falling Short

ENISA's NIS360 2026 finds overall cybersecurity maturity in EU critical sectors is improving but unevenly; banking, electricity, and telecommunications remain the most mature while health, rail, maritime, ICT service management, space, public administrations, and drinking/waste water sit in a 'risk zone' where criticality exceeds maturity. The report credits legislation, political attention, and better information sharing for progress, warns that AI, supply-chain risk, and geopolitical volatility are accelerating threats faster than defenses, and notes sector-specific issues such as hospitals' legacy systems and limited asset tracking and the space sector's wide maturity variation.