ENISA Threat Landscape 2026: Detect Attackers Beyond the Point of Entry
The ENISA Threat Landscape 2026 report analysed 8,257 incidents recorded between 1 January and 31 December 2025, drawing on open sources and anonymised information shared by EU Member States and members of the ENISA Cyber Partnership Programme. The findings highlight recurring threats across the EU, including vulnerability exploitation, social engineering and attacks on interconnected digital ecosystems.
For security teams, the challenge extends beyond preventing initial access. They need to identify malicious activity as early as possible, while an intrusion is developing and before an attacker reaches valuable assets.
This is where a Preemptive Approach to security becomes relevant. Advanced Deception can complement existing controls by creating additional detection opportunities through interactions with deceptive assets.
What ENISA Found in 2025
The report identifies several trends that shape the work of security teams:
Unauthorised access accounted for 39.5% of recorded incidents.
Among unauthorised access incidents for which ENISA identified an intrusion vector, 60.4% involved vulnerability exploitation. However, ENISA could identify the intrusion vector for only 5.2% of unauthorised access incidents. The 60.4% figure therefore applies only to this subset, not to all unauthorised access incidents.
Phishing remained a prevalent social engineering technique.
Phishing accounted for 77.8% of the social engineering techniques recorded by ENISA. The report also highlights phishing kits, Phishing-as-a-Service and ClickFix, which can trick users into executing malicious code themselves.
Third-party providers remained targets.
Attackers continued to compromise software, repositories, browser extensions and digital service providers. These compromises can expose multiple organisations that rely on the affected providers, extending the potential impact beyond the initial breach.
Different threat groups increasingly use similar methods.
Cybercriminals, hacktivists and state-linked groups have different objectives, yet ENISA observed recurring similarities in their tools, access methods and operational techniques. This means that the techniques observed during an attack may not, on their own, reveal the threat actor's identity or ultimate objective.
Together, these trends underline the importance of detecting and investigating activity inside an environment, including after an attacker has gained initial access.
Why Detection Must Extend Beyond Initial Access
Preventive controls reduce the opportunities available to attackers. Vulnerability management, access controls, endpoint protection and network security remain important parts of an effective security strategy.
However, gaining access is not necessarily the end of an intrusion. An attacker may continue exploring systems, searching for credentials, identifying valuable resources or attempting to move deeper into the network.
Detecting these activities early gives defenders an opportunity to investigate and respond before an attacker reaches critical assets or achieves their objective. Advanced Deception complements existing security controls by placing realistic decoys within the environment and making interactions with those assets detectable.
Advanced Deception: Detect Attackers from Reconnaissance Onward
LABYRINTH’s Advanced Deception creates opportunities to detect intruders during reconnaissance and subsequent attack activity, provided they encounter and interact with deployed deception elements. The precise stage at which detection occurs depends on the attacker's actions and the placement of those elements.
The technology uses realistic decoys that mimic network assets, including servers, web interfaces, databases, file shares, mail services and OT/SCADA systems. These decoys are designed to fit into the surrounding environment and attract attention from attackers searching for useful resources, credentials or paths to advance their operations.
When an attacker interacts with a decoy, LABYRINTH generates an alert with contextual information that can help security teams investigate the activity, including available evidence about the source of the interaction, tools used and actions taken.
Unlike detections that depend on identifying a known indicator of compromise, deception-based alerts are triggered by interaction with assets that should not attract legitimate activity. This gives security teams an additional way to identify suspicious activity while the intrusion is still developing, provided the attacker encounters and interacts with the deployed deception elements.
From Early Detection to Actionable Evidence
Early detection is most valuable when it gives analysts enough context to investigate and respond. LABYRINTH's Advanced Deception provides contextualised alerts that can help analysts examine attacker activity and determine the appropriate response.
The technology can work alongside existing security tools, including SIEM, EDR and XDR, allowing deception-related alerts and contextual evidence to support established investigation and response workflows.
By examining the interaction and its context, security teams can build a clearer picture of attacker activity and use their findings to inform incident response. Advanced Deception therefore adds a detection layer to existing defences rather than replacing preventive controls or other security tools.
What the ENISA Report Means for Security Teams
The ENISA Threat Landscape 2026 report highlights the continuing challenges posed by vulnerability exploitation, phishing, third-party compromises and overlapping techniques across different threat groups.
These trends reinforce the need to look beyond the initial point of entry and identify suspicious activity as an intrusion develops. LABYRINTH Advanced Deception supports this by turning interactions with deployed decoys into high-confidence detection signals backed by contextual evidence.
By helping security teams identify malicious activity at an earlier stage, Advanced Deception creates more opportunities to investigate and respond before an intrusion reaches its intended objective.
Shift Preemptive. Defend with Advantage.
Resources:
