# ENISA Threat Landscape Reports for Cryptography **Source**: https://quantumsequrity.com/blog/enisa-threat-landscape **Category**: Compliance & Regulation --- [← Back to Blog](../../blog.html) Compliance & Regulation # ENISA Threat Landscape Reports for Cryptography 11 min read The European Union Agency for Cybersecurity (ENISA) publishes the ENISA Threat Landscape Report once a year, with topical updates between annual publications. The report has been a fixture of European cybersecurity policy since 2013, and over the past five years it has become one of the most authoritative open-source compendiums of threat intelligence available to security teams in Europe. ENISA was established by Regulation (EU) 2019/881 (the Cybersecurity Act). Article 5 of the Act mandates ENISA to assist Member States in preparedness and response and to contribute to a common understanding of threats. Article 9 grants ENISA a market certification role, and Article 18 lays out the agency's role in policy development. The annual Threat Landscape sits within Article 5 and 9 functions. For cryptography teams, the ENISA Threat Landscape is consequential in two ways. First, it sets the European public-sector view of cryptographic threats, which national supervisory authorities use as a reference point under NIS2 Article 21 and DORA Article 9. Second, ENISA publishes specialised reports on post-quantum cryptography that are increasingly cited in procurement, regulatory guidance, and contractual specifications. This article walks through the structure of the annual Threat Landscape, the cryptographic threat themes that have emerged over the past five years, and the specific ENISA outputs on post-quantum cryptography. ## Structure of the Annual Threat Landscape The annual ENISA Threat Landscape is structured around eight prime threat groups, defined consistently across reports for comparison year on year: - malware; - web threats and ransomware; - social engineering threats; - threats against data; - threats against availability and integrity (denial-of-service); - information manipulation; - supply chain compromise; - targeted attacks against specific sectors. The report includes a chapter on threat actors, classifying them as state-sponsored, cybercrime, hacktivists, insider threats, and others. Trend analysis shows year-on-year shifts in volume, sophistication, and target sectors. ENISA bases the report on a combination of open-source intelligence, contributions from Member States and EU institutions, partner organisation feeds (including the EU CSIRT network), and the ENISA Cyber Threat Intelligence platform. The methodology is published as an annex. ## Cryptographic Threats in Recent Reports Cryptographic themes have appeared with increasing prominence in the ENISA Threat Landscape over the past five years. The 2020 Threat Landscape highlighted ransomware operators using cryptography to encrypt victim data and to manage payments. Cryptocurrency wallet seizures and the role of public blockchains in tracing payments became standard topics. The 2021 report introduced "data destruction" as a threat vector, with ransomware operators using cryptographic erasure (overwriting keys rather than data) as an alternative to file deletion. The report described attacks on cryptographic supply chains, including the SolarWinds Sunburst event of December 2020. The 2022 report covered attacks on TLS terminations, supply chain compromises affecting code-signing infrastructure, and the early signs of "harvest now, decrypt later" preparation by state-sponsored actors. The report also highlighted cryptographic weaknesses exploited in IoT devices and the failure of organisations to keep pace with deprecated algorithm migration. The 2023 report explicitly addressed quantum computing as an emerging threat, citing the rapid advances in quantum hardware and the timeline pressure on cryptographic migration. The report referenced ENISA's parallel publication on Post-Quantum Cryptography and recommended that critical infrastructure operators begin migration planning. The 2024 report expanded the post-quantum theme, citing NIST's August 2024 publication of FIPS 203, FIPS 204, and FIPS 205, and discussing the role of CNSA 2.0 and ETSI quantum-safe specifications. The report also identified specific cryptographic vulnerabilities exploited in the wild during the reporting period, including OpenSSL CVE-2023-0286 (X.400 address handling) and protocol-level downgrade attacks. The 2025 report (published in late 2025) treats post-quantum migration as an urgent operational matter, not a research topic, and includes an extended discussion of the EU's Coordinated Implementation Roadmap for the migration to post-quantum cryptography (a Council Implementing Decision adopted in 2024). ## ENISA's Post-Quantum Cryptography Reports In addition to the annual Threat Landscape, ENISA publishes thematic reports on post-quantum cryptography that have become reference documents. In May 2021, ENISA published "Post-Quantum Cryptography: Current state and quantum mitigation," authored by lead cryptographers including Daniel J. Bernstein and other invited contributors. The report covers the mathematical foundations of post-quantum schemes, the NIST PQC project status, and the practical considerations for migration. It is cited extensively in BSI TR-02102-1 and in ANSSI guidance. In October 2022, ENISA published "Post-Quantum Cryptography: Integration Study," addressing the practical engineering challenges of integrating post-quantum algorithms into existing protocols and applications. The study covers TLS, IPsec, SSH, code signing, and PKI scenarios. In April 2023, ENISA published "Cybersecurity policy of post-quantum cryptography in Europe," which surveys Member State approaches and identifies areas for harmonisation. In November 2023, ENISA contributed to the Council Recommendation on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography (adopted by the Member States in 2024), which set Member State obligations to develop national post-quantum migration plans. In 2024 and 2025, ENISA has continued to publish updates on the post-quantum migration, including practical guidance for SMEs and a thematic report on hybrid cryptographic schemes. The references to specific ENISA reports in regulatory guidance under NIS2, DORA, and the EU Cyber Resilience Act mean that ENISA's recommendations carry de facto regulatory weight, even though ENISA itself is not a regulator. ## Threats Against Data The "threats against data" prime threat group in the annual Threat Landscape covers attacks on confidentiality, integrity, and authenticity of data. Cryptographic threats sit at the centre of this category. Data breach trends in recent reports show a steady increase in volume, with the number of records exposed in major breaches reaching new records each year. The 2024 report identified data breaches affecting healthcare, financial services, and public administration as the most consequential. The report also tracks ransomware as a hybrid availability and confidentiality threat. Modern ransomware operators routinely exfiltrate data before encryption to add an extortion lever ("double extortion"). Some operators add public exposure as a third lever ("triple extortion"). The cryptographic mechanisms used by ransomware groups are increasingly sophisticated, with some groups using elliptic curve cryptography, key-derivation hardening, and tamper-evident audit logs to manage their criminal operations. For defenders, the implication is that "data at rest" encryption alone does not address the modern data threat model. Encryption combined with strong access controls, anomaly detection, and rapid incident response is the baseline. Post-quantum migration becomes important for any data with confidentiality lifetimes extending past Q-Day. ## Supply Chain Compromise The supply chain compromise prime threat has been one of the fastest-growing categories. SolarWinds, Kaseya, MOVEit Transfer, the 3CX compromise, and the XZ Utils backdoor (CVE-2024-3094) are all referenced in recent reports. For cryptography, supply chain compromise has two specific dimensions: First, code-signing keys are a high-value target. A compromised code-signing key allows an attacker to sign malicious software that legitimate operating systems and applications will trust. Several recent supply chain incidents involved compromised signing keys, including the 3CX incident. Second, cryptographic libraries themselves are supply chain dependencies. The XZ Utils incident in March 2024 was a near-miss for OpenSSH on Linux: a malicious commit was inserted upstream and would have affected any system updating to the latest XZ release. While XZ is not strictly a cryptographic library, the SSH path it would have compromised relies on cryptographic primitives. ENISA has emphasised in the 2024 and 2025 reports that supply chain risk for cryptographic libraries deserves heightened attention, and that organisations should adopt software bill of materials (SBOM) practices to track cryptographic dependencies. ## How National Authorities Use ENISA Reports National competent authorities under NIS2 use ENISA reports as reference points for "state of the art" determinations under Article 21. The German BSI cites ENISA in TR-02102-1. The French ANSSI cites ENISA in its référentiel. The Dutch Forum Standaardisatie list references ENISA recommendations. DORA-supervised entities use ENISA reports in the Article 6 RTS cryptography inventory and the Article 7 RTS key management requirements. The European Banking Authority and European Securities and Markets Authority cite ENISA in their guidance. The EU Cyber Resilience Act (Regulation (EU) 2024/2847), which applies to products with digital elements, references ENISA technical guidance in its Annex I essential requirements. See [EU CRA Cyber Resilience Act](../../blog/eu-cra-cyber-resilience-act.html) for more. ## Reading the Reports Strategically For a cryptography team, the ENISA Threat Landscape is most useful in three modes. Annual review. Once a year, the team should walk through the prime threat groups, identify which threats are material to the organisation's threat model, and update the risk register accordingly. Cryptographic-specific extraction. The cryptography sections of the report, plus any thematic post-quantum publications, should be cross-referenced against the organisation's cryptographic inventory. Algorithms flagged as state-of-the-art today, transitional, or deprecated should be tracked. Post-quantum migration. ENISA's thematic post-quantum reports are practical migration references. The 2022 Integration Study and the 2024 hybrid cryptography paper are the most operationally useful. For more on planning, see [Hybrid Migration Strategy Step by Step](../../blog/hybrid-migration-strategy-step-by-step.html). For the threat model, see [Harvest Now Decrypt Later](../../blog/harvest-now-decrypt-later.html). ## ENISA's Other Cryptography-Relevant Outputs Beyond the Threat Landscape and post-quantum reports, ENISA publishes: - the Cybersecurity Index, which surveys Member State cybersecurity capabilities and includes cryptography metrics; - guidance on Article 14 NIS Directive (continued under NIS2 Article 23) for incident notification, with cryptographic incident criteria; - the EU Cybersecurity Certification Framework under the Cybersecurity Act (Article 49 of Regulation (EU) 2019/881), with the EUCC scheme and the EU5G scheme covering products with cryptographic functionality; - the Common Criteria assurance levels for cryptographic products; - guidance on cloud cybersecurity, including cryptographic key management. For multinationals operating in the EU, ENISA outputs are the closest the EU comes to a single source of cryptographic guidance, and the patchwork of NIS2 Member State transpositions, DORA RTS, and the EU CRA all converge on ENISA-aligned interpretations. ## Sectoral Cryptography Reports ENISA also publishes sectoral threat landscape reports that drill into specific industries with cryptographic implications. The ENISA Aviation Threat Landscape covers aviation systems including ACARS, ADS-B, the Future Air Navigation System (FANS), and the protocols used for air traffic control communications. Cryptographic concerns include the lack of authentication in ADS-B (which has been a concern since deployment) and the migration plans for satellite-based aviation communications. Aviation has long-lived systems with retrofit cycles measured in decades, making the post-quantum migration particularly acute. The ENISA Telecom Threat Landscape and the EU 5G Toolbox publications address mobile network cryptography. The 5G specifications include support for stronger cryptographic primitives than 4G, but field deployment varies. Post-quantum migration in 5G is a 3GPP topic, with specific work on the cryptographic underpinnings of authentication, integrity protection, and roaming. The ENISA Maritime Threat Landscape addresses ship and port systems, including AIS (Automatic Identification System), ECDIS (Electronic Chart Display and Information System), and the protocols used for navigation and operations. Maritime cryptography has been historically weak; the migration agenda is significant. The ENISA Health Threat Landscape addresses medical device cryptography, electronic health records, and hospital infrastructure. The Medical Device Regulation (Regulation (EU) 2017/745) and ENISA guidance together create cryptographic obligations for connected medical devices. The ENISA Energy Threat Landscape covers grid operators, distribution system operators, and the SCADA/ICS systems that operate critical electricity infrastructure. Cryptographic obligations under NIS2, the Network Code on cybersecurity for the electricity sector (Commission Delegated Regulation (EU) 2024/1366), and ENTSO-E technical specifications all draw on ENISA inputs. ## How to Use ENISA Reports in Compliance Work For a compliance officer or security architect, ENISA reports serve four practical purposes. Calibration. Compare the organisation's threat model with the latest Threat Landscape. Are there threats the organisation has not addressed? Are there threats that have moved up the priority ranking? Justification. When a security control is challenged on cost-benefit grounds, citing the Threat Landscape provides authoritative external support. "ENISA identifies this as a top-three threat in the most recent annual report" carries weight in budget conversations. Procurement. Reference ENISA guidance in supplier evaluation, RFPs, and contractual specifications. Suppliers who can demonstrate alignment with ENISA recommendations on cryptography (post-quantum readiness, key management, incident handling) are easier to defend in audit. Roadmap input. The thematic post-quantum reports provide migration milestones. The annual Threat Landscape provides early warning of emerging threats. ## FAQ **Is the ENISA Threat Landscape legally binding?** No. ENISA reports are guidance, not regulation. But they are heavily cited by national competent authorities and form part of the "state of the art" assessment under NIS2 Article 21 and DORA Article 9. **How often is the Threat Landscape published?** Annually, typically in the autumn. ENISA also publishes interim updates, sectoral reports, and thematic reports between annual publications. **Can I download the report for free?** Yes. ENISA reports are published openly on enisa.europa.eu under a Creative Commons licence. **Does ENISA provide threat feeds?** ENISA operates the EU Cyber Threat Intelligence (CTI) platform, with controlled access for Member State CSIRTs and qualified entities. Open threat intelligence is published in the annual report and in ad hoc bulletins. **Where does post-quantum sit in the reports?** Post-quantum cryptography appears in the 2022 report as an emerging issue, in the 2023 and 2024 reports as a present-day operational concern, and in the 2025 report as an urgent migration matter. ENISA's thematic post-quantum reports complement the Threat Landscape with detailed migration guidance. ## Sources - ENISA Threat Landscape 2024 (October 2024), https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024 - ENISA Post-Quantum Cryptography: Current state and quantum mitigation (May 2021), https://www.enisa.europa.eu/publications/post-quantum-cryptography-current-state-and-quantum-mitigation - ENISA Post-Quantum Cryptography Integration Study (October 2022), https://www.enisa.europa.eu/publications/post-quantum-cryptography-integration-study - Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 (Cybersecurity Act), https://eur-lex.europa.eu/eli/reg/2019/881/oj - Council Recommendation of 11 December 2024 on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, https://eur-lex.europa.eu/ ## Related Articles - [NIS2 Directive Cryptography](../../blog/nis2-directive-cryptography.html) - [DORA Financial Cryptography](../../blog/dora-financial-cryptography.html) - [EU CRA Cyber Resilience Act](../../blog/eu-cra-cyber-resilience-act.html) - [Harvest Now Decrypt Later](../../blog/harvest-now-decrypt-later.html) - [PQC State 2026](../../blog/pqc-state-2026.html) --- ### Protect Your Data Before Q-Day Arrives QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats. [Try QNSQY](../../pricing.html)