The Evolving Cyber Threat Landscape and Cybersecurity Regulation in the EU

Over the past decade, cyberattacks have increased significantly in both frequency and complexity and have caused serious financial losses both globally and in the European Union.

The annual cost of cybercrime to the global economy in 2020 is estimated at 5.5 trillion euros; this figure doubled compared with 2015[1]. This upward trend continues, and by 2024 the cost is projected to have reached 9.5 trillion dollars. The evolving cyber threat landscape has made it clear that the critical question for organisations is no longer “Will we be attacked?” but “When will we be attacked?”[2].

Businesses in the EU face significant financial losses because of cyberattacks. For example, in 2023 the average cost of a cyberattack for companies in Europe, while varying by country, ran into hundreds of thousands of euros. The financial costs businesses face generally take the form not only of incident response and system restoration, the immediate consequences of a cyberattack, but also of long-term loss of reputation and customers. In some cases companies can lose all their assets as a result of these attacks.

The use of artificial intelligence (AI) has also expanded attack surfaces and made cyberattacks more sophisticated and effective. As a consequence, it has also increased the cost of cyber defence measures.

Ransomware attacks in particular have had very significant financial consequences. In 2023 the average ransom payment reached 1.54 million dollars, roughly double the previous year’s figure[3].

IBM’s Cost of a Data Breach Report 2023[4] shows that several European countries are among the 10 most affected countries.

Countries and Regions with the Highest Average Cost of a Data Breach (2023):

1. United States: 9.48 million dollars
2. Middle East: 8.07 million dollars
3. Canada: 5.13 million dollars
4. Germany: 4.67 million dollars
5. Japan: 4.52 million dollars
6. South Korea: 3.48 million dollars
7. United Kingdom: 4.21 million dollars
8. France: 4.08 million dollars
9. Italy: 3.86 million dollars
10. South Africa: 2.79 million dollars

In addition, supply chain attacks have increased considerably. The analysis firm Gartner predicted in 2022 that by 2025 45% of organisations worldwide would have experienced attacks on their software supply chains[5].

Rising cyberattacks have brought the concept of cyber resilience, rather than cybersecurity, to the fore for businesses. Accordingly, it is vital for businesses to take the measures necessary to keep operating without interruption during and after a cyberattack. Within this framework, European Union institutions have also developed comprehensive cybersecurity regulations and proactive risk management strategies.

The EU’s New Cybersecurity Regulations: To strengthen cybersecurity and digital resilience, the European Union has put into effect three important regulations differing in subject and scope. These are:

1. The NIS2 Directive: An expanded version of the NIS Directive (Directive on the Security of Network and Information Systems) adopted in 2016. Covering more sectors such as energy, health and transport, it develops a risk-based approach while introducing stricter security measures and incident reporting obligations. It also aims at bringing cybersecurity practices in EU countries into line with legislation and harmonising them with one another and at ensuring cooperation between EU countries.
2. The Digital Operational Resilience Act (DORA): Designed to ensure that banks, insurance companies, investment firms and other financial institutions can withstand and recover from disruptions caused by information technology (IT). It focuses on issues such as IT risk management, incident reporting and the oversight of third-party IT service providers. Through continuous monitoring, regular testing and governance measures, it aims to increase financial market stability and strengthen consumer protection.
3. The Cyber Resilience Act (CRA): Created to ensure that products with digital elements are secure throughout their entire life cycle. By requiring manufacturers to comply with cybersecurity requirements, it aims for devices and software to be designed securely and protected through regular updates. The regulation aims to increase consumer trust, protect the EU market and increase the resilience of the digital ecosystem. Update (October 2026): DORA has applied since 17 January 2025; the deadline for transposing NIS2 into national law expired in October 2024 (in Germany the implementing act entered into force in December 2025); the CRA’s reporting obligations have applied since 11 September 2026 and its main obligations will apply from 11 December 2027.

Effects of the New Regulations and Likely Challenges:

• Growth of the cybersecurity market: Companies should be expected to look for compliance solutions, risk management frameworks and advanced security technologies. In this context, demand will rise for cybersecurity firms in the areas of threat detection, vulnerability management, incident response and compliance automation.
• Rising demand for qualified cybersecurity experts: The need for professionals specialised in cyber risk management, vulnerability management, secure software development and compliance will grow.
• Rising compliance costs: Complying with growing regulation and cybersecurity standards can impose serious financial burdens, especially on small and medium-sized enterprises (SMEs). Elements such as mandatory certification, investment in advanced infrastructure and the hiring of experts may strain business budgets.
• The role of regulators will be critical: National regulators in EU member states ensure the implementation of compliance policies at local level, guide businesses and offer financial incentives that facilitate compliance. Technical support programmes, grants and training initiatives, especially for SMEs, will play a critical role in increasing cyber resilience.

In conclusion:

Although implementing NIS2, DORA and the CRA will require considerable effort and investment, for businesses it will bring long-term benefits such as greater resilience and a stronger cybersecurity infrastructure. As a natural consequence, the trust of consumers, customers and partners will grow, and businesses will thus be able to become more profitable. Businesses that carry out their cybersecurity and risk management investments and practices in a timely and effective way will come out ahead. At the same time, it is very important to develop technical support programmes and projects for financial incentives, particularly so that SMEs can meet the resulting costs and cover their need for expert staff.