Europe Fails to Keep Pace with Rising Cyber Threats

Nearly two in five European IT and cybersecurity professionals (39%) report their organisations are facing more cyberattacks compared to last year, according to new ISACA research.

Despite the surge, confidence in readiness is shaky. Based on the research, fewer than two in five (38%) feel fully confident their organisation can effectively detect and respond to attacks.

As threats grow in both scale and complexity, the burden on professionals continues to mount. Nearly two-thirds (65%) cite the increasingly complex threat landscape as a significant source of stress.

“While organisations are starting to acknowledge the problem and take steps to address long-standing issues in budgets and staffing, the pace of change is still far too slow. The reality is that cyber criminals are moving faster than most organisations can respond. Now is the time to invest in investing in a more holistically trained cybersecurity workforce, an investment towards customer trust and in gaining competitive advantages, not just a reactive move following an incident,” said Chris Dimitriadis, Chief Global Strategy Officer at ISACA.

Rising stress amid budgets and staffing

While budgets and staffing have inched upward, they are not keeping pace with demand. More than half (58%) of respondents still say their organisation is understaffed — a marginal three-point improvement over last year. Funding tells a similar story, although the proportion who say their organisation is underfunded has fallen slightly from 58% in 2024 to 54%.

Incremental progress suggests organisations are beginning to prioritise cybersecurity, but the pace lags behind the escalating risks. For frontline staff, the strain is evident as more than two-thirds (68%) say their jobs are more stressful than five years ago, unchanged from last year.

Workplace pressures exacerbate the issue. Over half (54%) cite unrealistic expectations or workloads, 48% point to poor work-life balance, and over a third (36%) report insufficient training or skills within their teams. Alarmingly, 22% of organisations have taken no steps at all to address or prevent burnout.

Retention and recruitment challenges

Talent gaps continue to undermine resilience. More than half of organisations (52%) struggle to retain cybersecurity professionals, while almost one in five (19%) report unfilled entry-level roles requiring no prior experience. Even these can take three to six months to fill, according to 45% of respondents.

Rigid hiring practices are part of the problem. While 55% still consider a university degree important, far more value professional credentials (84%) and hands-on training (73%). Broadening recruitment pathways and offering practical training opportunities could strengthen talent pipelines.

“To build resilience and keep pace with the evolving threat landscape, we must widen the pathways into cybersecurity. By valuing hands-on training, professional credentials and transferable skills, organisations can strengthen their teams and ease the pressure on overstretched professionals. But recruitment is only the start; continuous training and upskilling are critical. That is how we move from slow, incremental change to real progress, reducing stress and building long-term protection.” Dimitriadis added.

Cybersecurity and AI

Despite staffing shortages, cybersecurity teams are playing a central role in AI governance and implementation. More than half (51%) have contributed to AI governance frameworks — up sharply from 36% last year — while 46% are directly engaged in AI deployment, nearly doubling from 27%.

AI is already integrated into daily operations, supporting threat detection (29%), endpoint security (28%), and routine automation (27%). These trends highlight not only the pace of adoption but also the urgency for stronger AI security regulation and continuous upskilling, especially as Europe advances the EU AI Act and NIS2 and the UK prepares its own legislation.