The EU spent billions on a cyberattack shield — nobody checked if it worked

The European Union has allocated €1.4 billion to bolster its defenses against cyberattacks. However, an audit by the European Court of Auditors revealed serious concerns regarding the effectiveness of this expenditure. The auditors found that there were no proper checks to ensure that the funds reached organizations vulnerable to interference from hostile states.

According to the auditors, grant recipients are responsible for assessing the ownership and control of third-party entities receiving EU cybersecurity funding, but the European Cybersecurity Competence Centre, which oversees these grants, does not verify these assessments. As a result, critical infrastructure, operational data, and security technologies could be exposed to security risks.

Additionally, the early-warning network for major cyberattacks, known as ATHENA and ENSOC, is still not operational due to delays in procurement and the absence of necessary agreements, cooperation standards, and technical standards. The auditors identified poor information-sharing as the central weakness in the EU's cyber defenses, calling it the "Achilles heel of the entire system."

While the Cyber Blueprint adopted in 2025 clarifies roles and responsibilities during major cybersecurity crises, the formal definition of how the EU's two main cyber networks work together has yet to be established, hampering cooperation between the CSIRTs network and EU-CyCLONe. Furthermore, the auditors flagged duplication between EU bodies monitoring cyber threats, including the European Commission's cyber situation centre and the European Union Agency for Cybersecurity, which already monitor threats and build situational awareness across the bloc.