Europe connected cyber defence without centralising every network
A cyber incident can cross a border before a public authority has finished naming it. The same software supplier can sit inside hospitals, ports, railways and public administrations in many countries; a compromised service provider can spread one failure through an entire market. Europe answered that reality by building a system in which national technical teams, crisis authorities and European institutions can exchange evidence, form a common picture, exercise together and request reinforcement. That shared capacity is an achievement Europeans should recognise.
The system is deliberately distributed. A national or sectoral computer security incident response team—usually called a CSIRT—still handles technical work close to the affected networks. National cyber-crisis authorities manage consequences inside their countries. EU institutions have CERT-EU. Europol's European Cybercrime Centre supports law-enforcement work. The European Union Agency for Cybersecurity, ENISA, connects and strengthens these communities but does not become a remote administrator for every server in Europe.
ENISA and the technical CSIRTs Network
ENISA was established in 2004 and received a permanent mandate through the 2019 Cybersecurity Act. Its role combines policy support, capacity building, threat knowledge, exercises, operational cooperation and European cybersecurity-certification work. That mix matters. A continental security system needs more than an emergency telephone: it needs trusted relationships, comparable procedures, skilled people, tested communication and common evidence before a crisis begins.
At the technical level, the CSIRTs Network connects the CSIRTs appointed by EU member countries with CERT-EU; the European Commission participates as an observer. The first Network and Information Security Directive established it, and NIS2 strengthened it. Members exchange information, coordinate responses, assist one another and support coordinated disclosure when a vulnerability could significantly affect more than one country. ENISA provides the secretariat, infrastructure and active coordination support when requested.
Trust is infrastructure here. Incident responders can share indicators, technical artefacts, mitigation experience and an assessment of what is spreading without publishing every sensitive detail to the world. Years of meetings and exercises create the confidence to make that exchange useful under pressure. The network does not erase national-security limits, confidentiality duties or the affected organisation's responsibility. It creates a channel where parallel national investigations can become one faster European understanding.
EU-CyCLONe connects crisis authorities
Large incidents also need an operational layer above packet traces and malware samples. EU-CyCLONe—the European cyber crisis liaison organisation network—brings together the national authorities responsible for cyber-crisis management. It began in 2020 and was formalised when NIS2 entered into force in January 2023. Its job is shared situational awareness, impact assessment, coordinated management and support for political decision-making when an incident is large, cross-border or capable of becoming a wider crisis.
This produces a three-level logic. CSIRTs cooperate on technical response. EU-CyCLONe connects the authorities managing national and cross-border consequences. Political crisis arrangements can then act on a more coherent European picture. ENISA supports the information flow between those layers and works with CERT-EU, Europol, the European External Action Service, Commission services and others. The architecture is not perfectly simple, but its division of roles is more credible than pretending one organisation can investigate code, command emergency policy and prosecute offenders at once.
Cyber Europe turns plans into practice
Exercises turn an institutional diagram into muscle memory. Cyber Europe has been running since 2010. Its eighth edition, on 10 and 11 June 2026, simulated escalating attacks on Europe's interconnected rail and maritime systems. ENISA worked with more than 100 experts to bring together over 5,000 participants from national agencies, EU and EFTA public bodies, EU entities and the private sector. They had to share information across technical, operational and political levels while keeping essential transport services in view.
That scale is worth pride because it rehearses dependencies Europe actually has. A port combines logistics platforms, industrial control, customs, energy, telecoms and global carriers. Rail combines signalling, ticketing, operations, communications and legacy equipment. A scenario that forces teams to test escalation and continuity across countries is public infrastructure, not conference theatre. ENISA still has to evaluate the exercise and publish lessons; participation alone is not proof that every weakness was solved.
NIS2 supplies the common legal floor
The legal floor around this cooperation is NIS2. It extends cybersecurity risk-management and incident-reporting duties across a broad set of essential and important sectors, strengthens national supervision and gives the cooperation networks a clearer basis. Implementation remains national, and uneven transposition, staffing and enforcement can weaken a common system. A directive can require doors to connect; it cannot instantly equalise every country's capability behind them.
The Cyber Solidarity Act adds hubs and reinforcement
The Cyber Solidarity Act, Regulation (EU) 2025/38, adds another layer. It entered into force on 4 February 2025 and creates a European Cybersecurity Alert System made from national and cross-border cyber hubs, a Cybersecurity Emergency Mechanism, mutual-assistance support and a post-incident review mechanism. The hubs are intended to use advanced analytics to detect and exchange warnings. They are being built and expanded; describing the legal architecture does not mean every planned hub or data flow is already fully operational.
A reserve of trusted incident-response services
The Emergency Mechanism makes solidarity practical in three ways. It can support preparedness testing for critical sectors, reimburse or support mutual assistance between countries, and create an EU Cybersecurity Reserve. The Reserve consists of incident-response services procured from trusted managed-security providers. A member country's crisis authority or CSIRT can request support, and CERT-EU can request it for EU institutions. It complements national capacity; it is not an automatic European takeover of an affected company.
ENISA was entrusted with administering and operating the Reserve under a Commission contribution agreement signed in August 2025. The Digital Europe work programme allocates €36 million to the Reserve's response and reporting capability. Trusted providers undergo procurement and ownership-control checks. Cyber Europe 2026 tested the activation procedure for the first time. That is a genuine step from legislation toward operating capability, while the result still depends on available contracts, rapid decisions, access to the affected environment and cooperation from national authorities and operators.
Detection, institutions and product security
European cyber hubs add a detection ambition alongside response. The Commission's model combines national hubs with cross-border consortia that share threat information and analytical capability. Digital Europe funding and joint procurement can help smaller countries reach tools and scale that would be expensive to reproduce alone. Sensitive data, interoperability, false positives, supply-chain trust and the willingness to share useful information remain the hard engineering and governance tests.
CERT-EU keeps an important boundary clear. It is the cybersecurity service for EU institutions, bodies, offices and agencies, while national CSIRTs serve their own legal remits. Europol's cybercrime centre addresses criminal investigation and law-enforcement coordination. ENISA supports cybersecurity resilience and cooperation; it is not a police force and does not attribute every attack. Shared security becomes stronger when operational response, institutional protection, criminal investigation, diplomacy and defence cooperate without pretending to be interchangeable.
The European method also reaches products and services before an incident. Under the Cybersecurity Act, ENISA supports European cybersecurity-certification schemes. NIS2 governs organisational risk and reporting across covered sectors, while the Cyber Resilience Act adds security obligations for products with digital elements on its own phased timetable. These laws are different layers. A certificate, compliant product or reported incident does not guarantee immunity from attack; the achievement is a common framework in which evidence and responsibility can travel.
Cybersecurity protects Europe's shared infrastructure
This shared system protects infrastructure that Europe has already built together. GÉANT carries research and education data across borders. Europe's interconnected electricity system coordinates physical power through common networks. Galileo, 112 and eCall, and the civil-protection mechanism all depend on trustworthy digital services. Cybersecurity is not a separate prestige project; it is the maintenance layer of a connected European society.
Limits, accountability and the next test
The limitations are material. National capability and incident-reporting cultures vary. Specialist staff are scarce, and ENISA's own planning documents describe pressure from expanding statutory tasks. Critical systems still depend on global software, cloud, chips, telecoms and security vendors. Information can arrive late or in incompatible formats. Classification and national-security rules can obstruct sharing. A common network reduces fragmentation; it does not abolish technical debt, procurement risk or geopolitical dependence.
Accountability matters as much as speed. Incident data can reveal vulnerabilities, commercial secrets, personal data or intelligence. The system needs necessity, proportionality, access controls, audit trails and clear decisions about who may act. Post-incident review under the Cyber Solidarity Act can help turn failure into European learning, but only if reports are candid enough to change procurement, architecture and readiness rather than becoming ceremonial reassurance.
A practical form of digital sovereignty
Europeans can be proud of what already exists: a permanent agency, national teams connected through a technical network, crisis authorities connected at operational level, an institutional CSIRT, common exercises, common reporting rules and a funded route to mutual reinforcement. No member country had to surrender its networks or emergency authority to make that possible. Europe pooled the layers where speed, scale and shared awareness are more valuable than isolated control.
That is digital sovereignty in a practical form. Sovereignty is not a slogan that every component must be European and every incident solved centrally. It is the capacity to understand threats, set rules, train together, mobilise trusted expertise and keep essential services running when dependencies are tested. Europe's next task is to finish the hubs and Reserve, close national capacity gaps, secure supply chains and publish evidence that cooperation changes outcomes. The foundation is already an achievement: when a cyber crisis crosses borders, Europe no longer has to meet it as twenty-seven strangers.