EU auditors find the cooperation between national CSIRTs and EU-CyCLONe still undefined
The European Court of Auditors examined the years 2022 to 2025 and reported that the EU's two cyber networks have yet to define how they work together, and that the European Cybersecurity Alert System was not operational.
The Watch · Security desk
What happened
- The European Court of Auditors reported that the EU has built a cybersecurity cooperation framework, but that several measures needed for an effective response to significant and large-scale incidents are still incomplete.
- Cooperation between the CSIRTs network of national incident teams and EU-CyCLONe, which supports cooperation during EU-level crises, has not yet been formally defined.
- Two hubs of the European Cybersecurity Alert System that the auditors examined, ATHENA and ENSOC, had not started operating because of procurement delays.
- Recipients of EU cybersecurity grants assess the ownership and control of third parties they fund, and the European Cybersecurity Competence Centre does not verify those assessments.
Why it matters
- Who's exposed exposure An incident that spans several member states and exceeds one country's capacity is exactly the case the EU layer exists for, and the route from the national teams to the EU crisis body has no agreed form yet.
- What it limits constraint Reporting under NIS 2 is not redistribution. National security law limits what a receiving authority can pass on, so a playbook that treats one notification as reaching every peer CSIRT is wrong about what happens next.
- What it costs cost Member states are funding an average of EUR 200 million a year through the Digital Europe Programme while the hubs meant to carry alerts remain in procurement.
- Who's exposed exposure Grant recipients carry the entire third-party ownership check themselves, and the control meant to keep sensitive security information away from non-EU authorities rests on their own assessment.
Next story · Invest · 6h ago
EU leaders ask for new trade tools as the China deficit reaches €1 billion a dayConfirmed3 publishers
The CSIRTs network brings together the national teams that handle incidents. EU-CyCLONe supports cooperation once a crisis is being managed at EU level [4]. The Cyber Blueprint, adopted in 2025, largely clarifies roles and responsibilities for managing major cybersecurity crises, according to the auditors [15].
Even where a route exists, national security law limits what a receiving authority can pass on. National security laws differ, and the updated EU rules, including the NIS 2 Directive, are still being implemented; the auditors said both factors can make it harder for the EU networks to identify threats early and coordinate an effective response [5].
George-Marius Hyzler, the ECA member responsible for the audit, said: "The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should" [16]. He also said: "When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value" [17].
The European Cybersecurity Alert System was not operational at the time of the assessment [6]. It also lacked cooperation agreements, a common classification system and technical standards [8]. Under the 2021-2027 EU budget, EUR 1.4 billion has been allocated to cybersecurity through the Digital Europe Programme, the EU's main source of cybersecurity funding [9]. Across the seven years of that budget, the allocation averages EUR 200 million a year [21].
The audit covered 2022 to 2025 and asked whether EU actions effectively supported the detection of and response to significant and large-scale incidents, with audit missions in Ireland, Greece and Italy [18]. Member states remain primarily responsible for responding, and the EU's role starts when an attack causes major disruption, significant financial losses or substantial harm, or when an incident affects several countries and exceeds the capacity of one member state [19]. Every weakness in the findings is an arrangement, a funding control or a procurement delay. The report cites no individual incident [20].
The auditors also found that the European Commission's cyber situation centre, established in 2022 and largely supported by external providers, partly duplicates capabilities ENISA already has for monitoring threats and building situational awareness [10]. They called for better coordination to reduce that duplication [11].
What to watch
- Publication of a formal arrangement between the CSIRTs network and EU-CyCLONe, and what it commits either side to on timing.
- Closure of the ATHENA and ENSOC procurements, plus the cooperation agreements, classification system and technical standards the alert system lacked.
- Whether the European Cybersecurity Competence Centre starts verifying beneficiaries' ownership and control assessments.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption15
- Hype gap+15
- Incentives
- Not scored
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The European Union's ability to detect and respond to cybersecurity incidents faces significant gaps, particularly in information-sharing and coordination between national and EU-level bodies, according to a report by the European Court of Auditors (ECA).
- [2]
The auditors said the EU has made progress in developing a cybersecurity cooperation framework, but several measures needed to support an effective response to significant and large-scale incidents are still incomplete.
- [3]
Cooperation between the CSIRTs network and EU-CyCLONe has not yet been formally defined.
- [4]
The CSIRTs network brings together national teams responsible for handling cyber incidents; EU-CyCLONe supports cooperation during EU-level cyber crises.
- [5]
Information-sharing is affected by differences in national security laws and the ongoing implementation of updated EU cybersecurity rules, including the NIS 2 Directive; according to the auditors, these factors can make it harder for EU networks to identify threats early and coordinate an effective response.
- [6]
The audit found that the European Cybersecurity Alert System was not operational at the time of the assessment.
- [7]
Two hubs examined by the auditors, ATHENA and ENSOC, had not started operating because of procurement delays.
- [8]
The European Cybersecurity Alert System lacked several elements needed for operation, including cooperation agreements, a common classification system and technical standards.
- [9]
Under the 2021-2027 EU budget, EUR 1.4 billion has been allocated to cybersecurity through the Digital Europe Programme, the EU's main source of cybersecurity funding.
- [10]
The European Commission's cyber situation centre, established in 2022 and largely supported by external providers, carries out work that the auditors said partly duplicates existing capabilities at ENISA, including monitoring threats and developing cybersecurity situational awareness.
- [11]
The auditors called for better coordination to reduce duplication and strengthen the overall effectiveness of the EU's cybersecurity framework.
- [12]
Grant beneficiaries are responsible for assessing the ownership and control of third parties receiving financial support, but the European Cybersecurity Competence Centre does not verify those assessments.
- [13]
The ECA warned that the unverified assessments could expose sensitive infrastructure, operational data and security-critical technologies to security risks.
- [14]
The checks on organisations receiving EU cybersecurity funding are intended to reduce risks linked to intrusion or influence by non-EU states and to prevent sensitive security information from being shared with non-EU authorities.
- [15]
The Cyber Blueprint, adopted in 2025, largely clarifies roles and responsibilities for managing major cybersecurity crises.
- [16]
"The EU has made progress in building a cybersecurity cooperation framework, but it is not yet working as effectively as it should," said George-Marius Hyzler, the ECA Member responsible for the audit.
- [17]
"When a serious cyber incident occurs, timely and actionable information is essential. Without it, networks and mechanisms lose much of their added value," said George-Marius Hyzler.
- [18]
The audit covered the period from 2022 to 2025 and assessed whether EU actions effectively supported the detection of and response to significant and large-scale cybersecurity incidents; audit missions were conducted in Ireland, Greece and Italy.
- [19]
Member states remain primarily responsible for responding to cybersecurity incidents; the EU has a role when attacks cause major disruption, significant financial losses or substantial harm, or when incidents affect several countries and exceed the response capacity of a single member state.
- [20]
The reported ECA findings consist of incomplete arrangements, unverified funding controls, duplicated bodies and procurement delays; no individual cyber incident is cited among them.
- [21]
The EUR 1.4 billion cybersecurity allocation averages about EUR 200 million a year across the 2021-2027 budget period.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comEU Auditors Warn Information-Sharing Gaps Are Hindering Cyber Incident Response
1 article · September 23, 2026
- thecyberexpress.comEU Cybersecurity Response Hampered by Critical Information Gaps
1 article · September 21, 2026
Topics and entities
Topics
- Threat information sharing
- Cyber incident response
- EU cybersecurity policy
Entities
- European Cybersecurity Competence Centre
- George-Marius Hyzler
- European Court of Auditors
- European Commission
- Digital Europe Programme
- European Cybersecurity Alert System
- ENISA