In the last 16 months, nearly 70% of Europe's ransomware activity was concentrated in Germany, the United Kingdom, France, Italy, and Spain.

Germany reported 370 ransomware incidents (17.9%), the United Kingdom reported 347 (16.8%), France repored 255 (12.3%), Italy reported 240 (11.6%), and Spain reported 203 (9.8%) among ransomware incidents across Europe.

Understaffing in European cybersecurity roles is 48%, which is 14 percentage points higher than in the rest of the world.

Across organizations in Europe, GitHub and Microsoft OneDrive are the most abused platforms for malware distribution, each impacting 10% of organizations.

89% of users in Europe are interacting with AI applications that rely on user data for training.

Across organizations in Europe, LinkedIn is the most commonly used personal app at 89%, followed by Google Drive at 84% and ChatGPT at 82%.

In Europe, 59% of data policy violations across AI and personal cloud applications involve regulated data.

About 99% of organizations in Europe use AI.

64% of users are using AI applications directly, while an even larger share (95%) are using applications that incorporate AI-powered features indirectly in Europe.

In Europe, 15% of data policy violations across AI and personal cloud applications involved source code.

In Europe, 13% of data policy violations across AI and personal cloud applications involved intellectual property.

The share of users who switch between personal and enterprise accounts grew from 7% to 15% in Europe.

In Europe, Individual user AI adoption increased from 35% to 65%.

In Europe, 12% of data policy violations across AI and personal cloud applications involved passwords and API keys.

86% of IT decision makers in Europe are concerned about the impact of cyberwarfare on their organization as a whole.

71% of European IT professionals believe the cyber capabilities of nation-state 71% actors have the potential to instigate a full-scale cyberwar that could cripple critical infrastructure worldwide.

North America was the most affected region by ransomware in March 2026, accounting for 55% of reported incidents, followed by Europe at 24% and APAC at 12%.

43% of respondents across Europe say that the cyberwarfare threat is imminent and that they have had to report an act of cyberwarfare to authorities.

On average, 2.8 follow-up DDoS attacks occured after an initial incident, an 80% increase compared to the previous year.

The number of documented DDoS attacks in the Link11 network rose by 75% in 2025, after a 137% increase the previous year.