{
  "slug": "eu-cybersecurity",
  "name": "EU Business Cybersecurity",
  "updated": "2026-09-21",
  "page": "https://godofstartups.com/atlas/markets/eu-cybersecurity",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "facts": [
    {
      "metric": "UK micro businesses citing external consultants or providers for cyber security information and guidance",
      "value": "24",
      "unit": "percent",
      "geo": "UK",
      "period": "2025/2026",
      "tier": 1,
      "status": "ready",
      "url": "https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026"
    },
    {
      "metric": "UK businesses without cyber insurance citing lack of budgetary priority as a reason for non-coverage",
      "value": "34",
      "unit": "percent",
      "geo": "UK",
      "period": "2025/2026",
      "tier": 1,
      "status": "ready",
      "url": "https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026"
    },
    {
      "metric": "EU enterprises that applied at least 1 ICT security measure",
      "value": "93",
      "unit": "% of enterprises",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://ec.europa.eu/eurostat/web/products-eurostat-news/w/ddn-20241212-1"
    },
    {
      "metric": "EU enterprises making staff aware of ICT security obligations",
      "value": "59.97",
      "unit": "% of enterprises",
      "geo": "EU27_2020",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://ec.europa.eu/eurostat/api/dissemination/statistics/1.0/data/isoc_cisce_ra?format=JSON&lang=EN&geo=EU27_2020&lastTimePeriod=1&unit=PC_ENT&size_emp=GE10&nace_r2=C10-S951_X_K"
    },
    {
      "metric": "Share of EU enterprises that defined or most recently reviewed their ICT security policy within the last 12 months",
      "value": "21.82",
      "unit": "% of EU27 enterprises",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://ec.europa.eu/eurostat/api/dissemination/sdmx/2.1/data/isoc_cisce_ra/?format=JSON&lang=en"
    },
    {
      "metric": "EU organisations' median share of IT investment allocated to information security",
      "value": "9",
      "unit": "percent of IT investment",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/publications/nis-investments-2024"
    },
    {
      "metric": "EU organisations planning to raise their information security budgets",
      "value": "80",
      "unit": "percent of respondents",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/publications/nis-investments-2024"
    },
    {
      "metric": "EU organisations needing more cybersecurity staff to comply with NIS 2",
      "value": "89",
      "unit": "percent of organisations",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/publications/nis-investments-2024"
    },
    {
      "metric": "EU organisations expecting an increase in cyberattacks in the coming year",
      "value": "90",
      "unit": "percent of entities",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/publications/nis-investments-2024"
    },
    {
      "metric": "EU cybersecurity-role employees lacking formal qualifications or certified training",
      "value": "76",
      "unit": "percent of cybersecurity employees",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/publications/nis-investments-2024"
    },
    {
      "metric": "EU organisations that have not audited third-party vendors for AI-related vulnerabilities",
      "value": "80",
      "unit": "percent of organisations",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/publications/nis-investments-2024"
    },
    {
      "metric": "EU surveyed organisations reporting no measurable improvements from cybersecurity investment",
      "value": "4",
      "unit": "%",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/sites/default/files/2025-12/NIS%20Investments%202025%20-%20Survey%20data%20companion%20document_0.pdf"
    },
    {
      "metric": "EU surveyed organisations reporting faster incident detection after cybersecurity investment",
      "value": "35",
      "unit": "%",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/sites/default/files/2025-12/NIS%20Investments%202025%20-%20Survey%20data%20companion%20document_0.pdf"
    },
    {
      "metric": "EU surveyed organisations reporting improved incident response and recovery after cybersecurity investment",
      "value": "26",
      "unit": "%",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://www.enisa.europa.eu/sites/default/files/2025-12/NIS%20Investments%202025%20-%20Survey%20data%20companion%20document_0.pdf"
    },
    {
      "metric": "EU enterprises experienced any ICT security related incident (unavailability of ICT services, destruction/corruption of data, or disclosure of confidential data)",
      "value": "21.54",
      "unit": "% of enterprises (EU27; enterprises with 10+ employees; NACE Rev.2 sections C-J, L-N and group 95.1, excl. financial sector)",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://ec.europa.eu/eurostat/api/dissemination/statistics/1.0/data/isoc_cisce_ic?format=JSON&lang=EN&geo=EU27_2020&lastTimePeriod=1&unit=PC_ENT&size_emp=GE10&nace_r2=C10-S951_X_K&indic_is=E_SEC2IANY"
    },
    {
      "metric": "Enterprises hit by unavailability of ICT services from a security incident, European Union",
      "value": "19.26",
      "unit": "percent of enterprises",
      "geo": "EU27",
      "period": "2024",
      "tier": 1,
      "status": "ready",
      "url": "https://ec.europa.eu/eurostat/api/dissemination/statistics/1.0/data/isoc_cisce_ic?format=JSON&lang=EN&time=2024&unit=PC_ENT"
    },
    {
      "metric": "How EU enterprises source their ICT security activities: own employees vs external suppliers",
      "value": "68.03",
      "unit": "% of EU enterprises",
      "geo": "EU27",
      "period": "2022",
      "tier": 1,
      "status": "ready",
      "url": "https://ec.europa.eu/eurostat/api/dissemination/statistics/1.0/data/isoc_cisce_ra?format=JSON&lang=en&geo=EU27_2020&size_emp=GE10&indic_is=E_ITSEC3OWN,E_ITSEC3EXT,E_ITSEC3&unit=PC_ENT"
    },
    {
      "metric": "EU enterprises having insurance against ICT security incidents",
      "value": "19.81% in 2019; 24.97% in 2022",
      "unit": "% of EU27 enterprises with 10+ persons e",
      "geo": "EU27",
      "period": "2019-2022",
      "tier": 1,
      "status": "ready",
      "url": "https://ec.europa.eu/eurostat/api/dissemination/statistics/1.0/data/isoc_cisce_ic?format=JSON&lang=en&geo=EU27_2020&size_emp=GE10&nace_r2=C10-S951_X_K&indic_is=E_SECINS&unit=PC_ENT"
    }
  ],
  "note": "status: ready = two or more independent sources or an official series; proxy = one source; context = macro background, not a validation figure."
}