EU Cyber Defences Blinded by Reluctant Data Sharing, Auditors Warn

The European Union's financial watchdog, the European Court of Auditors, has delivered a sharp verdict on the bloc's digital shields: poor data sharing is actively undermining EU cyber defences. According to the auditors, while the EU has built a network of agencies and policy frameworks to combat digital threats, the flow of vital information between national capitals and European institutions remains stubbornly restricted. Rather than pooling intelligence to spot coordinated attacks early, member states and agencies continue to hoard threat data, leaving systemic vulnerabilities unaddressed across the continent.

Cyber threats do not respect national borders, but European security architecture still largely relies on national capitals choosing to talk to one another. When a member state or an EU agency suffers a breach or detects a new attack vector, withholding that information leaves every other European entity exposed to the exact same threat. For citizens and businesses, this operational silence increases the risk of disrupted infrastructure, compromised personal data, and unmitigated security breaches. Pooling threat intelligence costs virtually nothing in hardware, but requires political trust—a currency that remains notoriously scarce when national security services are asked to open their files.

In Brussels, the European Court of Auditors plays the role of the institutional candid friend: the independent body tasked with checking whether EU initiatives actually deliver what they promise on paper. This report hits a sensitive nerve in the EU bubble, where national sovereignty regularly collides with collective defence. Member states are routinely eager to pass ambitious legislation calling for European cyber resilience, yet deeply hesitant to share real-time threat telemetry with Brussels or their neighbours. The result is a classic Brussels paradox: a sophisticated architecture of regulatory frameworks and cyber agencies operating with only a fraction of the data required to function effectively.

The auditors' findings now go to the European Parliament and the Council of the EU, where ministers and lawmakers will examine the shortcomings. While auditor reports do not carry the legal force to compel member states to overhaul their intelligence-sharing habits overnight, they place direct pressure on the European Commission to tighten reporting requirements in upcoming policy reviews. Commission officials are likely to use these conclusions to push for stronger data-sharing mandates, even as national security agencies push back to protect their domain.