Banking, electricity and telecommunications remain the most mature sectors, with trust services, aviation and financial market infrastructures newly joining that top tier in this edition, while gas, maritime, road transport and health also showed improvement. Manufacturing is one of the sectors this report tracks specifically, and the comparative format - maturity plotted against criticality, sector by sector - gives a manufacturer a genuine benchmark for how its own cybersecurity investment compares with peers, rather than only the standalone compliance checklist a Directive by itself provides. ENISA links the improvements it does find to stronger information-sharing arrangements and the pressure NIS2 and DORA are putting on organisations to formalise risk management, while flagging AI-driven threats and supply-chain exposure as the trends now shaping every sector covered.

Recent progress in advanced LLMs, including Anthropic’s Mythos and increasingly capable open-weight Chinese models, adds a further dimension to ENISA’s warning on AI-driven threats. As powerful models become cheaper, more widely deployable and potentially usable for cyber tasks, governance frameworks designed around identifiable service providers and conventional supply chains may be harder to enforce consistently. For manufacturers, this increases the importance of assessing third-party AI components, model provenance and misuse risks alongside existing NIS2 obligations.

#CyberResilienceAct #EUManufacturing