ENISA’s 2026 Threat Landscape: Your SaaS Stack Is Part of Your Attack Surface

A small digital business can be secure inside its own accounts and still be disrupted by a failure elsewhere. Its website depends on a host and domain registrar; sales depend on payments, email and analytics; AI workflows may add model providers, connectors, data stores and automation platforms. Each service is useful. Together, they create a chain whose weak or unavailable link can stop the whole workflow.

That is the practical lesson for smaller organisations in the European Union Agency for Cybersecurity’s Threat Landscape 2026, published on 22 September. ENISA says attacks against supply chains, third parties, cloud environments and other digital dependencies continued to produce large-scale or impactful incidents. It also expects AI to support more phases of malicious operations while AI systems themselves extend the attack surface.

This does not mean every connected tool is dangerous or that a small firm should abandon cloud software. It means “our provider handles security” is not a complete resilience plan. Owners need to know which external services keep each critical business outcome alive, what can be recovered, and what the team will do when a provider, account or integration becomes unavailable.

What ENISA’s figures do—and do not—show

ENISA analysed 8,257 incidents recorded from 1 January to 31 December 2025 using open sources, anonymised information shared by EU Member States and information from its Cyber Partnership Programme. In that dataset, distributed denial-of-service attacks represented 51.3% of recorded activity and unauthorised access 39.5%. Phishing accounted for 77.8% of identified social-engineering techniques. Among unauthorised-access incidents where an intrusion vector could be identified, 60.4% involved exploitation of a vulnerability.

The report is a landscape, not a personal risk calculator. ENISA warns that open-source reporting is incomplete, some incidents are reported late, categories can overlap, and visible threats such as DDoS may be recorded more readily than covert espionage. The dataset also covers organisations of many sizes and sectors. A sole trader should not translate a percentage directly into “my probability of attack”.

The value lies in the pattern: attackers reuse access routes, compromised credentials, vulnerabilities and trusted digital environments. An incident can spread through the same interconnected services that make modern work efficient.

Your attack surface includes the relationships between tools

A list of subscriptions is not yet a dependency map. Start with the customer or operational result, then trace every service required to deliver it.

Business outcome	Typical dependencies	Failure question
Take an online order	Storefront, domain, payment provider, fraud checks, email	Can the customer pay, and can the team verify the order?
Deliver a digital product	Checkout, storage, access-control tool, automation, support inbox	Can a legitimate buyer receive access without manual guesswork?
Publish creator content	Account identity, editing tools, media storage, scheduler, platform	Can the creator retrieve assets and communicate elsewhere?
Run an AI workflow	Model provider, API key, connector, source data, logs, human reviewer	Can the process stop safely and continue manually?

Pay special attention to shared foundations. If five workflows use one email account for password resets, that inbox is a critical identity dependency. If every automation uses one integration account, revoking it may halt the business. If a cloud drive synchronises damaged or encrypted files instantly, synchronisation is not the same as a recoverable backup.

AI changes both sides of the security equation

ENISA describes a dual role for AI. Threat groups use it to increase speed, scale, translation and adaptability, while the integration of AI systems into business environments creates additional targets and access routes. The report says synthetic audio, video and AI-generated text have become cost-effective tools in information manipulation, and it expects more phases of the cyberattack chain to become AI-enabled.

For a small business, the immediate lesson is not to buy an “AI security” label and assume the problem is solved. It is to control what an AI tool can reach. An assistant that drafts marketing copy presents a different consequence from an agent that can read customer records, issue refunds, change listings or send messages.

• Give the tool only the accounts and data required for its defined task.
• Use separate credentials for automations rather than a founder’s all-purpose login.
• Record which systems an agent can read, write, delete or trigger.
• Require human approval for payments, permissions, mass communications and irreversible changes.
• Keep activity logs and decide who reviews unusual actions.
• Define a kill switch and a manual fallback before the workflow becomes essential.

AI can also help defenders summarise alerts, classify reports and look for unusual patterns. Those uses still need testing. A missed alert, confident false explanation or overly broad automated response can create its own damage. Measure whether the system improves detection and recovery, not merely whether it produces a polished dashboard.

Build a one-page dependency register

You do not need enterprise governance software to begin. A protected spreadsheet or document can capture the essentials for each critical service:

• Purpose: the business outcome it supports.
• Owner: the person responsible for access and decisions.
• Identity: the login, recovery email and multi-factor method.
• Data: what enters the service and how it can be exported.
• Connections: APIs, plugins, webhooks and other linked accounts.
• Failure impact: what stops after one hour, one day or one week.
• Recovery: backup location, restore method and last successful test.
• Fallback: a temporary manual process or alternative channel.
• Exit: how access, data and integrations are removed.

Review the map after adding or removing a tool, changing a team member’s role, or granting a new integration. The goal is not perfect documentation. It is to avoid discovering during an incident that nobody knows who owns the account, where the data lives or how an automation can be stopped.

Separate availability, security and recoverability

These questions are related but not interchangeable:

• Availability: is the service working now?
• Security: are identities, data and actions appropriately protected?
• Recoverability: can the business restore an acceptable state after loss, corruption or compromise?

A provider can have strong security and still suffer an outage. A service can be available while an attacker controls your account. A backup can exist but fail when restored. Ask providers about authentication, incident notification, data export, deletion, availability commitments and recovery—but keep a recovery plan you can test yourself.

The UK National Cyber Security Centre advises small organisations to back up the data needed to operate, protect online backups with two-step verification, and test that important data can be restored. Its SaaS guidance recommends keeping critical application data in at least one resilient backup so it can be recovered after an outage or destructive attack. “Stored in the cloud” should not be treated as proof that a usable independent recovery copy exists.

Run a four-hour interruption exercise

Illustrative exercise—not a report of an actual business: imagine that your main commerce or creator platform becomes unavailable at 10:00. You cannot access its dashboard, but customers can still contact you.

• Which person confirms whether the problem is internal or supplier-side?
• How do you warn customers without using the unavailable platform?
• Can you see recent paid orders from another trusted record?
• Which fulfilment steps can continue manually?
• Who can pause advertising so it does not send buyers into a broken journey?
• Where are the supplier’s status page, support route and incident reference recorded?
• At what point do you activate the longer-term fallback?

Time the exercise. Note every missing credential, export, contact and decision owner. Then fix the smallest high-impact gap. A tested CSV export and a written customer-update template may deliver more resilience than another monitoring subscription.

Who needs more than a lightweight plan?

A simple dependency register suits a solo creator or small firm with a modest stack and limited sensitive data. More formal risk, legal and technical support becomes appropriate when a business processes large volumes of personal or financial data, operates regulated services, gives software broad production permissions, has contractual uptime duties, or cannot tolerate even a short interruption.

Doing nothing may appear cheaper when every service is working. The trade-off is that the first real incident becomes the discovery process. Buying more tools is not automatically better either: every new control has its own identity, billing, configuration and failure modes. Start by reducing unused access, documenting critical dependencies, enabling strong authentication and proving that recovery works.

The practical trend: resilience is becoming architectural

The ENISA report is not a forecast that every small digital business will face an AI-directed attack. It is evidence that cyber activity increasingly travels through shared services, scalable tooling and trusted environments. As AI becomes another connected layer, resilience depends on architecture: narrow permissions, visible dependencies, independent recovery and a human route through failure.

If your next step is to evaluate a particular platform, MaryChuks.com’s AI software exit test offers a complementary way to examine exports, continuity and lock-in before purchase.

The useful question is no longer only, “Is this tool secure?” It is also, “What else fails when this tool fails—and how quickly can we keep serving people?”

---

Sources and further guidance

• ENISA: Threat Landscape 2026
• ENISA: How dependencies weaken digital resilience
• NCSC: Small organisations guide to cyber security
• NCSC: Backing up your data
• NCSC: Using SaaS securely
• NCSC: AI and cyber security