“Europe has many of the right structures in place. Now they need to function as a system.”
Europe has significantly expanded its cybersecurity architecture in recent years. National authorities, the CSIRTs Network, EU-CyCLONe, ENISA and other European mechanisms are creating structures for information sharing, preparedness and crisis response.
However, a strong institutional architecture does not in itself guarantee a strong joint response. In its Special Report 19/2026, the European Court of Auditors also concludes that existing mechanisms have not yet realised their full potential, partly due to limited information sharing.
Toon, Europe now has numerous institutions and mechanisms for cybersecurity. Why is this architecture alone not sufficient?
Toon Kockx: Institutions and clear responsibilities are an important foundation. But in an emergency, resilience is not determined by an organisational chart.
The crucial question is whether information, decisions and response measures can actually flow between the actors involved. Do organisations know who they need to inform? Are there common escalation procedures? And can different actors develop a shared situational picture quickly enough?
Europe increasingly possesses the building blocks of a collective cybersecurity capability. Now these building blocks must also function as a system.
Information as part of resilience
Cybersecurity is often discussed in terms of technical protective measures: secure architectures, monitoring, vulnerability management or incident response. However, in the event of a cross-border incident, a further dimension comes into play.
What do you mean by ‘coordination capability’ in this context?
Toon Kockx: It is not a question of every piece of cybersecurity information being automatically shared with everyone. Much of this information is too sensitive for that, and there are legitimate national, legal and organisational boundaries. What is crucial, rather, is this: do we have clear rules, trusted channels and established procedures to ensure that the right information reaches the right people quickly enough?
Cyber incidents do not respect administrative boundaries. A vulnerability at one provider can affect organisations in several countries. A technical observation made by a national team may become relevant to other Member States shortly afterwards. That is why, before a crisis strikes, we need to know which events are escalated, who informs whom, and when a local incident becomes a matter for European coordination.
Coordination must be practised before a crisis strikes
European exercises such as Cyber Europe 2026 demonstrate just how important these transitions are. More than 5,000 participants took part in the exercise, practising how to deal with large-scale cyber incidents in interconnected European transport systems.
What role do such exercises play?
Toon Kockx: A very significant one, because it is very difficult to establish coordination for the first time during a real crisis.
Organisations need to know in advance which channels to use, where responsibilities lie and how information is shared between technical teams, national authorities and European structures. The interfaces are particularly important here: does a technical detection actually lead to the correct escalation? Is a national analysis incorporated into a European situational picture? Can insights from one sector help to identify risks in another?
The strength of individual actors is not enough if their processes, terminology or information flows are not compatible.
Shared infrastructure reduces friction
In addition to processes and exercises, shared technical infrastructure can also facilitate coordination. One example is ENISA’s CRA Single Reporting Platform, through which manufacturers report certain actively exploited vulnerabilities and serious incidents involving products with digital components.
What lessons can be drawn from this for European cooperation?
Toon Kockx: The platform does not, of course, solve all the challenges of information exchange. But it illustrates an important principle: if Europe establishes shared obligations, it should also provide the infrastructure that enables organisations to fulfil them efficiently and consistently.
Shared mechanisms, clear processes and interoperable information flows reduce uncertainty and help ensure that relevant information reaches the right places more quickly. This is important even beyond the scope of regulatory reporting. The more interconnected our systems are, the more interconnected our resilience mechanisms must also be.
From organisational resilience to European capacity to act
For individual organisations, traditional questions remain central: Is there an incident response plan? Have responsibilities been defined? Can systems be restored?
At European level, however, another dimension comes into play: can an incident detected in one place be understood quickly enough elsewhere? Can several authorities develop a shared situational picture? Do escalation mechanisms work effectively across sectors and national borders?
What does this capacity for coordination have to do with digital sovereignty?
Toon Kockx: Digital sovereignty is not merely a question of which technologies or infrastructure we control. It is also demonstrated by whether our institutions are actually capable of taking action when under pressure.
A European cybersecurity framework can be very comprehensive in institutional terms. However, if, in an emergency, it fails to produce a shared situational picture and a coordinated response quickly enough, its practical impact remains limited.
Trust-based networks, clear escalation procedures, interoperable reporting mechanisms and well-rehearsed cooperation, on the other hand, enhance Europe’s ability to respond effectively. For me, that is sovereignty through capability.
Coordination is key
Europe does not need to ensure that every Member State reacts identically to every cyber incident. Nor should every piece of information be automatically shared at European level. National competences, security interests and legal boundaries will remain part of the system.
What is crucial is that these boundaries continue to function even under pressure: what information must cross them? Through which mechanisms? Under what conditions? And who bears responsibility at what stage?
