President von der Leyen Must Continue Investing, Improving and Integrating European Cybersecurity and Defence Capabilities

By Chris Hutchins · August 22, 2024

Amid rising geopolitical tensions globally, nation-state actors are increasingly engaged in digital espionage, disinformation campaigns and cyberwarfare against Western institutions – all of which threaten our democracies and weakens our social fabric. In the face of such adversity, Europe must work together to build up resilience and preparedness against the evolving threat landscape.

European Commission President von der Leyen’s political guidelines - setting out her policy priorities for the 2024-229 EU legislative mandate - provides a strong basis for countering escalating cyber and hybrid threats. Her proposal for a European Democracy Shield will be critical in advancing situational awareness to oppose online foreign information manipulation and interference. Trellix’s experience in supporting Ukraine’s government against Russian cyber-attacks has laid bare the fragility of digital infrastructures, and the impact this can have to the wider economy and society when not inadequately secured.

This is why we think it's right that President Von der Leyen's second term agenda prioritises the creation of a European Defence Fund. Increasing investment in Europe’s cybersecurity, whilst reaffirming the role for a renewed relationship between the EU and NATO, is the right course of action. Her calls for a common European cyber defence project, open to all and ready for rapid deployment, recognises that public-private partnerships provide an agile framework to leverage complementary cybersecurity experiences of industry and government. As for the European Cyber Shield and Cyber Reserve, participation and procurement processes should ensure fair competition among providers from the EU and allied nations as trusted partners. Today's digital infrastructures are borderless. Providers with global insights can help protect the ever-expanding attack surface.

However, no single cybersecurity solution is a silver bullet. The next Commission should further examine restrictive software licensing agreements that prevent European businesses and consumers from meaningfully choosing alternative providers. Healthy competition helps to ensure Europe gets the best choice of cyber products and prevents industries and governments from being reliant on a handful of sources for their cybersecurity. This creates single points of failure that are exposed to malfunctions or hacking, with rippling effects across the entire economy.

Vulnerabilities are evident across European SMEs, the beating heart of the EU economy, that remain poorly protected against cyber-attacks, despite the Digital Decade target for them to achieve 90% resilience by 2030. The next Commission could do well to boost financial and non-financial incentives to encourage SMEs to enhance their cybersecurity posture. For example, it could require SMEs to demonstrate an adequate level of cybersecurity in public procurements, establish a 'Cyber4EU' voucher scheme for SMEs, or recognize the US Cyber Trust Mark or create a similar mechanism at the EU level. In order for SMEs to take advantage of the digital transition, they must be safely secured.

EU digital regulations from the last Commission will shape global standards in the next five years and beyond, but only if they draw on industry best practices and are interoperable with international standards. Incident and vulnerability reporting should be globally aligned to avoid confusion and security lapses. Mutual recognition agreements encourage greater global cooperation and coordination to address common threats. This allows cybersecurity providers to focus on making their products safe, rather than on fragmented validation and reporting processes. It enables European cyber providers to expand by accessing new markets, while European industries and governments benefit from a wider range of cybersecurity solutions tailored to their diverse needs, provided by companies from like-minded countries.

While the EU must be clear-eyed about current security and economic risks, including strategic dependencies and supply chain disruptions, it must continue to support international public and private collaboration to serve our shared cybersecurity and defence needs.