Proofpoint today announced new research at Web Summit 2026 in Lisbon, revealing a rapidly evolving European threat landscape as phishing activity surges, state-aligned espionage expands, and attackers increasingly target cloud and AI infrastructure.
Proofpoint researchers found that phishing detections increased 4.5x across Europe year over year, compared with 1.5x globally. At the same time, 64% of European organisations targeted by precision cloud attacks showed evidence of successful compromise. These targeted attacks use techniques such as phishing and session hijacking to gain access to specific users and accounts, highlighting their effectiveness compared with broader brute-force attacks.
“Europe’s threat landscape is changing quickly. Phishing and identity-based attacks remain among the most significant risks, but attackers are also expanding to focus on emerging AI infrastructure,” said Ryan Kalember, CSO, Proofpoint. “What’s particularly concerning is the growing volume and sophistication of these attacks, as AI enables cybercriminals to operate at a scale we’ve never seen before. As people and AI increasingly work together, accessing the same systems and sensitive data, organisations need a more comprehensive approach to security that protects against today’s threats while addressing the new risks in the agentic workspace.”
Key findings from the research include:
- Phishing threats are driving greater engagement: European users clicked on 8.3 out of every 100 delivered threat messages, compared with 2.0 globally, highlighting the continued importance of the human layer in cybersecurity.
- Espionage operations are expanding: South Asian threat actors are extending their reach into Western Europe, while Russian and Chinese state-aligned groups continue to evolve their techniques.
- Cloud and AI are creating new risks: Proofpoint identified more than 188,000 AI-enabled applications connected through authentication and OAuth frameworks. The share of European sensors affected by attacks targeting open-source AI technologies increased 4.6 times between consecutive 90-day periods.
- European industries face targeted threats: Malware accounted for 21% of detected threats in European hospitality and leisure organisations, nearly twice the global rate. European healthcare saw callback phishing increase 257% year over year and malware rise 84%.
- Cybercrime is becoming increasingly targeted and localised: Attacks against European transportation and logistics organisations can facilitate cargo theft, while sophisticated phishing campaigns target investors and consumers through financial account takeover attempts and impersonation of trusted organisations, including France’s national health insurance system.
The findings highlight a broader shift in cybersecurity as attackers increasingly target the connections between people, data, and AI, reinforcing the importance of securing these interactions as organisations accelerate AI adoption.