GÉANT's first European R&E threat report: AI scales attacks, basic controls lag

GÉANT published its first dedicated research and education threat report on 16 September 2026, drawing on European NREN security specialists. The report lists ten priority threats and finds that AI is scaling attacker operations while missing basic controls remain the main path to initial access.

GÉANT's first sector report

On 16 September 2026, GÉANT released 'The Research & Education Threat Landscape 2026: What security leaders need to know', the first threat assessment written specifically for European research and education networks. The paper gathers judgments from national research and education network security specialists, sets out ten priority threats, and records mitigation advice.

GÉANT senior security engineer Roderick Mooi said attacker methods are scaling with artificial intelligence, yet the most common route to initial access is still the absence of basic controls rather than a new class of intrusion technique.

AI as an amplifier

The report treats AI as an amplifier of attacker capability, not only as a separate threat category. Mooi pointed to four effects.

Phishing volume. Deepfake and related tools let operators produce tailored, convincing messages in bulk. That capacity used to sit with a small set of well-funded groups.

Malware authoring. Custom malware is easier to produce, so skills that once stayed with high-end operators are spreading.

Speed. Automation shortens the time from first intrusion to attacker objectives.

Vulnerability discovery. Attackers and defenders both use AI to find flaws, which changes the pace of disclosure and repair.

AI use inside institutions adds risk of its own. Mooi highlighted vibe coding, in which staff generate code with large language models without understanding the security meaning of the output, and unmanaged AI tools that can leak sensitive data. The report calls for mandatory AI-use policies and AI impact assessments so organizations can limit leakage and still permit responsible use.

Quantum collection and geopolitics

Two further external risks are flagged.

Harvest-now, decrypt-later activity tied to quantum computing. Some views hold that cryptographically relevant quantum computers may be practical in five to ten years. Attackers already steal and store ciphertext until decryption becomes possible. Mooi advised institutions to inventory cryptographic assets now, set migration order by whether decryption in three to five years would cause real harm, and move toward post-quantum algorithms on that schedule.

Geopolitics is showing up in supply and infrastructure. The AI race has produced GPU and memory shortages and higher device prices. Internet service providers are increasingly treated as critical infrastructure and are being attacked, which weakens the environment that research and education networks need in order to operate.

Basic controls as the main entry path

A central finding is that failures in cyber hygiene, including patch management and credential management, are the primary way attackers obtain initial access.

Mooi said the cause should not be reduced to user error. Security teams lack staff and run overloaded, so patches wait, unapproved shadow IT appears, and account controls fail.

The report argues for user-centred security practice in place of blaming users, for zero-trust designs that include security from the start, and for enough people and budget so defenders can manage vulnerabilities and protect staff, networks, and data.

Resourcing, governance, and sharing

Most advice is managerial.

Resourcing: fund basic controls and give security teams the staff and budget to keep vulnerability management and daily work going.

Governance: put AI-use rules in place and balance useful adoption against data leakage.

Coordination: share threat intelligence in the sector. Mooi said sharing is the hardest step because reputation and legal concerns stop many institutions from disclosing incidents. He also said organizations that report events openly often receive a better public response, while silence leaves peers exposed. He asked leadership to join intelligence-sharing mechanisms, security policy coalitions, and crisis exercises, and to build collective defense.

Management as part of capacity

The report's picture is that threat tempo is high, and the largest gaps sit in basic control execution, team investment, and sector sharing, not in a missing product. Technical controls alone do not match the current conditions. Management, funding, and trust among institutions now form a large share of defensive capacity. How to keep open academic collaboration while facing changing security risk remains a long-term issue for research and education networks.

Source: GÉANT interview published 16 September 2026 on the organization's website.