Summary

  • At the European Court of Auditors' 2022–2025 audit, thirteen EU member states had opted into the first two cross-border cyber hubs, ATHENA and ENSOC. Neither hub was operational, and the European Cybersecurity Alert System had yet to function.
  • Supplier shortlisting for the two-stage tool procurements took until April 2025 after first-phase calls in May and July 2024. Some ENSOC lots reached a second phase in August 2025; no lot had a signed contract at the audit. Grant extensions recorded fifteen months of delay for ATHENA and eighteen for ENSOC.
  • The new hubs also lacked agreed cooperation procedures, a common incident vocabulary and interoperability standards linking them to national response teams and EU-CyCLONe. The next decisive evidence is a dated operational acceptance for each hub paired with an actual cross-network warning handoff.

An alarm system in the paperwork stage

The European Cybersecurity Alert System has a serious job. A threat seen in one country can become somebody else's incident before an authority has finished deciding which meeting owns it. The EU built a voluntary arrangement of national and cross-border cyber hubs to share information quickly enough for detection, analysis and response. At the European Court of Auditors' audit, thirteen member states had opted into two initial cross-border hubs. The memberships were real. The common system was still waiting for its tools.

ATHENA and ENSOC began project work in January 2024. That phrase describes a grant-funded consortium at work, not an operational warning service. The two hubs needed advanced detection and information-sharing equipment bought through joint procurement alongside the grants that supported their establishment. The procurement used a restricted two-stage process. Keeping sensitive technical specifications away from every applicant has a sound security rationale. The first stage still consumed an extraordinary stretch of time: ENSOC opened it in May 2024, ATHENA in July, and the successful candidates were told only in April 2025.

The next door was also locked. Hub members and the European Cybersecurity Competence Centre, or ECCC, had not finished the specifications shortlisted bidders needed to price the systems. Some ENSOC lots entered the second phase in August 2025; ATHENA's second phase was then planned for early 2026. Eighteen months after the first procurement launch, the auditors found no signed contract for any lot. Procurement was not a clerical sideshow. It was the route by which a legal network could acquire the ability to see and share a technical signal.

The consequence appears in the audit's plainest sentence: at its assessment, the two cross-border hubs were operationally on hold and the European Cybersecurity Alert System was not functioning. Grant amendments registered fifteen months of delay for ATHENA and eighteen for ENSOC. Those numbers measure programme slippage. The auditors did not identify a particular attack that crossed a border unnoticed because of it. A dated acceptance test and a traceable warning exchange would show when the new service actually began earning its name.

Buying a sensor does not settle who hears it

Hardware is only the first missing piece. The proposed hubs sit beside national computer security incident response teams, their EU-wide CSIRTs network, and EU-CyCLONe, the liaison network for large-scale cyber crises. The 2025 Cyber Blueprint clarified much of the crisis hierarchy. It left the procedural join between CSIRTs and EU-CyCLONe unfinished: which observation rises to a potential large-scale incident, which severity label travels with it, and who receives it next? Auditors heard the common-taxonomy problem in all three countries they visited, Ireland, Greece and Italy.

The new hubs add another route for information on threats, vulnerabilities, indicators of compromise and threat actors. That can reduce isolation inside trusted clusters. It also creates a new handoff where each institution can assume the next one has the message. The audit found no clear boundary between hub and CSIRT information-sharing roles and no agreed procedures for hub cooperation and exchange. The legal instruction to share without undue delay does not write an incident vocabulary or an interoperability test by itself.

The governance failure has a familiar shape. Membership can be announced, a grant can start, and a blueprint can place boxes on an organisational chart. The unglamorous choices come later: who finalises the specification, who signs the cooperation agreement, which machine-readable fields mean the same thing in two capitals, and which operator confirms receipt when a warning moves from technical staff toward crisis leadership. Each question belongs to a named institution. Together they determine whether a European alarm sounds in time or stays a collection of local bells.

The ECCC's public tender page still lists separate ATHENA platform-infrastructure and ENSOC Spain-hosting tenders with September 2026 participation deadlines. Those listings show continuing procurement activity after the auditors' fieldwork. They do not provide a system-wide operational-acceptance record. The next public update should join the contract, installed capability and first tested cross-border exchange rather than celebrating another procurement milestone as a finished alarm.

The clock the audit actually measured

The special report was published in September 2026 and examined 2022–2025. Its judgment is a dated one. The EU's existing CSIRTs, EU-CyCLONe and pre-contracted Cybersecurity Reserve supplied other forms of cooperation and response while the new alert system was on hold. Europe was not sitting in a dark room with no defenders. It had authorised an additional detection and sharing layer that had not yet become a service.

That distinction matters to the people who must make decisions during an incident. An incident commander needs to know which route is actually live today. A ministry needs to know whether the common severity terms are usable in an automated feed. A procurement office needs to know whether a delayed specification is now an accepted installation. The organisation chart answers none of those questions. A dated operational receipt does.

Sources: European Court of Auditors, Special Report 19/2026; ECCC tender opportunities.