In 2024, 92.8% of EU enterprises with ten or more persons employed used at least one ICT security measure, but only 38.5% used seven or more of the eleven measures in Eurostat's survey, and 39.8% used multi-factor authentication. 35.5% had documented security policies, and 21.5% had an ICT security incident with consequences in 2023. Among Belgium, the Netherlands, Luxembourg, Germany, Austria and France, the Netherlands (78.4%) and Belgium (59.0%) lead on multi-factor authentication, Germany leads on staff awareness (68.0%), and France has the lowest share of the group on six of the eleven measures.
Key takeaways
- Multi-factor authentication grew faster than any other measure, from 31.0% of EU enterprises in 2022 to 39.8% in 2024. Belgium added 19.6 percentage points, to 59.0%.
- The Netherlands ranks 2 of 27 for using seven or more measures (60.6%) and has the EU's highest share using all eleven (13.1%, against 5.5%).
- Only 35.5% of EU enterprises have documented security procedures, down from 37.3% in 2022, and 38.1% do not make staff aware of their security obligations.
- Failures hit far more enterprises than attacks: in 2023, hardware or software failures made ICT services unavailable for 18.0% of EU enterprises, attacks from outside for 3.4%.
- The size gap is widest for documented policies: 81.5% of large enterprises against 30.3% of small ones.
Which ICT security measures do European enterprises use?
The basics are widespread. In 2024, the most common measures in the EU were strong password authentication (83.7%), data backup to a separate location, including the cloud (79.2%), and network access control (65.4%). Fewer than half of enterprises use a VPN (49.6%), a monitoring system for suspicious activity (45.1%), log files for analysis after incidents (45.2%), multi-factor authentication (39.8%) or encryption (39.7%). About a third run ICT security tests (34.6%) or risk assessments (34.1%).
The six countries differ by measure. Germany has the group's highest share for encryption (57.9%) and Austria for backup (90.5%, rank 2 of 27). The Netherlands has the highest share in the EU for security tests (53.4%). Belgium is above the EU average on every measure except encryption (37.2%). France has the group's lowest share on six of the eleven measures, including encryption (21.8%) and risk assessment (30.3%).
| Measure | EU-27 | BE | NL | LU | DE | AT | FR |
|---|---|---|---|---|---|---|---|
| Strong password authentication | 83.7 | 90.0 | 82.8 | 79.8 | 89.1 | 80.6 | 82.2 |
| Data backup to a separate location (incl. cloud) | 79.2 | 87.0 | 87.3 | 77.8 | 90.1 | 90.5 | 78.7 |
| Network access control | 65.4 | 80.6 | 75.1 | 72.3 | 69.7 | 76.7 | 70.6 |
| VPN | 49.6 | 61.8 | 59.3 | 42.8 | 64.3 | 63.6 | 44.4 |
| Log files kept for analysis after incidents | 45.2 | 59.3 | 62.9 | 42.1 | 59.5 | 52.1 | 39.0 |
| Monitoring system for suspicious activity | 45.1 | 59.1 | 62.3 | 45.8 | 55.7 | 65.9 | 47.1 |
| Multi-factor authentication (two or more mechanisms) | 39.8 | 59.0 | 78.4 | 44.0 | 44.1 | 40.8 | 31.0 |
| Encryption of data, documents or e-mails | 39.7 | 37.2 | 51.4 | 40.2 | 57.9 | 47.8 | 21.8 |
| ICT security tests | 34.6 | 48.9 | 53.4 | 37.2 | 42.5 | 33.8 | 26.5 |
| ICT risk assessment | 34.1 | 50.9 | 52.5 | 34.2 | 38.8 | 32.5 | 30.3 |
| Biometric authentication | 18.3 | 23.2 | 32.1 | 15.0 | 24.7 | 19.6 | 10.5 |
BE Belgium, NL Netherlands, LU Luxembourg, DE Germany, AT Austria, FR France. Sorted by the EU-27 value. Source: Eurostat, isoc_cisce_ra.
How many security measures do enterprises combine?
A single measure is common; a layered set is not. In 2024, 56.9% of EU enterprises used at least five of the eleven measures, 38.5% at least seven, and 5.5% all of them. The highest shares using seven or more are in Finland (62.1%), the Netherlands (60.6%) and Denmark (60.2%); the lowest is in Bulgaria (19.3%).
In this group, the Netherlands and Belgium (55.0%, rank 5) lead, followed by Germany (51.2%) and Austria (46.6%). Austria (+8.3 points) and Belgium (+8.1) gained most since 2022. Luxembourg (39.7%) is close to the EU average and France (29.4%) below it.
| Country | At least 1, 2024 | At least 5, 2024 | At least 7, 2022 | At least 7, 2024 | All eleven, 2024 |
|---|---|---|---|---|---|
| EU-27 | 92.8 | 56.9 | 35.5 | 38.5 | 5.5 |
| Belgium | 96.1 | 71.5 | 47.0 | 55.0 | 10.5 |
| Netherlands | 95.8 | 76.3 | 54.1 | 60.6 | 13.1 |
| Luxembourg | 86.8 | 55.3 | 36.8 | 39.7 | 6.1 |
| Germany | 96.5 | 71.4 | 48.6 | 51.2 | 7.3 |
| Austria | 95.4 | 66.5 | 38.3 | 46.6 | 6.8 |
| France | 93.2 | 50.1 | 26.3 (b) | 29.4 | 1.6 |
(b) = break in time series. pp = percentage points. Source: Eurostat, isoc_cisce_ra.
How fast is multi-factor authentication spreading?
Faster than any other measure. Eurostat asks whether an enterprise combines at least two authentication mechanisms, such as a password with a one-time code, a security token or a biometric method. In the EU the share rose from 31.0% in 2022 to 39.8% in 2024, up 8.9 percentage points.
It grew in every country here. The Netherlands reaches 78.4%, rank 2 of 27 behind Finland (79.4%). Belgium had the group's largest increase and ranks 4 of 27. Germany (44.1%), Luxembourg (44.0%) and Austria (40.8%) are above the EU average; France (31.0%) is below it.
| Country | 2022 | 2024 | Change (pp) | EU rank, 2024 |
|---|---|---|---|---|
| EU-27 | 31.0 | 39.8 | +8.9 | – |
| Belgium | 39.4 | 59.0 | +19.6 | 4 of 27 |
| Netherlands | 64.6 | 78.4 | +13.8 | 2 of 27 |
| Luxembourg | 34.9 | 44.0 | +9.1 | 10 of 27 |
| Germany | 32.0 | 44.1 | +12.1 | 8 of 27 |
| Austria | 28.0 | 40.8 | +12.8 | 12 of 27 |
| France | 21.3 (b) | 31.0 | +9.7 | 19 of 27 |
(b) = break in time series. pp = percentage points. Source: Eurostat, isoc_cisce_ra.
Do enterprises document security policies and inform staff?
About a third document their rules. In 2024, 35.5% of EU enterprises had documents on ICT security measures, practices or procedures, against 37.3% in 2022. The Netherlands (41.5%), Belgium (40.3%) and Germany (40.3%) are above the EU average; Luxembourg (29.9%), Austria (29.1%) and France (23.4%) are below it. Belgium's share rose by 6.2 points, while the Dutch and Austrian shares fell.
Staff awareness is more common: 60.0% of EU enterprises make staff aware of their security obligations, most often through voluntary training or intranet information (42.6%), then contracts (34.3%) and compulsory training (24.5%). Germany leads the group (68.0%, rank 5), and Belgium had the largest increase (9.1 points).
The Netherlands shows that technical and organisational measures do not always move together. It leads this group on multi-factor authentication, yet 50.0% of Dutch enterprises do not make staff aware of their obligations, and it is the only country here where risk assessment (52.5%) is more common than staff awareness (50.0%).
| Country | Documented policy, 2022 | Documented policy, 2024 | Staff made aware, 2024 | Compulsory training, 2024 | Staff not made aware, 2024 |
|---|---|---|---|---|---|
| EU-27 | 37.3 | 35.5 | 60.0 | 24.5 | 38.1 |
| Belgium | 34.1 | 40.3 | 62.8 | 27.8 | 37.2 |
| Netherlands | 43.9 | 41.5 | 50.0 | 22.1 | 50.0 |
| Luxembourg | 25.9 | 29.9 | 54.1 | 22.2 | 44.9 |
| Germany | 35.6 | 40.3 | 68.0 | 26.9 | 27.6 |
| Austria | 32.2 | 29.1 | 61.1 | 25.2 | 37.7 |
| France | 20.8 (b) | 23.4 | 48.1 | 17.9 | 51.5 |
(b) = break in time series. pp = percentage points. Source: Eurostat, isoc_cisce_ra.
How does ICT security differ by enterprise size?
Large enterprises are ahead on every measure. The gap is narrowest for strong passwords (96.8% of large against 82.0% of small EU enterprises) and widest for measures that need planning: documented policies (81.5% against 30.3%) and security tests (78.1% against 29.8%). Risk assessment shows a similar divide (75.6% against 29.4%).
Country matters too. Small Belgian enterprises use multi-factor authentication (53.9%) more often than the average EU enterprise of any size (39.8%), and small Dutch enterprises (74.9%) are close to the EU figure for large ones (77.7%). Because about 83% of EU enterprises with ten or more persons employed are small, national averages largely reflect small firms.
How many enterprises had an ICT security incident?
About one in five. In the 2024 survey, 21.5% of EU enterprises reported at least one ICT security incident in 2023 that made ICT services unavailable, destroyed or corrupted data, or disclosed confidential data (22.2% for 2021). Large enterprises report incidents about twice as often as small ones (38.3% against 19.9%).
Failures affect more enterprises than attacks. Hardware or software failures made ICT services unavailable in 18.0% of EU enterprises, attacks from outside such as ransomware or denial of service in 3.4%. Data was destroyed or corrupted by failures in 3.9% and by malware or intrusion in 1.9%.
In this group, the Netherlands (25.8%), Germany (25.1%), France (25.0%) and Belgium (22.3%) are above the EU average, Luxembourg (16.7%) is below it, and Austria has the lowest share of all 27 member states (11.5%). The Netherlands has the second-highest share in the EU, after Romania, for disclosure of confidential data (5.4%). The survey only records incidents that enterprises noticed and reported.
| Country | Any, in 2021 | Any, in 2023 | Services unavailable: failure, 2023 | Services unavailable: attack, 2023 | Confidential data disclosed, 2023 | EU rank, 2023 |
|---|---|---|---|---|---|---|
| EU-27 | 22.2 | 21.5 | 18.0 | 3.4 | 2.3 | – |
| Belgium | 23.2 | 22.3 | 18.6 | 4.0 | 2.5 | 10 of 27 |
| Netherlands | 30.1 | 25.8 | 19.7 | 5.1 | 5.4 | 7 of 27 |
| Luxembourg | 16.1 | 16.7 | 13.0 | 3.3 | 2.2 | 14 of 27 |
| Germany | 26.2 | 25.1 | 22.2 | 3.6 | 2.4 | 8 of 27 |
| Austria | 15.4 | 11.5 | 9.3 | 2.1 | 1.5 | 27 of 27 |
| France | 25.6 (b) | 25.0 | 21.4 | 2.7 | 2.4 | 9 of 27 |
Survey years 2022 and 2024; the questions refer to the previous calendar year. Rank 1 = highest share. (b) = break in time series. pp = percentage points. Source: Eurostat, isoc_cisce_ic.
Methodology and limitations
All figures come from the EU survey on ICT usage and e-commerce in enterprises, run by the national statistical institutes on a common Eurostat questionnaire. In 2024, about 157,000 enterprises were surveyed out of around 1.54 million EU enterprises with ten or more persons employed. The financial sector, agriculture, forestry, fishing, and mining and quarrying are excluded.
- Definitions. Each measure is a separate yes or no item. "Multi-factor authentication" stands for Eurostat's "combination of at least two authentication mechanisms", and a documented policy for "documents on measures, practices or procedures on ICT security".
- Years. The security questions are asked every second year, so 2024 is the newest survey and 2022 the comparison year. Incident questions refer to the previous calendar year.
- Comparability. The counts of measures and the incident indicators started in 2022 under new codes, so earlier years are not compared. The monitoring-system item was reworded in 2024 under a new code and is shown for 2024 only; because the counts include it, changes in the counts are indicative.
- Flags. France's 2022 values carry a break in series (b), so France's changes are indicative. Sweden's 2024 values carry the same flag and appear only in the ranking chart. No printed value is flagged as low reliability, and unpublished values are left out rather than estimated; the timing of policy reviews is not published for Belgium and Luxembourg for 2024 and is not used.
- Scope. Small means 10-49 persons employed, medium 50-249 and large 250 or more. Micro-enterprises are not covered, and Switzerland does not take part in the survey.
- Computations. Changes are percentage-point differences between published values; ranks are positions among the 27 member states. Values are rounded to one decimal after calculation.
The raw responses, dataset codes and access date (29 October 2026) are kept with this article, so every figure can be traced to its Eurostat cell.
What this means for SMEs: a practical checklist
The survey shows whether enterprises use each measure, not how well. The items below come from Eurostat's list, with the share of small EU enterprises (10-49 persons employed) using each. They are a neutral starting point for a review, not a complete security programme.
- Use two authentication factors for e-mail, remote access and administrator accounts. 36.1% of small enterprises do, and it is the fastest-growing measure in the EU.
- Back up data to a separate location and test restores. 77.1% of small enterprises keep backups elsewhere. Eurostat counts cloud backup as a separate location; the same survey shows how widely European enterprises use cloud services.
- Plan for failures, not only attacks. Failures caused far more service outages than attacks, so written recovery steps and a known restore time are worth having.
- Keep log files you can analyse after an incident. 40.3% of small enterprises do.
- Write down the rules and tell staff about them. 30.3% of small enterprises have documented security procedures and 56.0% make staff aware of their obligations; compulsory training reaches 20.4%.
- Assess risks and test defences periodically. Apart from biometric authentication, risk assessment (29.4%) and security tests (29.8%) are the least common measures in small firms. Encryption (35.9%) is another gap.
Legal context: the General Data Protection Regulation (GDPR) requires appropriate technical and organisational measures to protect personal data, and the NIS2 Directive sets cybersecurity risk-management obligations for entities in the sectors it covers. Whether either applies to a particular business is a legal question; this article is not legal advice.
| Country | Multi-factor authentication | Backup to a separate location | Log files | Risk assessment | Documented policy | Staff made aware |
|---|---|---|---|---|---|---|
| EU-27 | 36.1 | 77.1 | 40.3 | 29.4 | 30.3 | 56.0 |
| Belgium | 53.9 | 85.3 | 54.0 | 45.4 | 33.2 | 57.4 |
| Netherlands | 74.9 | 85.3 | 57.4 | 46.6 | 34.4 | 43.4 |
| Luxembourg | 39.0 | 74.7 | 36.9 | 29.3 | 25.2 | 49.0 |
| Germany | 39.8 | 88.8 | 54.9 | 33.6 | 33.9 | 63.7 |
| Austria | 36.5 | 89.2 | 47.1 | 27.8 | 23.6 | 56.4 |
| France | 29.2 | 77.3 | 34.5 | 26.5 | 19.5 | 44.3 |
Source: Eurostat, isoc_cisce_ra.
Frequently Asked Questions
What share of EU enterprises use multi-factor authentication?
In 2024, 39.8% of EU enterprises with ten or more persons employed combined at least two authentication mechanisms, up from 31.0% in 2022, according to Eurostat: 36.1% of small and 77.7% of large enterprises.
How many enterprises have a documented ICT security policy?
35.5% of EU enterprises had documents on ICT security measures, practices or procedures in 2024: 81.5% of large and 30.3% of small enterprises.
How many Belgian enterprises use ICT security measures?
In 2024, 96.1% of Belgian enterprises with ten or more persons employed used at least one measure and 55.0% used seven or more. 59.0% used multi-factor authentication, 87.0% kept backups in a separate location and 40.3% had documented security procedures. 22.3% had an incident with consequences in 2023.
What is the most common cause of ICT security incidents in enterprises?
Hardware or software failure is the most commonly reported cause. In 2023, such failures made ICT services unavailable in 18.0% of EU enterprises, against 3.4% for attacks from outside.
Does Eurostat publish ICT security figures for Switzerland?
No. The survey covers EU member states, Iceland, Norway and candidate countries, so Switzerland has no figure in these datasets.
Conclusion
Eurostat's 2024 data show that almost every European enterprise uses some ICT security measure, but layered protection, documented rules and risk assessment remain the exception in small firms. Multi-factor authentication is spreading fastest, with the Netherlands and Belgium among the EU leaders, and far more enterprises lose ICT services to failures than to attacks. This summary was compiled by Rui Codex, a software engineering company based in Belgium; teams with a software project to discuss can send a project request.
Sources
- Security policy, measures, risks and staff awareness by size class of enterprise (isoc_cisce_ra) - Eurostat
- Security incidents and consequences by size class of enterprise (isoc_cisce_ic) - Eurostat
- ICT security in enterprises (Statistics Explained) - Eurostat
- ICT usage in enterprises: reference metadata - Eurostat
- Regulation (EU) 2016/679 (General Data Protection Regulation) - EUR-Lex
- Directive (EU) 2022/2555 (NIS2 Directive) - EUR-Lex
