Frontier AI models are reshaping the balance between offensive and defensive cybersecurity, exposing growing gaps in existing policy frameworks. Recent evidence shows a sharp increase in the ability of advanced systems to autonomously identify and exploit vulnerabilities, compressing the time between discovery and attack. While these capabilities can strengthen cyber defence by accelerating patching, they also lower barriers for malicious actors and scale offensive operations. This dual-use dynamic is not new, but AI is intensifying it, outpacing governance mechanisms designed for slower, case-by-case vulnerability management. In the EU, this mismatch is increasingly visible in the revised Cybersecurity Act, which acknowledges emerging technologies but does not prioritise the risks posed by frontier AI models. Without adapting its framework to AI-scale vulnerability discovery and response, the EU risks falling behind in securing critical infrastructure and shaping the governance of AI-enabled cyber capabilities.
Data Corner: Economic security at a glance
The United States and China are increasingly locked into clashing macroeconomic trilemmas driven by their pursuit of technological dominance. In the US, sustaining technological leadership conflicts with efforts to keep inflation low and reduce the current account deficit, forcing policymakers into trade-offs between external balance and domestic stability. China faces a parallel constraint: heavy investment to upgrade its industrial base comes at the expense of consumption growth or financial stability. As both superpowers prioritise technological supremacy, these unresolved trade-offs generate significant global spillovers, fueling trade tensions, financial volatility, and economic pressure on third countries.
Europe is stepping up investment in undersea cable infrastructure to strengthen digital resilience and reduce reliance on foreign operators. Through the Connecting Europe Facility (CEF Digital), the EU is funding over 30 cable projects linking member states, islands, and overseas territories, with nearly €1 billion allocated by 2027. While most initiatives aim to improve connectivity in underserved regions, the new Cable Projects of European Interest (CPEs) will target strategic routes essential for Europe’s digital autonomy. However, funding remains modest compared to private capital, and eligibility rules do not yet prioritise EU technologies or suppliers—highlighting a gap between Europe’s strategic ambitions and its investment firepower in critical infrastructure.
Europe’s venture capital ecosystem remains underpowered compared to the United States, particularly at later growth stages. In 2023, U.S. investors committed over three times more capital than their European counterparts across all stages—80% more at seed, 73% more at early stage, and 82% more at later stage funding. This scale-up gap means many promising European tech firms continue to seek financing abroad, especially in the U.S., where deep-pocketed funds dominate. Without stronger European risk-sharing instruments and larger venture funds, the EU risks losing out on breakthrough innovation and the long-term wealth creation tied to scaling strategic industries at home.
The EU’s trade relationship with the US in services reveals a stark and widening imbalance. Since 2010, EU exports of services to the US have surged by 182%, while imports have climbed even more sharply—by 237%. By 2023, the EU ran a €104 billion deficit in services trade with the US, a dramatic rise from just €13 billion in 2018. This gap underscores how US tech companies and platforms have capitalized on unfettered access to Europe’s vast digital market, often at the expense of local competitors and societal cohesion. Meanwhile, the EU’s goods surplus with the US, standing at €155.5 billion in 2023, masks the deeper structural challenge: Europe’s vulnerability to profit-shifting and tax evasion by US multinationals, further exacerbating economic dependencies. Without stronger regulatory frameworks and a unified approach to taxation and digital governance, Europe risks ceding even more ground in strategic sectors.
Europe’s clean energy transition is highly reliant on China’s manufacturing capacity and willingness to export. China accounts for more than half of Europe’s dependencies in value terms, with over 95% of solar wafers, 90%+ of battery anodes, 80% of cathode materials, and 80% of wind turbine blades produced in China. As Beijing restricts key raw material exports—such as graphite—Europe risks falling behind in clean tech manufacturing while Chinese competitors expand globally. Ensuring European energy security requires reducing these dependencies and reshoring strategic industries.
AI will play a pivotal role in future technological and military competition. The Global AI Index evaluates artificial intelligence in 62 countries using investment, innovation, and implementation criteria. The graph shows that the US and China are in the top two positions, with €62.5 billion and €7.3 billion in private investment, respectively, while Singapore rose from tenth to third place in 2023. The UK has fallen to fourth place for the first time, but its score remains stable compared to previous years. Canada follows closely behind, while Germany remains the only EU country in the top 10, dropping two positions to eighth place in 2023. In 2023, European countries and the UK together attracted €9 billion of private investment.
In its most standard and defensive acceptance, economic security is first and foremost about resilience to shocks, crises, and hostile actions (“shielding”). Yet it can also involve building strategic positions as leverage towards others, for instance, in international value chains (“spurring”) or even as an offensive tool, consisting in the ability to disrupt or limit economic functions or production capabilities of third countries (“stifling”). When compared to other global players, the EU’s sanctions program is relatively limited, ranking fifth behind the UK, Switzerland, Canada, and the US in terms of scale. The countries imposing sanctions, including the EU, primarily target Russian individuals, followed by different types of entities. Only a small portion of active sanctions are aimed at vessels and aircraft.
Hybrid cloud solutions will determine the future of the governments’ information technology and security, but American providers dominate the European cloud market. The European cloud market has experienced significant growth, expanding nearly fivefold since the start of 2017 to reach EUR 10.4 billion (US$10.9 billion) in the second quarter of 2022. Over the same period, European providers have more than doubled their cloud revenues. However, Amazon, Microsoft, and Google have emerged as the primary beneficiaries of this growth, now commanding 72% of the regional market, leaving only the remaining part to the Europeans. The advantages built by the American service providers risk becoming insurmountable, compromising Europe’s quest for cloud sovereignty.
Europe's ambitious target of achieving net-zero emissions (NZE) by 2030 hinges on cutting-edge technologies and, consequently, the availability of critical materials. Despite numerous extraction projects being announced, Europe's anticipated production capacity for these essential minerals falls short of what's needed to meet the ambitious emission reduction goals. This shortfall causes a reliance on external actors to bridge the gap.
If Europe is to address the “triple” challenge of climate action, competitiveness and economic security, speedy scale-up of Europe’s renewable energy capacities is critical. The EU’s aim is that for 45% of all energy in the EU will come from renewable sources by 2030, yet European production capacity of the necessary technologies is far from keeping up. Only China has a surplus of wind-energy-related technology, making Europe and the rest of the world dependent on their willingness to export. China also holds close to complete dominance in the upstream production of solar photovoltaic technologies.
A major worldwide “chip crunch” intervened in 2022, caused by both unexpected increases in demand and supply disruptions. Regional shares in different steps of the supply chain point to dependencies, chokepoints and vulnerabilities in what is an extremely complex global value chain. Most steps of the supply chain are controlled by the same five countries: the US, China, South Korea, Japan and Taiwan. This makes the EU dependent on them and their relationships, with little leverage.
Quantum computing is a next-generation foundational technology with significant economic and security implications. Truly powerful quantum computing might be years away, but when it arrives it is widely expected to be able to break the digital encryption system that underpins most security and defense communication and business transactions today. China is a prime actor in the development of quantum computing, but its efforts remain largely shielded from international research collaboration and global value chains. This graph seeks to illustrate emerging chokepoints and entrenchment in the global quantum computing value chain based on the technological position of key actors in selected, critical elements of the computer stack.
The number of cyberattacks in Europe has increased tenfold between 2010 and 2022. In 2023, more than 85% of cyberattacks on businesses affected SMEs. These are worrisome trends for Europe, as SMEs are the backbone of our economy and have little capacity to prepare.
