I. Introduction

While the concept of security has always been high on the European Union’s political agenda, it has become increasingly prominent in recent years. Different wars and crises, as well as rapidly evolving global events continue to unfold daily. The challenges to security and stability on the European continent are greater than at any time since World War II, and the need for clarity on the concept of security is particularly crucial now.

But what is security? And what should it mean for citizens to feel secure in the EU? According to the EU’s Treaty on the European Union (TEU), the values of respect for human dignity, freedom, democracy, equality, the rule of law, and respect for human rights are the fundamental principles of the Union, with the ultimate goal of promoting these values and the well-being of its people – especially peace.¹Taken with the Treaty on the Functioning of the European Union (TFEU), this underpins the Union’s overarching objective of providing citizens with a high level of protection in the areas of freedom, security and justice.² At the same time, it is clear from the Treaties that national security is a sole responsibility of each Member State³ and that separate rules apply for the development of the Union’s common foreign and security policy. Furthermore, while the Treaties provide a good starting point, they do not offer a definition of the concept of security that could apply across the Union and its legislation and policies. As we will see, this is a significant deficiency, particularly at a time when security challenges are fast growing.

Based on the rules in the core treaties, the Union has adopted a tremendous amount of legislative and policy initiatives over the past several decades, with the goal of creating and strengthening the EU’s area of freedom, security and justice. These rules provide common standards across the Union to combat serious crime, improve cooperation between police and judicial authorities, and enhance the Union’s overall resilience against different types of attacks. While the traditional focus of the Union’s actions in the area of security have focused on preventing terrorist attacks, protecting borders, and fighting organised crime, now shifting geopolitical interests and emerging new technologies demonstrate the need to apply a broader horizontal approach towards security. Providing citizens with security based on a comprehensive and enforceable framework is an endeavour requiring heightened attention to considerations far beyond the conventional justice and home affairs agenda. This means first recognising the inextricable links between the Union’s external security and security within its own borders but also expanding our working understanding of the security concept to areas such as the economy, energy, digitalisation, public health, transport, and climate, and addressing them effectively in defence policy.

This article outlines initiatives taken by the EU to protect its security, notably under the umbrella of the EU’s Security Union Strategy 2020-2025 (section II) and explains recently adopted initiatives in this area as announced by the Political Guidelines for the new European Commission 2024-2029 (section III). It also presents the views from other EU Institutions and actors in the area of security (section IV), before concluding with a number of final considerations (section V).

II. An Evolving EU Security Policy: From Internal Priorities to a Comprehensive and Silo-breaking Approach

Over the past decades, the evolution of the EU’s security policy has paralleled the changing global threat landscape and the Union’s commitment to safeguarding its citizens and core values. This is one of the youngest policy areas at the EU level, stemming from a gradual transition from informal collaboration among an expanding number of Member States to inter-governmental cooperation and then to further integration based on common laws and initiatives. The first EU internal security strategy, covering 2010-2015,⁴ primarily focused on traditional internal security priorities, such as organised crime and terrorism; however, it also included natural and man-made disasters. This foundational phase provided the necessary coordination among EU Member States’s push to tackle cross-border and cross-sectoral threats to which no single Member State could effectively respond on its own.

A series of high-profile terrorist attacks in subsequent years prompted a significant strategic shift in Member States’ approach towards security. The European Agenda on Security 2015-2020,⁵ under the guidance of Commissioner Julian King, emerged as a response to these threats and demonstrated the need for greater cooperation between national authorities, EU institutions, and various stakeholders, including the private sector. This agenda went beyond a conventional approach to security threats, paving the way for a Security Union concept. It marked a transition from the traditional focus on internal vulnerabilities to the recognition that modern security challenges are increasingly transnational and multifaceted.

The advent of the Security Union Strategy 2020–2025,⁶ entrusted to Commission Vice-President Margaritis Schinas, took this shift further. This strategy was designed at the peak of the COVID-19 pandemic, and it was founded on four strategic pillars: (i) creating a future-proof security environment, ii) tackling evolving threats, iii) protecting Europe from terrorism and organised crime, and iv) building a robust European security ecosystem. The Strategy aimed to provide a holistic and comprehensive approach to security in an increasingly complex threat landscape marked by hybrid threats, disinformation, and increasing geopolitical volatility – with unprecedented challenges to EU values and democracies. It targeted areas where the EU could bring added value to national efforts and placed a particular emphasis on cybersecurity, the protection of critical infrastructure, hybrid threats, and the nexus between internal and external security.

During its timespan, new initiatives were incorporated under the umbrella of the Security Union Strategy in response to a number of specific circumstances that could not have been foreseen when it was first designed. It was not only the Russian war of aggression against Ukraine and the deteriorating situation in the Middle East that required additional and more decisive actions but also rapid technological developments. This was true, in particular, for the newer areas of focus in the original Strategy (critical infrastructure, cybersecurity, and hybrid threats), and they have been intensified in response to severe events. Examples of these new initiatives include the Cyber Solidarity Act,⁷ the anti-corruption package,⁸ and measures to counter migrant smuggling.⁹ Parallel to the overarching framework provided by the Security Union Strategy, the Commission adopted targeted strategies in key security domains, including counterterrorism,¹⁰ organised crime,¹¹ drug trafficking,¹² and trafficking in human beings.¹³ This multi-pronged approach reflects the understanding that modern security challenges are interlinked and that vulnerabilities in one area can have cascading effects on others. An example illustrating an integrated approach where physical and cyber threats are addressed in tandem is the measures taken to protect public spaces and entities providing essential services, which have been coupled with efforts to secure digital infrastructures.

Over 40 legislative initiatives under the umbrella of the Security Union Strategy were proposed by the Commission and successfully adopted by the co-legislators (European Parliament and Council) in 2020-2025.¹⁴ Key legislative achievements concern the protection and enhancing of the resilience of critical infrastructure in the EU against physical and digital threats, with the parallel adoption of the Directives on Critical Entities Resilience (CER)¹⁵ and Network and Information Systems (NIS2).¹⁶ Together, and once fully transposed and implemented by Member States, these Directives will ensure that risks and vulnerabilities affecting entities in a range of key sectors, such as energy, transport, and space, are better addressed. With the adoption of the Cyber Resilience Act¹⁷ and the Cyber Solidarity Act,¹⁸ the EU has been a pioneer in creating a solid legal framework to reinforce the cybersecurity of products with digital elements and supply chains, to strengthen solidarity at the EU level in case of major cyber incidents, and to enhance its collective capabilities to detect, prepare for, and respond to these types of risks.

At the same time, more “typical” security areas, such as the fight against organised and serious crime, continued to receive attention under the Security Union Strategy, with pivotal legislation adopted to tackle cybercrime (notably the e-evidence package¹⁹), trafficking in human beings,²⁰ and environmental crime²¹ as well as money laundering and terrorism financing.²² The new rules on asset recovery and confiscation²³ should lead to higher rates of confiscation of criminal proceeds – currently stagnating at an estimated 2% of illicit proceeds²⁴ – and allow for a stronger focus on crypto assets. A related area of major importance to the Strategy concerned the improvement of cooperation between police authorities and their operational capabilities. No less than three initiatives branded as the “EU Police Cooperation Code” were adopted: the Regulation on Automated Data Exchange for Police Cooperation (Prüm II),²⁵ the Directive on information exchange between law enforcement authorities and Member States,²⁶ and a Council Recommendation on operational police cooperation.²⁷ Through timely and accurate implementation, these measures are expected to significantly step up law enforcement cooperation across Member States and grant police officers more modern tools by which to exchange information.

While advancing the work on the Security Union Strategy and following the return of war to the European continent, the Strategic Compass²⁸ of March 2022 presented an ambitious plan of action for strengthening the EU’s security and defence policy. With the objective of boosting the EU’s cyber defence capabilities, enhancing situational awareness, and coordinating the entire range of defensive options available, this Compass aimed for a heightened level of resilience, a better response to cyber-attacks, and enhanced solidarity as well as improved mutual assistance. Increasing emphasis has been put on improving the EU’s capacities to counter hybrid threats. In addition to mechanisms, such as the Foreign Information Manipulation and Interference (FIMI) Toolbox and the Cyber Diplomacy Toolbox to be better prepared for and respond to cyberattacks, the EU put in place the Hybrid Toolbox, which is now operational and is used to respond to the intensified hybrid campaign by Russia targeting the EU and its Member States. Moreover, the idea of deploying EU Hybrid Rapid Response Teams was developed to offer short-term, tailored support to Member States and partner countries. Also noteworthy is the fact that the Strategic Compass identified space as a fifth operational domain of warfare (alongside land, sea, air, and cyber domains) and proposed measures to improve the collective protection of space systems and services against threats.²⁹

Central to the Security Union Strategy has been its focus on implementation, with the Commission adopting seven progress reports to regularly report on progress achieved in the 2020-2024 period.³⁰ The final progress report³¹ of the Strategy adopted in May 2024 concluded with an outlook on security challenges beyond 2025. Accessing data in cutting-edge technologies like quantum communication infrastructure, artificial intelligence, and advanced surveillance pose significant challenges, highlighting the need to continue exploring how law enforcement can make use of digital technologies, while also ensuring the full respect for fundamental rights and cybersecurity.³² Indeed, the intersection of technology and security presents a growing paradox: we must protect data and technological advancements, in line with EU values and principles, yet these very assets can also be exploited by criminals for illicit activities.

The final progress report called for a fresh approach to the way EU institutions and bodies and Member States respond to challenges, guaranteeing the EU’s capacity to respond swiftly when necessary as well as avoiding silos and response mechanisms that duplicate risk assessment or complicate crisis response.³³ Here, the challenge lies in translating this into practical action within an increasingly complex security ecosystem, where multiple players with overlapping goals and responsibilities must navigate a delicate balance. The Joint Cyber Unit, identified by the Security Union Strategy as a crucial mechanism for coordinated and structured operational cooperation across the civilian, law enforcement, diplomatic, and defence communities serves as a prime example of how promising initiatives can lose momentum.

Finally, the progress report acknowledged that the Union’s understanding of the notion of security has broadened, as the risks facing the EU have multiplied. The need for Europe to become more autonomous and less dependent on third countries (be it in the area of technology or in the provision of critical products and services) brings with it a range of economic considerations situated at the interface between security and competitiveness. The report further emphasised that any modern approach to security must integrate both digital and cyber components and take international implications into consideration, while also ensuring that security is embedded in all EU policies and decision-making processes.³⁴

III. Current and Future Priorities

Extraordinary times call for extraordinary measures. This is also true for my Commission. To deal with the challenging way ahead, we need to switch into a preparedness mind-set. This is why, in the next weeks, I will convene the first-ever Security College. This will ensure that the College members receive regular updates on security developments. From external and internal security to energy, defence and research. From cyber, to trade, to foreign interference. Only if we have a clear and in-depth understanding of the threats, including hybrid threats, can we effectively contribute to collective security.

Ursula von der Leyen, 9 March 2025

Given the current geopolitical context, it comes as no surprise that the notion of security is predominant in the Political Guidelines of Commission President Ursula von der Leyen during her second term of office.³⁵ In the Chapter “A new era for European Defence and Security”, she announced her vision for a new approach to crisis and security preparedness. Among the main initiatives listed in this section are the adoption of a Preparedness Union Strategy inspired by the 2024 Niinistö Report and a European Internal Security Strategy to ensure that security is integrated into EU legislation and policies by design. In line with this direction, President von der Leyen announced specific initiatives: to make Europol a truly operational police agency, to reflect on areas where the European Public Prosecutor’s Office’s (EPPO) mandate could be extended,³⁶ and to design a new EU action plan against drug trafficking, an EU Port Strategy with a strong focus on security, a new Counter-Terrorism Agenda, and a new European Critical Communication System – to be used by authorities in charge of ensuring security and safety.

The concept of the “Security College” was also announced by Commission President von der Leyen in a speech marking the first 100 days of her Commission’s mandate.³⁷ It aims to anchor security in the Commission’s policymaking, ensuring that the College of Commissioners receives regular updates on security developments in all policy areas.

The consolidation of security is also a red thread in the letters that Commission President von der Leyen sent to Commissioners-designate, setting their missions for this mandate.³⁸ First, Executive Vice-President Henna Virkkunen is responsible for the portfolio Tech Sovereignty, Security and Democracy, a title that implies a supervisory role in security policies, including internal security and defence. Furthermore, the Executive Vice-President is in charge of key security areas, such as cybersecurity. Second, Commissioner Magnus Brunner is responsible for Internal Affairs and Migration, focusing on the traditional aspects of security, such as the fight against terrorism and organised crime; he is also tasked with delivering on the Internal Security Strategy. Commissioner Andrius Kubilius is the first-ever appointed Commissioner for defence. Preparedness, a policy closely linked with security, is included in the remit of Vice-President Roxana Mînzatu and Commissioner Hadja Lahbib.

In her mission letters, Commission President von der Leyen calls on all Commissioners to draw on recent, high-profile reports addressing security policies. These include, in particular, the 2024 Draghi Report on the future of European competitiveness and the 2024 Niinistö Report on how to enhance Europe's civilian and defence preparedness and readiness. The main security-related aspects of these reports and the linked initiatives adopted in this mandate, are described in the following sub-sections.

Competitiveness as a prerequisite for securing prosperity and freedom

Presented on 9 September 2024, the Draghi Report on EU competitiveness³⁹ arrived at a crucial moment in the core mission of strengthening the Union’s competitiveness. With 176 concrete recommendations made in a range of sectors, the report is built on three key anchors: i) closing the innovation gap with the United States and China, particularly in advanced technologies; ii) a joint action plan for decarbonisation and competitiveness; and iii) increasing security and reducing dependencies from third countries.⁴⁰ Cutting regulatory burdens, using collective spending power in crucial areas such as innovation and defence, and applying stronger horizontal EU coordination are means to achieve these goals. Together with Enrico Letta’s 2024 Report on the Future of the Single Market,⁴¹ Draghi’s steer is seen as key not only to reinvigorating the EU’s competitiveness but to safeguarding its economic security.

The European Commission responded with the adoption of the Competitiveness Compass on 29 January 2025,⁴² setting out a roadmap with legislative and policy initiatives for the next five years to implement the recommendations of Draghi’s report. Based on the three key anchors identified by Draghi, the Compass introduces transformational imperatives to boost the EU’s productivity gap, particularly in the tech area, as a way to strengthen competitiveness. Preparedness and security are also part of the agenda; reference is made to new actions flowing from the joint White Paper on the future of European Defence, the Preparedness Union Strategy, and the Internal Security Strategy. Five enablers are guiding horizontal requirements for the implementation of the Compass across all policy sectors: i) simplifying the regulatory environment, ii) fully exploiting the potential of the EU’s Single Market, iii) providing financing through a Savings and Investments Union as well as a refocused EU budget, iv) promoting professional skills and high-quality jobs and iv) improving policy coordination at the EU and national levels.

Preparedness as a mindset and standard course of action

On 30 October 2024, former Finnish President Sauli Niinistö presented his report on strengthening Europe’s civilian and military preparedness and readiness.⁴³ Aimed at informing future actions to be proposed by the High Representative for Foreign Affairs and Security Policy (in the following: High Representative) and the Commission in view of the Political Guidelines and mission letters to Commissioner-designates, this report is a clear wake-up call to the EU on the need for action, and it sets out a number of specific steps. The actions proposed relate to cross-cutting areas of strategic importance which include – but are not limited to – the EU’s military capabilities, the provision of healthcare and building up sufficient stockpiles, the secure use and development of digital technologies, and the availability of critical raw materials and components. The Niinistö Report confirms the important link between security and competitiveness, underscoring Europe’s need to be economically competitive – not only to keep itself and its businesses secure but also to make a real impact on international developments instead of merely adjusting to them.⁴⁴

The Niinistö Report also underlines the need for the EU to consider and concretely prepare for worst-case emergency and crisis scenarios and to take more strategic responsibility in a world subject to constant change. The idea is to follow an integrated whole of EU society method, bringing together relevant stakeholders: national authorities, private entities, employers, trade unions, civil society organisations as well as – and perhaps most importantly – individual citizens. While the “whole of society” approach already made its appearance in the Security Union Strategy, its inclusion in future strategies remains relevant.

The ideas presented in the Niinistö Report were translated into the European Preparedness Union Strategy, adopted by the Commission and the High Representative on 26 March 2025.⁴⁵ The aim of this Strategy (accompanied by an action plan with 63 items and an indicative timeline for their implementation) is to establish a comprehensive framework ensuring the EU’s preparedness to respond to any type of crisis, including climate change, health emergencies, natural disasters, and security infrastructure attacks. The Strategy is horizontal in nature, and it fosters a culture of preparedness and resilience, thereby supporting the obligation of Member States under Art. 222 TFEU to act in solidarity in the event of crises. The actions proposed revolve around seven areas⁴⁶, and include the development of an EU comprehensive risks and threats assessment. The latter will be done through the following: strengthening the Single Intelligence Analysis Capacity (SIAC); a future Climate Adaptation Plan; practical measures to increase preparedness of citizens to ensure self-sufficiency for a minimum of 72 hours; and the boosting of public-private cooperation and the EU-NATO partnership.

The Strategy also includes a section on ensuring the resilience of vital societal functions. Reference is made to the work carried out under the previous Commission mandate in the context of the Security Union as regards the protection of critical infrastructure and cybersecurity, in particular the adoption of the CER and NIS2 Directives. While it is not surprising that the Strategy calls for the urgent transposition of these Directives, it further envisages that the Commission will engage with Member States to identify additional sectors and services not covered by the current legislation where there may be a need to act, e.g., Europe’s defence industrial base.⁴⁷

A notable action put forward by the Strategy, also referred to in Niinistö’s report, concerns the embedding of a Preparedness and Security by Design principle in future EU legislation, policies, and programmes. This approach slightly deviates from the recommendation put forward in the report, which called for an explicit security and preparedness check in all future impact assessments accompanying new legislative initiatives proposed by the Commission. Taken together with the principles of proportionality in combination with the Commission’s objective in the Competitiveness Compass to simplify EU rules, the Strategy takes a more targeted approach, namely that future initiatives should be developed with preparedness and security perspective considerations in mind. The true value and implications of this approach will be revealed through practical application on a case-by-case basis in specific initiatives.

Peace through defence?

A number of recommendations put forward by the Niinistö and Draghi reports particularly focused on defence. The response to these recommendations is evident in the joint White Paper for European Defence Readiness 2030⁴⁸ of the European Commission and the High Representative published on 19 March 2025. Against the background of the immense disruption of the post-Cold War political order currently taking place and the systematic under-investment in Europe’s defence capabilities, the White Paper sets out a framework to strengthen European defence and to support Ukraine. The actual novelty of the White Paper is the launch of the ReArm Europe Plan, an urgent defence response plan with six measures to speed up defence spending in the EU: a new EU regulation to provide Member States with loans backed by the Union budget; a proposal to activate the National Escape Clause allowing Member States to mobilise additional defence expenditure, which could reach at least €800 billion over the next four years; additional incentives granting more flexibility and incentives to increase European defence investments; further contributions by the European Investment Bank, including a widening of the scope of defence-related funding; the mobilisation of private capital, including through the Savings and Investment Union; and the exploration of additional funding sources for defence, notably under the next Multiannual Financial Framework.⁴⁹

With the objective of ensuring European defence readiness by 2030 at the latest, the White Paper provides concrete directions for invigorating the Union’s defence technological and industrial base, stimulating research, and creating an EU-wide market for defence equipment. While Member States’ defence spending has significantly increased over the years and is currently estimated at 1.9% of the EU’s combined GDP (€326 billion in 2024),⁵⁰ it is still considered insufficient in the new era of security threats fuelled by geographical, geopolitical, technological, and competitive motives.

ProtectEU: safeguarding the EU’s internal security

The latest building block in the new security architecture designed by the Commission concerns the European Internal Security Strategy adopted on 1 April 2025.⁵¹ Branded as “ProtectEU”, this new strategy continues the foundational work laid out in the Security Union Strategy, despite use of the term “internal”, and does not exclusively focus on the classical internal security threats (updating the Framework Decision on organised crime, strengthening Europol, and the adoption of new, targeted strategies and action plans in the areas of counterterrorism, and trafficking in firearms, drugs, and humans as well as the protection of children against crime). ProtectEU not only addresses threats posed by organised crime and terrorism but also puts the spotlight on hybrid threats, including incidents affecting the EU’s critical infrastructure, cyber-attacks, disinformation, and foreign interference.

The Strategy of 1 April 2025 establishes a new governance model for European internal security.⁵² This is done through consolidation of the principle that security should be mainstreamed in all the EU’s future actions, in line with the Preparedness Union Strategy adopted at almost the same time. Regular meetings of the Commission Project Group on European Internal Security, enhanced by strategic cross-sectoral collaboration at the service level, should enable the Commission to embed the notion of security in all aspects of its work. The new format of the Commission’s Security College will duly discuss internal security elements and their potential impact on different policy areas. To ensure the necessary transparency on progress made in implementing the actions put forward, the Strategy requires that the Commission regularly update the Council and European Parliament. Regular EU internal security threat assessments based on sectoral analysis should feed into the EU’s comprehensive risk and threat assessment, as announced in the Preparedness Union Strategy.

The ProtectEU Strategy acknowledges that the online and offline dimensions of security have currently become blurred and puts a strong emphasis on digital risks and vulnerabilities, such as cybersecurity and cybercrime. In this context, the Commission also proposed an updated Cybersecurity Blueprint⁵³ on cybersecurity crisis management that, once adopted by the Council, would provide a solid framework for cyber crisis management. While it does not introduce new mechanisms and tools as such, it does present in a clear and simple manner how to make use of available mechanisms across the full crisis management lifecycle. The Action Plan on the Cybersecurity of Hospitals and Healthcare Providers⁵⁴ is another example of the need to accelerate collective action in particularly vulnerable areas. Moreover, the Strategy announces actions in the field of access to data by law enforcement, including the preparation of an impact assessment with a view to updating rules on data retention at Union level.

The Strategy reinforces that attempts to decouple internal and external security aspects are not feasible in the current context: threats originating outside the EU have a direct impact on the lives of European citizens. For example, drugs produced in Latin America and illegally trafficked to Europe end up in European cities and towns, thus inevitably increasing insecurity close to home. Geopolitical events, such as the new Taliban regime in Afghanistan and the fall of the al-Assad regime in Syria generate changes in drug trafficking routes and increase terrorist threat levels across Member States. Incidents in undersea critical infrastructure in the Baltic States have the potential to disrupt a larger range of critical and essential services in Europe, such as energy supply and telecommunication services. In response to these latter incidents, the Commission and the High Representative presented an Action Plan to enhance the security and resilience of submarine cables.⁵⁵

IV. Views from other EU Institutions and Actors in the Area of Security

Shaping the EU’s security is not a task which can be carried out by the Commission alone. Co-legislators, Member States’ authorities and other actors including EU agencies and bodies operating in this area carry an important responsibility in materialising the EU’s security architecture. This section provides an overview of their main positions.

The Council adopted in December 2024 strategic guidelines for the next five years in the area of freedom, security and justice⁵⁶. The fact that these guidelines focus on implementation should not be seen as a lack of ambition, given the complexity and number of legislative and policy instruments adopted in recent years. The 39 guidelines provide useful insight into the Council’s position in both a general and specific sense. For example, with regard to serious and organised crime, specifically the fight against corruption, the guidelines underline the continued need to focus on and implement the recommendations put forward by the High-level Group on access to data for effective law enforcement (e.g., the adoption of rules on data retention). In light of the EU’s challenges related to the changing security landscape worsened by global conflicts and climate change, the guidelines also point out that initiatives in the Justice and Home Affairs area should contribute to strengthening preparedness and crisis response at Union level. With “Security, Europe” as its core motto, the Polish Presidency of the Council of the European Union had set this specific area at the heart of the EU’s priorities.

In recent years, the European Parliament has adopted a number of resolutions reflecting its position on EU security. As co-legislator, it recently adopted a resolution on the White paper on the future of European defence.⁵⁷ Specifically, this resolution calls on the EU to invest substantially more in defence, to integrate a defence and security dimension in most Union policies,⁵⁸ and to embed a Preparedness by Design principle horizontally and consistently across EU institutions, bodies, and agencies. Earlier resolutions – following Commission strategies and actions in the area of organised crime,⁵⁹ cybersecurity,⁶⁰ and the Security Union Strategy⁶¹ – offer further guidance on the Parliament’s priorities. Having reflected on the new opportunities for fraud with EU funds following the COVID-19 pandemic (in connection to the disbursement of NextGenerationEU), the European Parliament also emphasised the need to step up the fight against organised crime at the Union and national levels and called on the Commission to revise the Framework Decision on the fight against organised crime.⁶² As regards the issue of funding, a visible difference exists between the Parliament’s approach towards cybersecurity versus the traditional justice and home affairs policies. While for cybersecurity and related infrastructure deployment, the Parliament calls for a coherent use of EU funds and the need to exploit synergies between different EU programmes;⁶³ it expresses deep concerns and calls for adequate funding and staffing of EU Justice and Home Affairs agencies and bodies in order for the EU to deliver on the Security Union Strategy.⁶⁴

EU agencies and bodies operating in the security sphere carry an important responsibility in forming future policy to prevent, anticipate, and respond to cross-border threats. Europol’s most recent Serious and Organised Crime Threat Assessment report 2025⁶⁵ identifies cyber-attacks, online fraud schemes, (online) child sexual exploitation, migrant smuggling, drug trafficking, firearms trafficking, and waste crime as key threats. According to Europol, a particularly worrying and recent trend concerns the increased collaboration between criminal networks and hybrid threat actors. Guidance on the terrorism situation and trends in Europe is provided by, for example, the European Union Terrorism Situation and Trend Report.⁶⁶ Such terrorism and situation trend reports provide input for the future EU Counter-terrorism Agenda, which will need to reflect on the rise in terrorist attacks, the increased use of technological innovations such as Artificial Intelligence, and the active involvement of young individuals in terrorism and violent extremism. The increase in cyber-attacks and crimes committed through online means, notably ransomware and malware attacks, is also highlighted in the most recent ENISA Threat Landscape report.⁶⁷ All these agencies make an important contribution to shaping the EU’s priorities in the area of security by raising situational awareness in their operational activities.

V. Conclusion

The increased attention to security across the EU, particularly in the current threat landscape, should be welcomed. However, the consolidation of the EU’s cross-cutting approach to security has translated into a growing number of initiatives dealing with this topic, leaving the notion as open as it is salient.

In contrast with the previous Commission mandate, when the Security Union Strategy served as a comprehensive umbrella for the EU’s security policy, there is currently no single initiative to bring together all security matters. In addition to the recently adopted Preparedness Union Strategy and Internal Security Strategy, there are also sectoral strategies, such as those related to economic security, maritime security, and energy security. The proposed initiatives raise security concerns to the highest political level. it remains to be seen how this will be organised in a clear and convincing way, ensuring streamlining and coordination.

An efficient legislative and operational environment, with enhanced clarity on the role, responsibilities, added value, and complementarities of the various actors in the security landscape, is indispensable and urgent. The operationalisation of the mainstreaming of security and preparedness into future EU policies and initiatives, as announced in the Preparedness Union Strategy and the Internal Security Strategy, may reveal how the EU’s concept of security will be further framed. Such clarity is a prerequisite for the trust necessary when providing an integrated and holistic approach to existing and potential security challenges.

With the concept of security inherent to a wide range of different instruments, actions, and policy areas, there is a constant risk of overlaps, divergencies in interpretation, and a duplication of efforts that must be avoided if the EU is to live up to its responsibility under the Treaties to protect citizens. While certain areas (such as the protection of critical infrastructure) are recognised in multiple strategies, other areas (such as the dependencies on high-risk vendors for the provision of critical services, materials, technology, and equipment) have not received the same concerted attention. Such gaps need to be addressed in a systematic way.

Stronger governance would also help address the challenge of funding for security policies and agencies, particularly in view of the upcoming negotiations on the next multiannual financial framework. A clear prioritisation and political will is needed to balance specific priorities, such as the strengthening of Europol and Frontex with new initiatives, e.g., the ReArm Europe plan to mobilise up to €800 billion for defence investment and the InvestAI initiative to mobilise €200 billion of investment in Artificial Intelligence.

Another point for consideration concerns the need to balance the work on preparing and negotiating new initiatives versus the need to timely and correctly implement agreed legislation. Without proper implementation and enforcement, legislative instruments and policies risk losing their impact in practice. Urgent political developments necessitate prompt adaptation and reaction at the EU and national levels. The EU level added value, and the merit of effective governance on these issues, thereby resides in ensuring stronger coordination, resource and intelligence pooling, increased collective efficiency, and a scale effect, building on Member States’ efforts.

Ultimately, while security may not be better assured through the development of a firm construct or concept, vigilance remains of the essence for the EU in order to maintain a horizontal overview and ensure a coordinated approach towards the protection of its own security, especially in today’s times.