European regulators: traditional cyber perimeter defense obsolete as internal errors cause most outages

The European Supervisory Authorities (EBA, EIOPA, ESMA) published their inaugural DORA baseline report, analyzing 3,383 major ICT incidents across European financial entities. Direct cyberattacks accounted for only 10% of severe disruptions; nearly a third stemmed from internal system errors and third-party dependency failures. The findings challenge the perimeter-focused security model and push firms toward identity-centric, automated resilience.

Bottom line — The DORA report forces European financial firms to pivot from perimeter defense to continuous third-party monitoring and automated fault isolation.

Go deeper (8)

• The ESAs' baseline report transforms DORA compliance from a speculative exercise into an empirical risk strategy, per Ali Run AIOps' analysis.
• CrowdStrike reports AI-enabled attacks surged 89% during 2025, with average breakout time at 29 minutes and a record 27 seconds, according to AI CERTs News.
• Microsoft measured AI-automated phishing click-through at 54%, dwarfing legacy lure performance, the same source notes.
• Check Point recorded 1,968 weekly attacks per organization, a 70% leap from 2023, per AI CERTs News.
• Darktrace notes 70% of incidents start with stolen or abused accounts, not packet exploits, undermining traditional perimeter defenses.
• A Digitimes piece argues corporate cybersecurity's perimeter model — firewalls, email gateways, antivirus — needs rethinking for the AI era, as summarized by AIToday.
• CISA and Five Eyes released guidance on April 30, 2026, recommending graduated autonomy for AI agents, least privilege tokens, and human-in-the-loop checkpoints for destructive actions, per AI CERTs News.
• Gartner expects autonomous response adoption to hit 40% of enterprises by 2027, the same outlet reports.

Read the reporting