Since 2016, no incident anywhere in the EU has been classified as large-scale - not WannaCry, not NotPetya, not the CrowdStrike outage. The reason is not that nothing large happened. It is that classification is a decision somebody has to make.

The EU bought incident response capacity for its member states and then audited what happened to it: 84 % of the money went to preparation, and 89 % of the response days were never used. Why that outcome is structural.