UK Prime Minister Andy Burnham has been meeting with the EU to discuss tackling cybersecurity threats. The aim is for deeper cooperation to form a united front against hostile nation states such as Russia.

It comes after Germany blamed Russia for launching a drone fitted with explosives at Leipzig airport. Burnham also suggested at the Labour Party conference that he is seeking a closer relationship with the EU.

The latest talks, between Burnham and German Chancellor Friedrich Merzn in Berlin, focused on creating a shared defence against state-sponsored cyber-attacks and threat intelligence across borders. They also looked at aligning security regulations to make it harder for adversaries to exploit gaps between different national frameworks.

So, what does that mean for UK cybersecurity?

Closer Ties

The talks between the UK and Germany are much-needed at a time of global geopolitical instability including the ongoing Russia-Ukraine war. Adding to the risk is the fact that Brexit removed the UK from the formal EU-level intelligence-sharing mechanisms.

The talks come as hostile states are treating Europe as “a single target for hybrid warfare,” according to Dray Agha, senior manager, tactical response at Huntress. He describes “a sharp increase” in disruptive attacks on critical national infrastructure and transport hubs. “Defending against these campaigns requires a unified response because threat actors do not care about political borders.”

Both the UK and EU recognise that fragmented defences are a “strategic liability,” says Tracey Hannan-Jones information security consulting director at UBDS Group.

 “It’s safe to say, the threat environment is the most urgent driver,” Hannan-Jones tells SC Media UK. “Russian hybrid operations have escalated in both frequency and boldness. Germany’s accusation that Russia was responsible for launching an explosive-laden drone at Leipzig airport is one of the most concrete examples of how hybrid warfare has moved beyond the digital into the physical. It’s a clear signal that cyber activity does not exist in isolation from broader geopolitical aggression.”

Greater international cooperation is “a logical step” in strengthening collective cyber resilience, says Doug Jewitt, security consultant, Infinity Group. “Threat actors operate across jurisdictions, making it increasingly important for governments, law enforcement and security organisations to share intelligence, coordinate responses and work towards a common understanding of emerging risks.”

On the technical side, talks explored alignment with the EU’s Network and Information Systems 2 (NIS2) Directive, as well as threat intelligence sharing between national authorities, and coordinated incident response frameworks.

Hannan-Jones explains how NIS2, in force across EU member states since October 2026, is creating growing regulatory divergence between the UK and the EU. “For those organisations operating across both jurisdictions, that divergence creates a compliance complexity that both sides will now have an interest in resolving.”

Formal Agreements

As the talks progress, businesses should expect to see formal agreements happen. Agha predicts these will focus sharing real-time intelligence between UK and European cyber agencies. “Joint exercises to test responses to major cross-border incidents will likely become standard practice. This alignment will create a much stronger deterrent against nation-state attackers.”

Hannan-Jones believes the most probable outcome from the talks is a formal UK-EU cybersecurity cooperation agreement: “One that stops well short of broader political realignment but delivers meaningful operational benefits.”

This would likely include alignment or mutual recognition around NIS2 obligations and “observer” or “associate” status for the UK in EU cyber bodies such as the European Union Agency for Cybersecurity (ENISA), and structured information-sharing agreements between national CERTs, she says.

Meanwhile, Burnham has suggested rejoining the EU, but this is “a long-term political process dependent on factors far beyond cybersecurity policy,” she says.

Cybersecurity Benefits 

Experts believe the collaboration between the UK and the EU is a good thing for businesses. Security teams will benefit from a much wider view of the threat landscape, says Agha. He points out that early warning systems will improve as data flows more freely between national agencies. “This means defenders can block new attack methods before they reach UK networks.”

However, it also means that UK organisations, particularly those with EU clients, supply chains, or operations in covered sectors – will “see the compliance bar rise again,” according to Hannan-Jones.

For example, NIS2 introduces mandatory obligations across energy, transport, digital infrastructure, healthcare, and financial services.  “Even where UK firms are not directly subject to NIS2, you may find yourselves drawn in through contracts with EU entities or as part of a regulated supply chain,” she warns.

She therefore thinks it’s a good idea to conduct a NIS2 gap analysis. This will be especially key if you operate in a covered sector, supply to EU entities, or handle data across jurisdictions, she says. “The gap analysis will tell you where you stand and what needs to change.”

Meanwhile, supply chain risk is a major theme businesses should be aware of, says Hannan-Jones. “Regulators and customer are scrutinising third-party cyber practices with greater rigour than was the previous norm and any undocumented, untested approach to supplier risk is now a material vulnerability – both commercially and regulatorily.”

Be Aware 

Right now, companies should ensure they’re aware of the hybrid threats they face. Tiernan Connolly, managing director, cyber and data resilience at Kroll advises firms to be “investing in proactive defence, preparedness and the ability to recover quickly from disruption”.

This means an integrated approach to resilience is “essential,” bringing together physical and cyber security controls with appropriate measures to mitigate insider threats and supply chain risks, says Connolly. “In a world where digital and energy infrastructure are closely linked, and geopolitical tensions are driving hybrid threats, this is becoming even more important. The EU’s Critical Entities Resilience Directive, for example, highlights the need for a broader, integrated approach to resilience in the face of potentially systemic risks.”

Experts also advocate focusing on the basics of cybersecurity, which will help mitigate many of the risks firms face.

While increased cooperation is welcome, organisations “shouldn’t lose sight of the fundamentals,” according to Connolly. “Most successful attacks still exploit well-known weaknesses, whether that’s unpatched systems, poor identity controls, third-party risk or gaps in incident response preparedness.”

Kate O'Flaherty Cybersecurity and privacy journalist