European cybersecurity challenges and policy gaps. The Estonian experience in cybersecurity

Following the COVID-19 pandemic, the European Union hasstrengthened its cybersecurity policies to address the growing threats generated byincreased digital dependence, including attacks on critical infrastructures,individuals, and businesses. While notable progress has been made, fragmentationremains a major challenge. Legal and regulatory advancements, such as the NIS2Directive, the Cyber Resilience Act, and DORA, have harmonized standards andreduced disparities among Member States. Horizontal fragmentation between EUinstitutions and agencies has improved through strengthened ENISA competencesand cooperation mechanisms like CERT-EU, the CSIRTs network, and CyCLONe,yet overlapping mandates and the absence of a central coordinating authority persist.Vertical fragmentation, involving the EU, Member States, and the private sector,remains pronounced, as sovereign prerogatives and limited information-sharinghinder coherence. This study evaluates the EU’s post-pandemic cybersecurityframework, identifies structural and institutional challenges, and draws lessons fromEstonia’s cybersecurity model using qualitative analysis of EU strategies, ENISAand Europol reports, and academic literature.