• Web application and service security
• Mobile application security
• Cryptography
• Reverse engineering
• Digital forensics

This year, we organized policy roundtables in Tirana, Berlin and Brussels to discuss how we can bring the Western Balkans closer to EU’s cybersecurity mechanisms and policies, and every one of these roundtables all participants shared a call on the European Union to take a bold and strategic step: enable the phased integration of the WB6 into the European Union Agency for Cybersecurity (ENISA). This process should begin by granting observer status and developing a clear roadmap toward full membership.

The EU has acknowledged that digital transition is central to its future. Through initiatives such as the Growth Facility for the Western Balkans, the EU has emphasized that the digital resilience of the Western Balkans is crucial for convergence with the EU. But while rhetoric recognizes the digital challenge, the instruments for cybersecurity integration should be open to candidate countries. ENISA, a critical actor in safeguarding the EU’s digital infrastructure, currently offers no formal pathway for WB6 participation beyond third-country cooperation. This is not to say that there is no cooperation between ENISA and WB6; in fact, ENISA and its leadership have been very active in supporting WB6. However, we need to develop this relationship further. Considering that the EU is seeking ideas on how to advance gradual integration, ENISA is a perfect option, as it is common sense and mutually beneficial for the EU and our region.

A crucial opportunity to do so is now on the table. The European Commission is currently revising the EU Cybersecurity Act, which defines the mandate, scope, and structure of ENISA. This presents a timely opportunity to introduce the necessary legal provisions that would enable EU candidate countries to obtain observer status. Such a change would not only reflect the geopolitical reality of enlargement but also allow the WB6 to contribute meaningfully to Europe’s cyber resilience today, not just after accession.

The Western Balkans are not on the sidelines of the EU’s digital periphery; they are in the middle of it. Cyber incidents in one part of Europe are never truly local. The 2022 cyberattacks in Albania served as a wake-up call, highlighting how hostile actors exploit institutional gaps and regional vulnerabilities. Fragmentation in cybersecurity capacity across the WB6 increases the continent’s overall exposure.

What the Western Balkans need today is operational integration. In terms of advanced relations with ENISA and observer status for our region, this means participating in ENISA’s knowledge networks, contributing to its certification framework, and aligning with its incident response standards. Phased integration into ENISA is the most effective way to develop further and enhance the region’s capacity to prevent, detect, and respond to cyber threats, while also promoting legal and institutional convergence with EU norms. The EU leadership and leaders from member states have already made it clear they support gradual integration. ENISA, in this context, is a no-brainer.

The readiness is there. Most countries in the region have already established national cybersecurity agencies and adopted strategies aligned with the European Union’s Network and Information Security (NIS) Directive. But aligning with the EU Cybersecurity Act and participating meaningfully in ENISA’s work requires more than domestic reform; it requires access.

We propose a three-tiered approach. First, the EU should amend the Cybersecurity Act to allow for observer status for WB6 countries that meet basic legal and institutional criteria. This model already exists for EEA countries, such as Norway and Iceland. Second, ENISA and the European Commission should conduct feasibility assessments and provide technical support to help the WB6 meet integration benchmarks. Third, a formal roadmap for full membership should be established, linked to each country’s progress in EU accession and compliance with ENISA standards.

In the framework of the IGNITA initiative supported by the Open Society Foundations – Western Balkans, the Kosovar Centre for Security Studies (KCSS), has published a policy paper on ENISA where this roadmap is fully elaborated, as well as outlining the state of play in WB6 concerning cybersecurity, what needs to happen for the region to be ready for observs stats and arguments why such a status should enabled.

Critically, this integration must be uniform across the region. Fragmented bilateral arrangements would only entrench asymmetries. Instead, the EU should pursue a coherent regional approach, building on the momentum of the Berlin Process and the common priorities identified in the Reform and Growth Facility. The leaders’ conclusions from the Berlin Process Summit in Tirana in 2023 endorse the integration of the Western Balkans into the EU’s cybersecurity frameworks.

From the EU’s perspective, the phased integration of WB6 into ENISA would demonstrate the tangibility of the commitment to enlargement. It would also serve as a practical step toward resilience, reducing the attack surface of the European Digital Single Market. Cybersecurity is, by its nature, transnational. So, it must be its governance.

To be clear, we are not advocating shortcuts. Integration into ENISA must be earned through reform and alignment with EU norms. However, the EU must do its part by opening the door and making it clear that compliance will be rewarded with participation.

In the framework of the IGNITA initiative supported by the Open Society Foundations – Western Balkans, the Kosovar Centre for Security Studies (KCSS), has published a policy paper outlining the state of play in WB6 concerning cybersecurity, what needs to happen for the region to be ready for observer status and arguments why such a status should be enabled for WB6.

For the Western Balkans, joining ENISA would institutionalize cooperation, embed a culture of standards, and foster mutual accountability in a policy area where margins of error are shrinking. It would also send a powerful message to citizens in our region that European integration is happening across different sectors, it is tangible and a living process that delivers.

As the European Commission pushes for the implementation of the Reform and Growth Facility and as it reviews the EU Cybersecurity Act, the time to act is now. Cybersecurity integration for the Western Balkans must begin with institutional bridges. ENISA is the ideal starting point.

*This article was originally published on European Western Balkans: https://europeanwesternbalkans.com/2025/07/11/53121/ 

Authors: Dr Igli Tafa and Mentor Vrajolli