This thesis aims to display how disastrous events in the cyber domain can be understood to have root causes attributed to non-technical vulnerabilities. The goal is to show the accelerating importance in understanding the cyber domain as any other societal arena. Further, the European Union and reports about the threat landscape from the European Union Agency for Cybersecurity will be analysed. Theoretical assumption from the field of disaster risk reduction about vulnerabilities will be used to understand how vulnerabilities are understood in the empirical material. The first report which was released in the year of 2012 and the most current one from the year of 2022 will be compared to understand patterns and correlations in the development during the last decade. The results shows that the reports have multiple features that can be interpreted as understanding of how events offline relate to threats online. Further the comparison shows that even if superficial factors and their appearance have changed, the underlying vulnerabilities have much in common.