EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch
Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union.
Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union.
Attackers can turn a newly disclosed flaw into a working attack within days, and sometimes within hours or minutes.
Those providers run systems for other organizations, so a slow patch at one becomes exposure for the customers that depend on it, and 43% of them ran no cybersecurity assessment over a full year.
Frontier AI will cut vulnerability discovery from days to hours, and a provider on a three-month patch cycle is counting in quarters while attackers count in days.
Finding a flaw costs less, and vulnerability reports are likely to arrive faster than many organizations can triage, validate and fix them.
The index tracks national policy and practice, and the patching figures above come from a separate ENISA survey of organizations; a high national score says little about how fast the supplier running your systems patches.
In the survey, 37% of organizations named supply-chain risk management as the hardest NIS2 requirement to implement, and more than a third outside banking said they feel predominantly unprepared.
Anthropic’s Claude Mythos, introduced in early 2026, marked a substantial advance in what these models can do.
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the Cyber Resilience Act Single Reporting Platform.
Once a fix or mitigation exists, notified vulnerabilities are published in the European Vulnerability Database, with the manufacturer’s agreement.
Some critical service providers may be pushed to autonomous patching because organizational approval takes too long, and automated updates can break systems and cause downtime, and verifying AI-generated patches may become a bottleneck of its own.
That gives CISOs a new source for checking vendor products, though the slow patching above sits with service providers.
What happened
Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union.
Attackers can turn a newly disclosed flaw into a working attack within days, and sometimes within hours or minutes.
Those providers run systems for other organizations, so a slow patch at one becomes exposure for the customers that depend on it, and 43% of them ran no cybersecurity assessment over a full year.
What changed
Frontier AI will cut vulnerability discovery from days to hours, and a provider on a three-month patch cycle is counting in quarters while attackers count in days.
Finding a flaw costs less, and vulnerability reports are likely to arrive faster than many organizations can triage, validate and fix them.
Who is affected
The index tracks national policy and practice, and the patching figures above come from a separate ENISA survey of organizations; a high national score says little about how fast the supplier running your systems patches.
Why it matters
In the survey, 37% of organizations named supply-chain risk management as the hardest NIS2 requirement to implement, and more than a third outside banking said they feel predominantly unprepared.
Anthropic’s Claude Mythos, introduced in early 2026, marked a substantial advance in what these models can do.
Technical details
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the Cyber Resilience Act Single Reporting Platform.
Once a fix or mitigation exists, notified vulnerabilities are published in the European Vulnerability Database, with the manufacturer’s agreement.
Response
Some critical service providers may be pushed to autonomous patching because organizational approval takes too long, and automated updates can break systems and cause downtime, and verifying AI-generated patches may become a bottleneck of its own.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.