In its 2026 assessment, the EU Agency for Cybersecurity found that 45 percent of surveyed EU IT service management providers needed more than three months to patch critical systems. Attackers can weaponize newly disclosed flaws within days or hours, so a quarter-long patch cycle leaves customers exposed. The same assessment found that a newly disclosed flaw can become a working attack within days, and sometimes within hours or minutes.
These providers run systems for other organizations, so a slow patch at one creates downstream exposure for every customer that depends on those systems. The survey also found that 43 percent of those providers ran no cybersecurity assessment over a full year, meaning a large share of the industry went an entire year without any formal evaluation of its security posture.
ENISA held the EU cyber threat level at substantial across the two years ending in July 2026, unchanged from its previous assessment. The substantial rating leaves out AI. The agency continues to assess AI’s impact before adding it to the threat rating, so the substantial rating came out before AI became a force multiplier for attackers.
Frontier AI is industrializing vulnerability discovery, cutting the time to find flaws from days to hours. Anthropic’s Claude Mythos, introduced in early 2026, marked a substantial advance in what these models can do, representing a major capability jump that further compresses the window for defenders to respond.
After discovery, the slow steps remain: triage, prioritization, coordinated disclosure and remediation. These post-discovery workflows have become the primary bottleneck, as vulnerability reports now arrive faster than organizations can triage, validate and fix them. Finding flaws has also become cheaper, which means more reports are likely to arrive than many organizations can handle.
ENISA says slow internal approval could push some critical service providers toward autonomous patching. Automated updates can break systems, triggering downtime, while checking AI-written patches may create another bottleneck. Smaller organizations may find autonomous patching harder than large ones.
The EU average on ENISA’s revised Cybersecurity Index is 71.53 out of 100. Of the 27 member states, 22 score between 60 and 80, two exceed 80, three land between 40 and 60, and none drops below 40. ENISA changed the framework in 2026, so readers cannot compare the numbers with the 2024 edition. The index covers national policy and practice, but the patching figures come from a different ENISA survey of organizations.
Strong national results do not show how quickly a supplier patches the systems it runs.
On supply-chain management practices, essential and important entities across member states score 89.91, with 25 countries reaching the advanced level. The same survey found that 37 percent of organizations call supply-chain risk management the toughest NIS2 requirement — the EU’s security requirements for essential and important entities — to put in place, while more than a third of non-banking organizations say they feel unprepared. Most countries have the controls in place, but confidence in them is lacking.
When it comes to sharing information with peers, essential and important entities score just 26.30, and 23 member states remain at the developing level. ENISA is calling for greater private-sector involvement in information sharing and analysis centers, beginning with sectors at low maturity, and assigned that work to member states and to ENISA itself. ENISA is also urging member states to mandate that critical infrastructure operators verify zero-trust baselines, maintain resilient incident response capabilities during annual audits, and establish clear escalation paths for incidents accelerated by AI.
Manufacturers of digital products sold in the EU must use the Cyber Resilience Act Single Reporting Platform to disclose actively exploited vulnerabilities and severe incidents. The obligation started on 11 September 2026.
Vulnerabilities that have been reported appear in the European Vulnerability Database after a fix or mitigation is in place, and only if the manufacturer agrees. Full application of the CRA begins on 11 December 2027. This gives CISOs a new tool for vetting vendor products, though the slow patching problem lies with service providers.
AISLE, described as a pioneer in AI-native vulnerability lifecycle management, said on Sept. 14, 2026 that it backed the launch of the EU’s Cyber Resilience Act Single Reporting Platform, which ENISA develops, maintains and operates. The platform was secured by AISLE’s sovereign vulnerability management platform in partnership with ENISA and went live for the first CRA reporting deadline on 11 September 2026. AISLE will keep its full loop process running continuously to support future SRP releases. The SRP is the single reporting channel for manufacturers of digital products sold into the EU, and under the CRA those manufacturers must disclose actively exploited vulnerabilities and severe incidents through it.
Hans de Vries, Chief Cybersecurity & Operations Officer at ENISA, said the platform applies technical and organizational security measures to keep submitted information confidential. ENISA operates the SRP under the CRA framework.
For defenders, the CRA SRP reporting deadlines are tight: manufacturers have 24 hours from awareness of a qualifying event to submit an initial entry, then 72 hours to provide a more detailed notification. ENISA warns that a provider on a three-month patch cycle measures time in quarters while attackers measure it in days.
Join the discussion