EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch
Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union. Attackers can turn a newly disclosed flaw into a working attack within days, and sometimes within hours or minutes.
Those providers run systems for other organizations, so a slow patch at one becomes exposure for the customers that depend on it, and 43% of them ran no cybersecurity assessment over a full year. ENISA kept the EU’s cyber threat level at substantial for the two years to July 2026, unchanged from its previous assessment. Frontier AI will cut vulnerability discovery from days to hours, and a provider on a three-month patch cycle is counting in quarters while attackers count in days.
National scores are high
ENISA’s revised EU Cybersecurity Index puts the EU average at 71.53 out of 100. Twenty-two of the 27 member states score between 60 and 80, two score above 80, three fall between 40 and 60, and none falls below 40. ENISA changed the framework this year, so the numbers cannot be compared with the 2024 edition. The index tracks national policy and practice, and the patching figures above come from a separate ENISA survey of organizations. A high national score says little about how fast the supplier running your systems patches.
Supply-chain numbers split the same way. Member states score 89.91 on supply-chain management practices by essential and important entities, with 25 countries at the advanced level. In the survey, 37% of organizations named supply-chain risk management as the hardest NIS2 requirement to implement, and more than a third outside banking said they feel predominantly unprepared. The controls exist in most countries. The confidence does not.
AI moves the bottleneck to triage
Frontier AI is industrializing vulnerability discovery. Finding a flaw costs less, and vulnerability reports are likely to arrive faster than many organizations can triage, validate and fix them. Anthropic’s Claude Mythos, introduced in early 2026, marked a substantial advance in what these models can do. The slow steps now come after discovery: triage, prioritization, coordinated disclosure and remediation.
Some critical service providers may be pushed to autonomous patching because organizational approval takes too long. Automated updates can break systems and cause downtime, and verifying AI-generated patches may become a bottleneck of its own. Smaller organizations may find this harder than large ones.
The substantial rating does not yet count AI. ENISA is still evaluating AI’s impact before folding it into the threat assessment, so the rating predates the factor that now acts as a force multiplier for attackers.
What changes for buyers
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the Cyber Resilience Act Single Reporting Platform. Once a fix or mitigation exists, notified vulnerabilities are published in the European Vulnerability Database, with the manufacturer’s agreement. The CRA applies in full from 11 December 2027. That gives CISOs a new source for checking vendor products, though the slow patching above sits with service providers.
ENISA is pushing member states to require critical infrastructure operators to attest zero-trust baselines, resilient incident response capabilities during annual audits, and clear escalation paths for AI-accelerated incidents.
Essential and important entities score far lower on sharing information with peers: 26.30, with 23 member states at the developing level. ENISA wants more private-sector participation in ISACs, starting with low-maturity sectors, and puts that task on member states and on itself.
Strategies: CISSP exam prep with ISC2 experts
