EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch
45% of EU IT providers take months to patch critical systems, ENISA reports.
ENISA's 2026 assessment reveals that 45% of IT service management providers in the EU take over three months to apply critical patches, leaving customers vulnerable. Despite high national cybersecurity scores and advanced supply-chain management practices reported by member states, a significant portion of organizations struggle with timely patching and NIS2 requirements. The report also highlights the accelerating pace of vulnerability discovery due to AI, which could further widen the gap between attackers and defenders.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Anthropic?
Get an email when a new story names Anthropic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonENISA's 2026 assessment exposes a critical operational gap: despite strong national cybersecurity scores on paper, 45% of EU IT service management providers are taking more than three months to apply critical patches, leaving their customers exposed for extended windows of risk. This delay is especially dangerous in a supply chain context, where a single unpatched managed service provider can become a vector for compromise across dozens or hundreds of downstream organisations. The accelerating pace of AI-assisted vulnerability discovery means attackers are finding and exploiting flaws faster than ever, making slow patching cycles increasingly untenable. The disconnect between reported compliance posture and actual patching behaviour highlights how self-assessed frameworks can mask real-world weaknesses.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.