[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fr_lvya_wGpsSCu_HTFcFagpGH-FRfTYZ9zkzQ4jGa3c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"a87122ba-4a7e-438e-b78a-7de19f1c7a9d","nearly-half-of-eu-it-providers-take-over-3-months-to-apply-critical-patches","08c22924-b13f-4550-ae67-ad4d71e473aa","Nearly Half of EU IT Providers Take Over 3 Months to Apply Critical Patches","ENISA's 2026 assessment exposes a critical operational gap: despite strong national cybersecurity scores on paper, 45% of EU IT service management providers are taking more than three months to apply critical patches, leaving their customers exposed for extended windows of risk. This delay is especially dangerous in a supply chain context, where a single unpatched managed service provider can become a vector for compromise across dozens or hundreds of downstream organisations. The accelerating pace of AI-assisted vulnerability discovery means attackers are finding and exploiting flaws faster than ever, making slow patching cycles increasingly untenable. The disconnect between reported compliance posture and actual patching behaviour highlights how self-assessed frameworks can mask real-world weaknesses.","**Immediate actions:**\n- Establish a maximum 30-day SLA for critical patch application and audit current compliance against that target immediately.\n- Deploy automated patch management tooling to reduce manual effort and human delay in the patching pipeline.\n\n**Long-term improvements:**\n- Require IT service providers to contractually commit to measurable patching timelines and report compliance quarterly.\n- Build a continuously updated asset and software inventory so every critical system is tracked and no asset is missed during patch cycles.\n- Integrate AI-assisted vulnerability intelligence feeds to prioritise exploitable vulnerabilities before attackers can weaponise them.\n\n**Detection & verification measures:**\n- Run regular authenticated vulnerability scans against all managed environments to verify patches have been successfully applied.\n- Conduct third-party audits of supplier patch management processes as part of annual supply chain risk reviews.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-03: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"CIS Control 7: Continuous Vulnerability Management (v8)":20,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":21,"NIST CSF 2.0 RS.MI-03: Newly identified vulnerabilities are mitigated or documented as accepted risks":22},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure in security acquisition and maintenance, making the 45% of non-compliant IT providers directly in breach of this requirement.","SI-2 mandates that organisations identify, report, and correct information system flaws within defined time periods, which would have imposed enforceable deadlines that most surveyed providers were clearly missing.","CIS Control 7 requires organisations to continuously assess and remediate vulnerabilities on a risk-prioritised schedule, directly addressing the multi-month patching delays identified in the ENISA report.","Annex A control 8.8 requires timely identification and remediation of technical vulnerabilities, which the ENISA findings show a large proportion of IT providers are systematically failing to meet.","This category requires organisations to act on discovered vulnerabilities in a timely manner, directly targeting the gap between vulnerability discovery and the months-long patching delays observed.","published","2026-11-11T07:20:22.876588+00:00","2026-11-11T07:20:22.845+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Feu-enisa-cybersecurity-report\u002F","eu-cyber-scores-look-healthy-but-45-of-surveyed-it-providers-take-months-to-patc-1ecb9a","EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,51],{"slug":34,"name":46,"problem":47},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":49,"problem":50},"Automated patch management","Known holes get closed in days, not months.",{"slug":52,"name":53,"problem":54},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]