ENISA: 45% of surveyed EU IT providers take months to patch
Original title: EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch
The EU Cybersecurity Index averages 71.53, but ENISA says the figure is not comparable with 2024 and does not show supplier patch speed.
ENISA’s 2026 assessment kept the EU cyber threat level at substantial for the two years to July 2026. Forty-five percent of surveyed IT service providers took more than three months to patch critical systems, and 43 percent ran no cybersecurity assessment for a year. The revised index averages 71.53 of 100 after a framework change, so it cannot be compared with 2024. Manufacturers have had to report actively exploited vulnerabilities since 11 September 2026.
Unconfirmed: ENISA says it is still evaluating AI’s impact and has not yet included it in the substantial threat rating.
- Twenty-two of 27 member states score between 60 and 80; none scores below 40.
- Member states score 89.91 on supply-chain practices, with 25 at the advanced level.
- Thirty-seven percent named supply-chain risk management the hardest NIS2 requirement.
- Essential and important entities score 26.30 on sharing information with peers.
- The Cyber Resilience Act applies in full from 11 December 2027.
- Organizations
- ENISA
From the original article
3 min read at helpnetsecurity.com
Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union. Attackers can turn a newly disclosed flaw into a working attack within days, and sometimes within hours or minutes.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.