[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh5p164z23rUEs7tzaD753KnN6efi2hLx-jST4xXt2zg":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"08c22924-b13f-4550-ae67-ad4d71e473aa","EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch","eu-cyber-scores-look-healthy-but-45-of-surveyed-it-providers-take-months-to-patc-1ecb9a","Forty-five percent of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems, according to ENISA’s 2026 assessment of cybersecurity in the Union. Attackers can turn a newly disclosed flaw into a working attack within days, and sometimes within hours or minutes. Those providers run systems for other organizations, so a slow patch at one becomes exposure for the customers that depend on it, and … More → The post EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch appeared first on Help Net Security.","ENISA's 2026 assessment reveals that 45% of IT service management providers in the EU take over three months to apply critical patches, leaving customers vulnerable. Despite high national cybersecurity scores and advanced supply-chain management practices reported by member states, a significant portion of organizations struggle with timely patching and NIS2 requirements. The report also highlights the accelerating pace of vulnerability discovery due to AI, which could further widen the gap between attackers and defenders.","45% of EU IT providers take months to patch critical systems, ENISA reports.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Feu-enisa-cybersecurity-report\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F01\u002F21142123\u002Feu-people-1500.webp","2026-11-11T06:00:09+00:00","2026-11-11T07:00:26.326389+00:00",7,[17,20],{"name":18,"type":19},"Anthropic","vendor",{"name":21,"type":22},"AI","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":23,"icon":25,"name":26,"slug":27},null,"Supply Chain","supply-chain",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"4fd32ef4-29b8-4ee4-b88f-ecfb77fbf9c1","NIS2","nis2",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18],{"controls":49,"vendors":136},[50,79,107],{"slug":51,"name":52,"problem":53,"products":54},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":80,"name":81,"problem":82,"products":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":80,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":108,"name":109,"problem":110,"products":111},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":147},"nearly-half-of-eu-it-providers-take-over-3-months-to-apply-critical-patches","Nearly Half of EU IT Providers Take Over 3 Months to Apply Critical Patches","ENISA's 2026 assessment exposes a critical operational gap: despite strong national cybersecurity scores on paper, 45% of EU IT service management providers are taking more than three months to apply critical patches, leaving their customers exposed for extended windows of risk. This delay is especially dangerous in a supply chain context, where a single unpatched managed service provider can become a vector for compromise across dozens or hundreds of downstream organisations. The accelerating pace of AI-assisted vulnerability discovery means attackers are finding and exploiting flaws faster than ever, making slow patching cycles increasingly untenable. The disconnect between reported compliance posture and actual patching behaviour highlights how self-assessed frameworks can mask real-world weaknesses.",[142,143,144,145,146],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-03: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":148,"NIST SP 800-53 SI-2: Flaw Remediation":149,"CIS Control 7: Continuous Vulnerability Management (v8)":150,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":151,"NIST CSF 2.0 RS.MI-03: Newly identified vulnerabilities are mitigated or documented as accepted risks":152},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure in security acquisition and maintenance, making the 45% of non-compliant IT providers directly in breach of this requirement.","SI-2 mandates that organisations identify, report, and correct information system flaws within defined time periods, which would have imposed enforceable deadlines that most surveyed providers were clearly missing.","CIS Control 7 requires organisations to continuously assess and remediate vulnerabilities on a risk-prioritised schedule, directly addressing the multi-month patching delays identified in the ENISA report.","Annex A control 8.8 requires timely identification and remediation of technical vulnerabilities, which the ENISA findings show a large proportion of IT providers are systematically failing to meet.","This category requires organisations to act on discovered vulnerabilities in a timely manner, directly targeting the gap between vulnerability discovery and the months-long patching delays observed."]