Nearly Half of EU IT Providers Take Over 3 Months to Apply Critical Patches
Written by AI from the linked story. Not reviewed by an editor. How this works
ENISA's 2026 assessment exposes a critical operational gap: despite strong national cybersecurity scores on paper, 45% of EU IT service management providers are taking more than three months to apply critical patches, leaving their customers exposed for extended windows of risk. This delay is especially dangerous in a supply chain context, where a single unpatched managed service provider can become a vector for compromise across dozens or hundreds of downstream organisations. The accelerating pace of AI-assisted vulnerability discovery means attackers are finding and exploiting flaws faster than ever, making slow patching cycles increasingly untenable. The disconnect between reported compliance posture and actual patching behaviour highlights how self-assessed frameworks can mask real-world weaknesses.
Tactical Insight
Immediate actions
- Establish a maximum 30-day SLA for critical patch application and audit current compliance against that target immediately.
- Deploy automated patch management tooling to reduce manual effort and human delay in the patching pipeline.
Long-term improvements
- Require IT service providers to contractually commit to measurable patching timelines and report compliance quarterly.
- Build a continuously updated asset and software inventory so every critical system is tracked and no asset is missed during patch cycles.
- Integrate AI-assisted vulnerability intelligence feeds to prioritise exploitable vulnerabilities before attackers can weaponise them.
Detection & verification measures
- Run regular authenticated vulnerability scans against all managed environments to verify patches have been successfully applied.
- Conduct third-party audits of supplier patch management processes as part of annual supply chain risk reviews.