Help Net Security reports ENISA: 45% of surveyed EU IT providers patch slowly

What happened

According to Help Net Security, ENISA’s 2026 assessment of cybersecurity in the Union found that 45% of surveyed IT service management providers in the EU took more than three months to apply critical patches to critical systems Help Net Security. Help Net Security also reports that 43% of those providers ran no cybersecurity assessment over a full year. The outlet notes that these providers run systems for other organizations, so a slow patch at one can become exposure for its customers.

Help Net Security reports the following other figures from the assessment:

• ENISA kept the EU cyber threat level at substantial for the two years to July 2026, unchanged from its previous assessment.
• The revised EU Cybersecurity Index puts the EU average at 71.53 out of 100. According to the article, 22 of 27 member states score between 60 and 80, and none falls below 40. ENISA changed the framework this year, so the figures cannot be compared with the 2024 edition.
• Member states score 89.91 on supply-chain management practices by essential and important entities. In the survey, 37% of organizations named supply-chain risk management as the hardest NIS2 requirement to implement.
• Essential and important entities score 26.30 on sharing information with peers.

The article says the patching figures come from a separate ENISA survey of organizations and that the index tracks national policy and practice. It says the substantial threat rating does not yet account for AI, because ENISA is still evaluating AI’s impact.

Not confirmed: the primary ENISA report was not among the sources reviewed, so these figures are as reported by Help Net Security. The sources do not name any provider, vulnerability or attack, and they do not report any exploitation.

Am I affected?

The source does not identify specific providers or products, so affected status is not confirmed for any organization. The finding is relevant if your organization relies on an EU IT service management provider to run or maintain your systems. The source does not say how many of the surveyed providers were in each category, or which customers they serve.

Help Net Security also reports that, since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through the Cyber Resilience Act Single Reporting Platform. Once a fix or mitigation exists, notified vulnerabilities are published in the European Vulnerability Database, with the manufacturer’s agreement. The article says the CRA applies in full from 11 December 2027, and that this gives CISOs a new source for checking vendor products, though the slow patching it describes sits with service providers.

What to do now

1. Identify which IT service management providers run or maintain systems for your organization.
2. Ask each one, in writing, for its actual time to apply critical patches to critical systems, and whether it ran a cybersecurity assessment in the past year. These are the two measures the survey reports on.
3. Review whether your contracts state a patch timeline. The sources do not recommend a specific threshold, so any target is your own decision.
4. For vendor products, consider the European Vulnerability Database as an additional source, as the article suggests. Per the article, it lists notified vulnerabilities once a fix or mitigation exists.

Sources

• Help Net Security: EU cyber scores look healthy, but 45% of surveyed IT providers take months to patch