ENISA: Index averages 71.53; 45% of surveyed ICT service management entities took over three months to patch
ENISA's 2026 report gives its EU Cybersecurity Index an average of 71.53 out of 100. Only its full report, not the condensed edition, says 45% of surveyed ICT service management entities took over three months to patch, from a survey with about 105 sector respondents (derived).
By Parminder Kumar Sharma · LinkedIn · · 19 min read
The 45% is printed in ENISA's full report, not the condensed edition, and rests on about 105 sector respondents
The EU Cybersecurity Index average of 71.53 out of 100 is printed in both editions of ENISA's 2026 Report on the State of Cybersecurity in the Union: the 24 page condensed edition and the 74 page full report. The statement that 45% of surveyed ICT service management entities "took more than three months to apply critical patches to critical systems" is printed only in the full report, on page 47. A search of every page of the condensed edition finds no 45%, no 43%, no 37% and no "three months" (checked by this site). Help Net Security reported the figure on 11 November 2026 at 06:00 UTC, by its page data, and links only the condensed edition.
The figure does not come from a survey run inside this report. It traces to a different ENISA study, NIS Investments 2025: a phone survey of 1,080 professionals, fielded from May to August 2025, in which the ICT service management bar is labelled 105 organisations (read from the chart). At 45% that is about 47 organisations (derived, assuming all 105 answered the patch question; the sector base for that question is not printed).
What this does not establish. It is not the share of providers in the Union: the survey was voluntary, its sample was not weighted to the size of each sector, and ENISA prints no margin of error. It does not say what counts as a critical patch or a critical system, it does not link patch time to any incident, and it does not say how the 45% compares with 2024. The Index does not measure it either. The two numbers sit in one report but count different things, and the diagram below sets them side by side.
ENISA is the European Union's cybersecurity agency. The report is mandated by Article 18 of the NIS2 Directive and, in the report's words, its "primary target audience is the European Parliament". One interest to state once: ENISA maintains the European Vulnerability Database, the report cites an ENISA portal for the CRA Single Reporting Platform, and it recommends reinforcing the interoperability of both, so the agency is describing the case for its own services. This briefing read the full report, the condensed edition, the NIS Investments 2025 main report and its data companion from 10:11 UTC on Wednesday 11 November 2026, and used the Help Net page only to find them.
Where each figure is printed
A reader of the Help Net article may ask whether the 45% and 43% sit in the condensed edition, the full report, or another ENISA document. They sit in the full report, which cites the survey study. The condensed edition is the 24 page version that the Help Net page links to; the full report is on ENISA's publication page.
Figures in the Help Net article and where ENISA prints them. Read from the condensed edition (24 pages) and the full report (74 pages), 11 November 2026. Page numbers are the printed numbers; derived items are marked.
| Figure | Condensed edition | Full report |
|---|---|---|
| EU Index average 71.53 | Page 10 | Page 19, with a note that scores are not directly comparable with the previous Index |
| Member States by band: 0, 0, 3, 22, 2 of 27 | Page 10 | Page 19. None below 40 is derived from the two zeros |
| Supply chain practices 89.91, with 25 at advanced | Page 11 prints 89.91 and says almost all | Pages 47 and 72 print the count: 0, 0, 0, 2, 25 |
| Threat level substantial, same as 2024 | Page 8, with no dates | Pages 14 and 15; the period July 2024 to July 2026 is on page 11 |
| 45% over three months to patch | Not printed | Page 47, ICT service management sector |
| 43% with no assessment | Not printed | Page 47, worded as in 2024 |
| 37% on supply chain risk | Not printed | Page 47 (most difficult) and the note on page 41 (third of three) |
| Discovery time from days to hours | Page 19 | Page 48, with a note citing a Dutch national cyber security centre page |
What the Index counts, in ENISA's words
ENISA says the Index "comprises the methodology and the indicators needed to support the aggregated assessment of the level of maturity of cybersecurity capabilities and resources across the EU". It covers "the state of policy development and implementation, the ability of the public and private sectors to recognise threats and prevent incidents, and the capability to carry out operations to ensure resilience". So, on this site's reading of Annex C, the Index is not purely national policy. Some indicators score what Member States have set in law and strategy; others score what surveyed essential and important entities report doing.
The 2026 framework was revised, with five posture levels, and ENISA says the numbers are "not directly comparable" with the previous Index. Data collection "took place at the end of 2025". The report prints no validation method for the scores, and no total number of indicators: Annex C describes the 13 indicator results that appear in the report, which the text calls "a selection". The five highest scoring Member States average 79.86 and the five lowest 60.45, a spread of 19.41 points (derived). ENISA reads this as "an overall alignment of the MS within the EU". No Member State is named with a score anywhere in the report; the pages print averages and counts only, so no highest or lowest country can be reported.
The five posture bands and the number of Member States in each, as ENISA prints them on page 19 of the full report.
| Band | Score range | Member States |
|---|---|---|
| Foundation | 0.00 to 19.99 | 0 |
| Developing | 20.00 to 39.99 | 0 |
| Established | 40.00 to 59.99 | 3 |
| Mature | 60.00 to 79.99 | 22 |
| Advanced | 80.00 to 100.00 | 2 |
The supply chain indicator is about practices being present. The 89.91 average belongs to the indicator "adoption of supply chain management practices by essential and important entities". ENISA defines a score of 100 as "all surveyed entities have specific practices for supply chain management in place". Of 27 Member States, 25 are at advanced and 2 at mature (page 47). That records whether practices exist. It does not record how quickly a supplier applies a patch, and the report does not claim it does. ENISA itself adds that "further improvement is possible considering the relevance of the topic". In the same report, coverage of supply chain security in national strategies "remains low compared to other areas" (page 28).
The report also warns, about a different indicator, that the CSIRT maturity framework does not "assess actual operational effectiveness" and that its picture "should be interpreted as a structured baseline". That caution is about CSIRTs and not about supply chain practice, but it shows how ENISA words maturity scores: as a baseline for action, not as proof of outcomes.
What the patch survey counts
NIS Investments 2025 is ENISA's sixth annual survey. It reached "1 080 professionals representing organisations" in all 27 Member States, "mostly COOs, CIOs, CROs, CISOs and CSOs", by "dedicated phone interviews" from May to August 2025. Large enterprises are 83% of the sample and SMEs 17%. Some questions asked for "ballpark figures or high-level estimates". Participation was voluntary, and the survey report says the distribution "is not proportional to overall sector coverage across the EU" and that the sample "was not adjusted to reflect market size". ENISA also notes that the sample "varies from year to year", so changes over time may reflect the sample.
The question behind the 45% is: "What is the average time to patch critical vulnerabilities on your organisation's critical assets (IT and OT)?" (data companion). Across all 1,080 respondents, 28% (300 of 1,080, derived) answered more than three months. SMEs answered 51% and large enterprises 23%. For the ICT service management sector, which the survey report says "includes managed service providers (MSPs) and managed security service providers (MSSPs)", the chart reads 45%.
Two points from the chart. First, the 45% is not the highest sector figure: the chart reads 46% for space and 39% for public administration, against 6% for banking. The State report names only the ICT service management sector. Second, ENISA's own Annex B places ICT service management in the "risk zone" with health, maritime, railway, water, public administration and space, and says its maturity "remains at a moderate level" with "modest and mostly ad-hoc progress".
ENISA's own reading of the sector figures is a caution, not a count of harm: "even well-prepared organisations may still be exposed to risk through their third-party service providers" (survey report, page 27). The State report adds that both figures "point to a significant exposure to threats" that patching "could have otherwise mitigated". That is a statement of exposure. No incident, breach or customer harm is tied to these respondents. ENISA also says that "outsourcing or buying goods and services from a third party should not be regarded as a weakness".
Where ENISA's pages and Help Net differ
Several statements in the Help Net article match ENISA exactly. Others differ in a way a reader would want to know. None of the differences is resolved here; they are listed.
Differences between the Help Net Security article (11 November 2026, secondary) and the ENISA pages. ENISA's wording is quoted from the page named.
| Point | What the pages print | How this briefing treats it |
|---|---|---|
| Period of the 43% | State report: no assessments in 2024. Survey report: no testing in the past year, fieldwork May to August 2025. Help Net: over a full year | Both ENISA wordings shown; the survey is the source, so the period is the 12 months before mid 2025 |
| What the 37% means | State report p47 and survey p27: most difficult requirement. Survey question: choose up to three areas; patch and vulnerability management 50%, business continuity 49%, supply chain 37%. Help Net: hardest | Reported as a pick within a choice of up to three, third by share; the prose and the data disagree |
| Sector name | ENISA: ICT service management, which includes MSPs and MSSPs. Help Net: IT service management providers | ENISA's name used |
| Days to hours | ENISA's own sentence, with a note citing a Dutch national cyber security centre page. Help Net: its own sentence | Attributed to ENISA; the cited page was not read |
| What the Index tracks | Help Net: national policy and practice, with patching from a separate survey. ENISA: the survey dataset also feeds the Index; which indicators is not printed | Both stated; the link is not assumed |
| 25 at advanced | Condensed p11: almost all. Full p47 and p72: 25 advanced, 2 mature | Count attributed to the full report |
| A high score says little about patching | Not in either ENISA document | Help Net's inference, consistent with what the indicator counts |
On the 37%, the survey itself asked respondents to "Select up to three" areas, so 396 of 1,080 respondents (36.7%, derived from the chart count) named supply chain risk management among their three, while 545 (50.5%, derived) named patching and vulnerability management. Calling supply chain risk the hardest, as the two ENISA sentences and Help Net do, reads more into that choice than the question carried. The same State report words the figure both ways, on page 41 as the third of three areas and on page 47 as "the most difficult".
The threat assessment, and who says what about AI
ENISA assesses "the level of cyber threats to the EU during the reporting period" as substantial. It defines the word with one sentence: "it is likely that entities are being directly targeted by threat actors or could be exposed to breaches using recently discovered vulnerabilities", with serious disruption of essential and important entities a realistic possibility. The pages print no scale of levels, so what lies above or below substantial is not stated. The reporting period is July 2024 to July 2026 (full report, page 11), and the level "is the same as was reported in the 2024 Report", for three reasons ENISA gives: the 2024 level already reflected the war in Ukraine, conflict related activity focuses on the parties involved, and activity affecting the EU is mostly low impact denial of service.
On AI, the report says the effect on the threat assessment "is currently being evaluated", so the substantial rating does not yet include it. It also says vulnerability exploitation "remains a key vector for initial access", that campaigns can weaponise vulnerabilities "within days, and in some cases even hours or minutes" of disclosure, and that "frontier AI will also bring down discovery time from days to hours". That last sentence is ENISA's own, on page 48 of the full report and page 19 of the condensed one; the Help Net article repeats it without saying so. ENISA's note for it cites a page from a Dutch national cyber security centre, which this briefing did not read.
The threat chapter names one model, saying Anthropic "introduced Claude Mythos frontier AI model" in the first quarter of 2026, "which represented a substantial advancement". That paragraph prints no score or test result for it. On remediation, ENISA says "rapid triage, prioritisation, coordinated disclosure and remediation are becoming more critical bottlenecks than discovery alone", and that automated patching "could accidentally break systems" is a risk of its own (page 48).
NIS2 transposition, as printed
The report gives no count of Member States that have transposed NIS2. It says that "Two years after the transposition deadline (17 October 2024), the NIS2 Directive" "has not been transposed by all MS", that Member States transposed it "at different times, the majority after the transposition deadline", and that "a few are still in the legislative process" (pages 16 and 25). All 27 Member States now mandate Article 21 risk management measures (page 26).
Supervision shows the spread. "Approximately one third of MS collect this information from 81% to 100% of entities and a quarter of MS from 0% to 20% of such entities", where the information is basic details such as names and addresses. In 2024 the two numbers were 3 and 12 Member States (page 25). ENISA says the supervision indicator averages 68.33, with the Member States split equally across established, mature and advanced. The condensed edition says transposition has not been fully implemented and that the scale up is placing pressure on national authorities.
ENISA's recommendations, by who should act
The report groups its recommendations under the five directions of its compass, a framework the 2026 edition introduces as a "conceptual backbone" (publication page). The table lists those closest to patching, suppliers and vulnerability handling, with the actor ENISA names in the middle column. The wording is shortened; none of these recommendations sets a patch time limit, and the word patch appears in none of the recommendation boxes.
Recommendations from the full report, pages 31, 38, 44, 52 and 60, shortened. The actor is the one ENISA names.
| Direction | Actor | What ENISA says should happen |
|---|---|---|
| Shifting to effective implementation | ENISA | Support Member States in supervisory tasks, including cross border cases |
| Shifting to effective implementation | ENISA and the NIS Cooperation Group | Prioritise SMEs in scope of NIS2 and newly identified operators |
| Shifting to effective implementation | The European Commission | Work with stakeholders to accelerate EU responses to vulnerability handling and management requirements across legislations |
| Crisis operational capacity | Member States and the Commission | Invest in the maturity of the CSIRTs in the CSIRTs Network |
| Critical infrastructure | Member States | Require critical infrastructure operators to attest zero trust baselines, resilient incident response during annual audits, and escalation paths for AI accelerated incidents |
| Critical infrastructure | Member States and ENISA | Strengthen private sector participation in sectoral information sharing communities, prioritising low maturity sectors |
| Supply chains and borders | Member States | Build national capacity for EU level risk assessments; prioritise investment in supply chain security measures in essential and important entities |
| Supply chains and borders | Member States and ENISA | Reinforce the interoperability of vulnerability services, including the EUVD, the EU KEV Catalogue, the CRA reporting platform and CVE |
| Skills and awareness | ENISA | Monitor the impact of AI and emerging trends on cybersecurity skills |
What ENISA prints, and what it does not
The patch figure and the Index, stated and not stated. Read from the ENISA documents on 11 November 2026.
| Question | Stated | Not stated |
|---|---|---|
| Survey sample | 1,080 professionals, 83% large enterprises, 27 Member States, May to August 2025; the ICT service management bar is labelled 105 | The sector base for the patch question; the sector mix of respondents beyond the chart; a margin of error |
| Who the 45% describes | Surveyed ICT service management entities, a voluntary and unweighted sample | That it is the share of providers across the Union |
| Critical patches and critical systems | The question wording: critical vulnerabilities on critical assets, IT and OT | A definition of critical; which patches were counted; how timing was measured |
| Link to incidents | ENISA says the figures point to exposure that patching could have mitigated | Any incident, breach or customer harm tied to a slow patch cycle |
| Comparison with 2024 | Index scores are not directly comparable with the previous Index | A like for like patch figure for the sector in 2024 |
| Patch speed by sector | Printed for all 11 sectors in the survey data companion, Figure 94 | Any patch speed in the Index, or in the State report beyond the one sector |
| Index validation | Data collected at the end of 2025; 13 indicator results shown | How scores were validated; the total number of indicators; any Member State's own score |
| NIS2 transposition | Not transposed by all Member States, a few still legislating | How many Member States have transposed |
| Index and incident rates | Nothing linking them | Any link between a Member State's score and incidents there |
What to do, in order
ENISA's advice to industry is general: manufacturers, vendors and other operators "adopt all necessary measures to promptly identify, assess, mitigate, and remediate vulnerabilities, including by patching vulnerable systems once vulnerabilities are discovered" (page 50). The steps below mark which parts are the report's and which are this site's suggestions.
Take this with you
Using the patch figure when you buy or run managed services
- This site's suggestion: ask each managed service provider for its own measured time from vendor patch release to deployment on critical systems, with the date of its last security assessment. Do not accept a national index score in its place.
- This site's suggestion: write patch time limits and the right to see evidence into provider contracts. ENISA's survey says 48% of organisations include cybersecurity requirements in supplier contracts; it does not say what those requirements are.
- This site's suggestion: keep an inventory of which suppliers run which of your systems. ENISA lists, as a good practice in Member States, annual reporting of critical ICT and non ICT suppliers to the national authority.
- This site's suggestion: do not read a high national score as supplier assurance. ENISA's own caution is that even well prepared organisations may be exposed through their third party service providers.
- ENISA's report: treat outsourcing as acceptable but the supply chain as a whole as a priority. Decide which suppliers hold legacy or operational technology systems, which ENISA's survey cites as a factor in patch delays for 27% of respondents.
- ENISA's report: use the European Vulnerability Database for vendor product flaws; the report says notified vulnerabilities are published there after a fix or mitigation exists, with the manufacturer's agreement.
Technical details
The report prints no code, configuration, detection rule or indicator of compromise, and this briefing adds none. What it does print is below: the posture bands, the sentence that carries the 45%, the survey questions, the supply chain indicator definition, and the catalogue identifiers a reader needs to cite the documents. Each block is copied from the page named in its caption.
The posture bands. This is the scale behind the 71.53 and the count of Member States per band. A reader uses it to see that a score of 60 to 79.99 is called mature and that no Member State sits below 40.
0 MS Foundation Cybersecurity Posture
MS with overall EU-CSI score within 0.00 - 19.99
0 MS Developing Cybersecurity Posture
MS with overall EU-CSI score within 20.00 - 39.99
3 MS Established Cybersecurity Posture
MS with overall EU-CSI score within 40.00 - 59.99
22 MS Mature Cybersecurity Posture
MS with overall EU-CSI score within 60.00 - 79.99
2 MS Advanced Cybersecurity Posture
MS with overall EU-CSI score within 80.00 - 100.00
The sentence that carries the 45% and the 43%. It sits in the section on supply chains. Read the period (2024) against the survey wording (the past year) before quoting it.
At the same time, 43% of surveyed entities in the ICT service management sector conducted no cybersecurity assessments in 2024, and 45% took more than three months to apply critical patches to critical systems.
The two survey questions. The first is the question behind the patch figure. The second is the question behind the 37%: respondents could choose up to three areas, which is why the shares add to more than 100%.
Survey Question: What is the average time to patch critical vulnerabilities on your organisation's critical assets (IT and OT)?
Answer options in Figure 14 of the main report: Within a week; Within a month; Within three months; More than three months later; Variable / Don't track timing
Survey Question: Which of the following NIS2 areas is the most challenging for your organisation to implement? (Select up to three)
The supply chain indicator. This is the indicator behind the 89.91. A buyer uses the definition to see that it measures whether practices exist in surveyed entities, not their speed. The last line is this site's reading of the bar printed on the page.
SUPPLY CHAIN MANAGEMENT PRACTICES BY ESSENTIAL/IMPORTANT ENTITIES
This indicator measures the adoption of supply chain management practices by essential and important entities.
A score of 100 means that, across all MS, all surveyed entities have specific practices for supply chain management in place.
EU Avg: 89.91 Foundation 0, Developing 0, Established 0, Mature 2, Advanced 25
Identifiers and licence. Use these to cite the documents. The licence permits reuse with credit and an indication of changes.
State of Cybersecurity in the Union 2026, full report: TP-01-26-024-EN-N, ISBN 978-92-9204-816-7, DOI 10.2824/1662989
State of Cybersecurity in the Union 2026, condensed edition: TP-01-26-025-EN-N, ISBN 978-92-9204-817-4, DOI 10.2824/8158412
NIS Investments 2025, main report: TP-01-25-033-EN-N, ISBN 978-92-9204-777-1, ISSN 2600-4712, DOI 10.2824/7442427
Licence on all three: CC BY 4.0, reuse allowed with credit and an indication of changes
The question the report leaves open
A Member State can score advanced on whether its essential and important entities have supply chain practices, and a sector can still report that 45% of its surveyed entities take more than three months to patch critical systems. The report prints both, and the State report prints no sample size for the second, no definition of critical, and no link between the two. If the supplier that runs your critical systems is one of those sector respondents, which of the two numbers could it show you, and would it show you its own?
Key facts
Sources
- Primary2026 Report on the State of Cybersecurity in the Union, full report, 74 pages, catalogue TP-01-26-024-EN-N, CC BY 4.0. Read in full on 11 November 2026: Index results, threat assessment, supply chain section, recommendations, annexes. ENISA maintains the EUVD and the report cites an ENISA portal for the CRA reporting platformENISAaccessed 2026-11-11
- Primary2026 Report on the State of Cybersecurity in the Union, condensed edition, 24 pages, catalogue TP-01-26-025-EN-N, CC BY 4.0. Read in full as saved by the lead on 11 November 2026: searched for every figure, none of the survey figures is printedENISAaccessed 2026-11-11
- PrimaryPublication page for the 2026 report: publication date 10 Nov 2026, description of the compass, links to the full report and the condensed editionENISAaccessed 2026-11-11
- PrimaryNIS Investments 2025, main report, 38 pages, published December 2025: survey of 1,080 professionals, patching, supplier and sector findings, sampling approachENISAaccessed 2026-11-11
- PrimaryNIS Investments 2025, survey data companion document, 73 pages: question wording and the sector chart of time to patch critical systemsENISAaccessed 2026-11-11
- PrimaryPublication page for NIS Investments 2025, 8 Dec 2025: sample description and links to the main report and the data companionENISAaccessed 2026-11-11
- Reported byNews article published 11 Nov 2026 at 06:00 UTC by its page data: reports the 45%, 43% and 37% figures. Used to find the primaries; every figure re-read in the ENISA documentsHelp Net Securityaccessed 2026-11-11
