EU agency that provides cybersecurity guidance, risk assessments, and technical standards supporting EU-wide policy, including the Cyber Resilience Act.
Grid-tech vendors have had to report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act since 11 September 2026. SBOMs and vulnerability handling become mandatory on 11 December 2027.
Reality
EU Cyber Resilience Act rules have required connected-product makers to report exploited flaws through ENISA within 24 hours since 11 September 2026. One incident can also start DORA, NIS2 and GDPR clocks, so runbooks need a triage step that splits into parallel filings.
Reality
The Cyber Resilience Act's vulnerability reporting duties are already in force, well before the December 2027 date that governs most of the regulation, and they sit alongside five other disclosure regimes whose clocks start differently.
Perspective Coverage
5 publishersReality
EU Cyber Resilience Act rules have required 24-hour ENISA warnings on exploited flaws in commercial container images since Sept. 11, 2026. Vendors of supported Kubernetes operators and Helm charts are on the same clock, well before the rest of the law is enforced in December 2027.
Reality
The G7 Cyber Security Working Group's June call to action says the quantum threat is off the radar and under-resourced at most organizations, and it hands CISOs the wording to fund a cryptographic inventory this cycle.
Perspective Coverage
5 publishersReality
From 11 September 2026, an actively exploited vulnerability starts a 24-hour early warning, a 72-hour notification and a 14-day final report, all timed from awareness. The artifact that decides whether you make it is your SBOM archive.
Reality
OpenAI's financial-services ChatGPT arrives with market data licensed from the vendors banks already pay, and without a published price the buy-or-keep comparison cannot be run. Its own benchmark still misses about three answers in ten.
Perspective Coverage
3 publishersReality
The European Court of Auditors examined the years 2022 to 2025 and reported that the EU's two cyber networks have yet to define how they work together, and that the European Cybersecurity Alert System was not operational.
Reality
ENISA counted 8,257 EU incidents in 2025 and found that denial of service against public-facing services supplies most of the volume, while its warning about compromised technology suppliers rests on one named Swedish case.
Reality
The Joint Committee of the EBA, EIOPA and ESMA handed EU governments an autumn risk update that puts reliance on non-EU ICT, clearing, ratings and foreign-currency funding at the top, with AI-enabled attacks and quantum next.
Reality
ENISA's Single Reporting Platform went live on 11 September 2026, the day manufacturers' Article 14 duty applied. The coordinating CSIRT is set by where a company is established, and open-source stewards have until December 2027.
Reality
Politico reported that ENISA and CERT-EU ran an advanced OpenAI model over an EU project's code and got four fixed flaws out of it. Poland's CERT, doing the same kind of work, said it tested every hypothesis on real systems.
Reality
ENISA says in a July 2026 assessment that the research-and-develop delay defenders implicitly count on is disappearing as automated systems take over the attacker's work, with the remaining window measured in minutes.
Reality
The Cyber Resilience Act's reporting duties started binding manufacturers on 11 September 2026, and the first release of ENISA's portal has no API, so each report is typed into an English-language web form.
Reality
Dario Amodei's pacing proposal has three parts, and Anthropic can deliver only the first of them by itself. According to TNW, that first part has been binding on systemic-risk models in the EU since 2 August 2025.
Reality
The Cyber Resilience Act does not fully apply until December 11, 2027, yet its Article 14 early warning binds 15 months earlier, starting from the moment a manufacturer is reasonably certain a product is being exploited.
Reality
The European Commission says its cybersecurity agency now holds both frontier models, but it will not say whether Article 55 or a letter from 30 MEPs pried Mythos 5 loose, and nobody has named the build ENISA is testing.
Reality
Two or three of the 95 were genuine, and reviewers had to read all of them to find out. The EU's 24-hour ENISA clock starts on September 11, 2026, and only evidence of active exploitation starts it.
Reality
Verizon's 2026 DBIR puts mobile phishing simulation click rates 40% above email. Most of those attempts never reach a security team, because the report button, the gateway and the triage queue all sit in the inbox.
Reality
Essential entities face up to EUR 10 million or 2 percent of global turnover, and management bodies can be barred from executive roles, which makes access control the one Article 21 requirement a team can finish and evidence inside a month.
Reality