45% of EU IT providers take months to patch, leaving a three-month evidence gap.

ENISA's 2026 cybersecurity assessment found that 45% of surveyed EU IT service management providers took over three months to patch critical vulnerabilities in critical systems, even though attackers can exploit new flaws within hours. That's a long window where logs, configurations and access records sit exposed.

The patching delay at providers becomes a security and evidence gap for all customers depending on those systems. If an attacker gets in before the patch, they can alter what the system logged or hide what they did.

A digital witness would show when each patch was applied and what state the system was in before and after. For public sector bodies relying on these providers, that could prove whether records were intact during a disputed period or whether an exploit window was actually closed.