ENISA Reports Rapid Exploitation of Vulnerabilities Amid New Cyber Resilience Act

• •ENISA reports vulnerabilities can be exploited within 15 minutes of disclosure.
• •The Cyber Resilience Act requires mandatory reporting of exploited vulnerabilities in the EU.
• •AI tools are significantly increasing the volume of reported vulnerabilities, overwhelming security teams.

ENISA's recent analysis reveals that attackers can exploit vulnerabilities within 15 minutes of public disclosure, prompting discussions in Europe about automating patch deployment without human approval. The report highlights a significant increase in reported vulnerabilities, with one organization experiencing a rise from 80 to 500 daily vulnerabilities due to AI tools. The agency introduces the term 'negative time-to-exploit' to describe scenarios where attackers exploit vulnerabilities before defenders can respond. Additionally, the Cyber Resilience Act mandates that all manufacturers selling digital products in the EU report actively exploited vulnerabilities through a new centralized portal, effective September 11, 2026. This new regulation affects not only EU-based companies but also international manufacturers distributing products in the European market.