ENISA's 2026 Threat Landscape is out. Two numbers belong together. Where ENISA could identify the intrusion vector, 60% of unauthorised-access incidents came through a vulnerability, N-day or zero-day. And 2025 published over 48,000 new CVEs, up 22% on the year before. More doors, and the doors are the preferred route in. The other thread is dependencies. Supply-chain and third-party attacks are what produce the large-scale incidents. Which is why the point about patch clocks shrinking to days is not pedantry. The patch programme and the supplier register are the same control now. https://www.enisa.europa.eu/news/exploring-the-evolution-of-the-cyber-threat-landscape-how-dependencies-weaken-our-digital-resilience #CyberSecurity #InfoSec #ENISA #DigitalSovereignty