The IT Nerd

The European Commission unveiled an Action Plan on Cybersecurity and Artificial Intelligence aimed at helping Member States, public authorities, and industry address cyber risks associated with advanced AI systems.

The plan includes measures to expand AI-assisted vulnerability detection, establish an EU capability to evaluate advanced AI models, and develop secure testing environments for AI systems. It builds on existing legislation, including the Cyber Resilience Act, the AI Act, and NIS2.

The Commission said the initiative will support the secure development and deployment of AI by strengthening collaboration between governments, industry, and the cybersecurity community. Planned actions include coordinated vulnerability disclosure, AI-powered cyber defense capabilities, and guidance for organizations deploying AI in critical sectors.

The plan’s press release can be found here: New EU plan to address the risks and opportunities of advanced AI for cybersecurity – European Commission

Steven Swift, Managing Director, Suzu Labs provided this comment:

   “The problem with locking new frontier models behind a governmental pre-release screening, is that it gives governments a mechanism to require frontier labs to modify their models in ways that aligns with political preferences, such as selecting which version of the truth they want models to present. While at the same time being able to claim “for better security” as the official reason to gate the release at all.

   “The other problem with it, is that there isn’t really a difference between the offensive and defensive capabilities of a model. Even if screening focus is narrowly focused on cybersecurity capabilities, actively lowering a model’s offensive capabilities directly impacts its ability to perform defensive work. Especially defensive verification, which is critical. Models will hallucinate unpredictably. It is absolutely essential that agentic systems be capable of building tests to verify the validity of results to ensure that hallucinations aren’t present.

   “This makes frontier models more insecure, and makes their use less safe. Despite the entire point of cybersecurity review process to be the opposite.

   “If we are going to gate frontier models behind an approval process, it is absolutely critical that the structured access programs actually function effectively to get legitimate security professionals, and developers access to sensitive unrestricted models, so that appropriate verification and testing can be performed on their own systems.”

Seemant Sehgal, Founder & CEO, BreachLock has this comment:

   “The EU is right to treat this as an infrastructure problem, not a software problem. AI embedded in critical sectors carries the same risk profile as power grids and financial rails in that a failure isn’t an inconvenience, but a systemic event.

   “The window to set baseline security expectations before widespread deployment is already closing. What makes this harder than traditional infrastructure is that AI systems don’t stay static after deployment. The testing frameworks have to keep pace with that. The real question is whether coordinated disclosure and continuously updated validation environments can be stood up before adversaries finish mapping what Europe has already put in place.”

Doc McConnell, Head of Policy and Compliance, Finite State adds this:

   “This action plan presents what the EU sees as an ideal ecosystem to support safe, responsible, and innovative development and utilization of AI across the Union. That vision is ambitious, including a stronger system of third-party AI evaluators, sovereign AI capacity, multi-state workforce training, and secure testing platforms. These will require significant investment, international coordination, and development of new technology. And as the EU works to achieve these goals, existing frontier labs will continue to innovate, and new open-weight models may emerge.

   “The specificity of this action plan stands in contrast to the U.S. policy on AI security, as laid out in the June 2026 Executive Order Promoting Advanced Artificial Intelligence Innovation and Security. Although the goals are similar, including protection of critical infrastructure, early government access to cybersecurity tools, and the promotion of innovation, the U.S. approach is much more open-ended.

   “I expect that neither approach will fully meet this moment, and we will see national policies have to adapt along with the technology they are seeking to oversee. The action plan describes a promising future: one of “unprecedented opportunities to enhance cyber resilience.” That is the goal to keep in mind. Even as plans, priorities, and AI models change, we must all, individual technologists and commercial companies, as well as policymakers, make choices that prioritize AI as an enabler of better defense, greater resilience, and stronger international security.”

The US and other countries that are not in the EU should copy what the EU is doing as the EU has the right idea here. And other countries when all is said and done are on the wrong side of history.

Cybersecurity experts, OEMs, software publishers and end user organizations have focused on the EU Cyber Resilience Act’s ultimate December 2027 compliance deadline for years. What’s gotten far less attention is the first major enforcement milestone on September 11, 2026, now less than 100 days away.

On that date, anyone selling connected products and applications into the EU must report actively exploited vulnerabilities and significant security incidents to regulators under strict timelines – within 24 hours.

Doc McConnell, Head of Policy and Compliance, Finite State, said

“For many companies, the challenge isn’t simply reporting, it’s determining within a few hours whether a vulnerability exists inside their products, whether it’s being actively exploited, and who might be affected. 

“The biggest obstacle isn’t paperwork, it’s visibility. Many companies lack accurate software inventories across their product lines, and have limited insight into third-party components embedded in products. Even more lack an in-place internal decision process to meet that 24-hour reporting mandate. The CRA readiness gap persists across sectors: ICS, automotive, medical devices, consumer electronics, IoT, IT gear, mobile applications distributed to EU  end users, embedded software and more. And are their legal and compliance departments ready to assess cyber resilience?”

Ryan McCurdy, VP, Liquibase, added:

“The CRA turns cybersecurity from a best practice into a reporting obligation. That creates a simple test for software manufacturers: can you prove what changed, who changed it, when it changed, and whether the right controls were applied? For many organizations, the database layer is where that proof breaks down. Manual scripts, schema drift, and inconsistent approvals make it hard to show control when regulators, customers, or auditors ask. The companies that are ready for CRA will not just have security policies. They will have governance and proof of control across the full software lifecycle, including database change.”

The bottom line is that we’ll see if 100 days is an administrative nightmare, or a nothing burger. And it will be up to software vendors to decide which side of the fence that this falls on.

Reuters is reporting that The European Commission has had several productive meetings with​ Anthropic on potential access ‌for EU bodies to Anthropic’s Mythos. 

The European Commission is in ‌contact with Anthropic ‌regarding Mythos and is assessing its ​possible implications, European Economic Commissioner Valdis Dombrovskis told reporters on Monday.

“The commission representatives ‌met with ⁠Anthropic and was briefed on technical details around ⁠cyber capabilities and the risk of this Mythos ​preview, so ​we ​are currently assessing ‌possible implications in light of the EU policies and legislation,” Dombrovskis said.

Uzair Gadit, CEO, Secure.com:

Giving a regulator like ENISA hands-on access to a frontier model is a smart move, particularly given that Anthropic has filed to go public. Defenders learn fastest when they can test these systems directly, not read about them secondhand. This is a well considered move, aligning with Anthropic’s filing to go public.

The real question isn’t whether AI belongs in cybersecurity. It’s where it helps and where it quietly creates new risk. A model can triage and investigate at a speed no human team matches, but judgment calls still need a person in the loop. 

Europe putting its own experts that close to the technology is how you build informed policy instead of guessing at it.

The threat landscape didn’t evolve — it massively accelerated. What used to require a skilled hacker and days of preparation now takes an AI tool and mere minutes.

Joshua Marpet, Senior product security consultant, Finite State:

Mythos, while reportedly equaled in capability by ChatGPT 5.5, among other frontier models, is still an incredibly powerful AI framework. The usage of Mythos by ENISA is fascinating. Will they use it to find vulnerabilities in EU RED and EU CRA Certified products? Or products coming up for certification? Are they going to try to use it to determine what exploits should be rated at what level? I have to assume that there are multiple questions that Mythos can and will answer for ENISA.

 Importantly, will this change the initial certification or certification maintenance process? That’s a question to be answered in the fullness of time.

Steven Swift, Managing Director, Suzu Labs:

Anthropic continues to keep Mythos behind closed doors, primarily as a marketing stunt. New frontier models have an established pattern of incremental improvements despite exaggerated marketing claims. We should expect Mythos to perform similarly once released more widely. Anthropic has stated that they will be making a public release of Mythos in the not too distant future, though the public release is expected to contain additional safety guardrails which are not present on their internal builds.

This is especially interesting for Mythos, which has been reported to have a heavy emphasis on its capabilities around vulnerability management and information security. As these functions are both critical for defenders, in order to build more secure, robust systems. But they’re also the same functions that allow bad actors to leverage those same functions for malicious intent.

Anthropic is trying to walk a very tight line. If safety tuning is too restrictive, the model won’t be useful for defenders. If its too permissive, it’ll be too easy for bad actors to leverage.

Granting access to the EU ahead of a more general release gets some additional eyes on the model, and provides Anthropic a larger userbase from which to solicit feedback from. Its not clear to what extent the EU release will contain safety guardrails, or if they’re being granted access to the unrestricted model.

John Carberry, Solution Sleuth, Xcape Inc.

Expanding early access to Anthropic’s Claude Mythos Preview introduces an asymmetric shift in global risk management, forcing organizations to navigate an automated security arms race where defense must match the velocity of AI-driven exploitation. Because sophisticated adversaries are already utilizing advanced models to automate zero-day discoveries and craft complex exploit chains, restricting access to defensive entities guarantees systemic failure.

Project Glasswing’s integration of the European Union Agency for Cybersecurity, or ENISA, represents a critical geopolitical rebalancing, allowing international defenders to scan critical infrastructure before adversarial actors weaponize those same flaws. For security leaders, this transition means traditional, human-centric patching timelines are officially obsolete, shifting the enterprise bottleneck from vulnerability discovery to human remediation capacity. Organizations must proactively integrate automated code review, implement machine-speed patching workflows, and embed agentic AI safeguards directly into their development pipelines to survive an attack surface that now scales at the speed of computation. If you thought keeping up with patch Tuesday was difficult, wait until you are triaging ten thousand zero-days discovered by an AI before lunch.

Critical Takeaways

• The defensive arms race is active: Granting ENISA access to Claude Mythos Preview acknowledges that sophisticated adversaries are already deploying autonomous toolkits, making defensive AI adoption an operational necessity.
• Remediation is the primary bottleneck: With autonomous models surfacing thousands of zero-day vulnerabilities in weeks, the enterprise challenge pivots entirely from flaw discovery to human patching capacity.
• Traditional vulnerability management is obsolete: Security leaders must transition toward automated triage and machine-speed mitigation to counter threats that scale at computational velocity.

Personally, the EU has to do less talking and more listening in order to get resolution rather than create more problems. But I suspect that the EU has to learn the hard way on this front.

On Tuesday, the EU agreed to the Cyber Solidarity Act, a new set of rules intending to make the EU more resilient and reactive to cyber threats via cooperation mechanisms.

An EU-wide cybersecurity alert system will be established to rapidly share information and will comprise of national cyber hubs which will be responsible for detecting and acting on cyber threats, helping authorities respond more effectively to major incidents.

The new regulation will allow for the creation of a cybersecurity emergency mechanism that will support:

• Preparedness actions, including testing entities in highly critical sectors, such as healthcare, transportation and energy.
• Shared financial assistance for impacted entities.
• A ‘cybersecurity reserve’ made up of incident response services from the private sector as well as associated partnering countries that are ready to intervene during a large-scale cybersecurity incident.

The EU Council and Parliament have also agreed to amend the 2019 Cybersecurity Act in order to establish European certification schemes for managed security services. This aims to boost the quality and comparability of these service providers and avoid fragmentation of the internal market.

Formal adoption of the provisional agreements will come once they have been endorsed by the Council and Parliament. 

Emily Phelps, VP, Cyware had this comment:

   “The Cyber Solidarity Act recognizes and addresses the critical nature for the EU to more effectively prepare, detect, and respond to cyber threats. Threat actors often work together, increasing the challenges nations and organizations face to defend against adversaries. These collaborative efforts to improve resiliency are an important step to protecting critical infrastructure, national security, and economic continuity.

Dave Ratner, CEO, HYAS follows with this comment:

   “Sharing information the way that the EU Cyber Solidarity Act does is a great start and a good initiative — too many times the right information is not shared quickly enough. However, if the goal is to make everyone, especially critical infrastructure, truly proactive and cyber resilient then they need to do more than just share information about ‘what’s happened in the past’ and ‘what’s happening now’.  They need to endorse the use of proactive threat intelligence capable of identifying what is going to happen, and mandate the implementation of cyber resiliency solutions like Protective DNS — which other governments are already recommending — that are capable of automatically identifying attacks in real-time and shutting them down.”

George McGregor, VP, Approov had this comment:

   “The EU continues to flesh out the EU Cybersecurity Strategy laid out 4 years ago.

   “The newly announced Cyber Solidarity Act is intended to drive readiness and cooperation and includes infrastructure investments and financial incentives. Because of this it will certainly prove less controversial than the Cyber Resiliency Act of 2023 which imposed strict breach reporting requirements on companies operating in the EU.

   “Key, however, will be the effective execution of the work needed to implement this Act. For example, the creation of a “state-of-the-art” European Cybersecurity Alert System is certainly aspirational but could prove quite challenging to implement. Further information and regular updates on the status of the various projects required to implement the Act will be welcome as a next stage. “

By making sure that everyone shares info and plays nice in the metaphorical sandbox, it ensures that everyone is a lot safer. Thus I see this as a very good move by the EU and one that should be copied far and wide.