14 days. Not the dwell time problem.
Scattered Spider's 2025 European manufacturing campaign used CVE-2025-31324 and CVE-2025-42999 to compromise Jaguar Land Rover's SAP NetWeaver, forcing a five-week production shutdown. The technical mechanic involved exploiting zero-day vulnerabilities in edge devices.
What everyone reads as a vulnerability problem is actually a patch governance failure. 42% of exploited vulnerabilities in 2025 were weaponized before public disclosure (CrowdStrike Global Threat Report 2026). Historically, state-nexus actors have accelerated the exploitation of newly disclosed flaws.
The defensive math: -> Implement a 14-day patch cycle for critical infrastructure to reduce the exploitation window. -> Conduct a third-party assurance review to ensure suppliers' security postures align with NIS2 compliance requirements. -> Develop a board-level cybersecurity briefing to address the new legal responsibilities under NIS2.
Can your board articulate the cybersecurity risk profile of your organization's supply chain?