Build an AI-cyber action plan your Joint Supervisory Team will accept, and prove it works.
| Frontier AI turns vulnerabilities into working exploits in minutes. The ECB wants your action plan to address this by 31 October 2026. Qualys helps you detect, prioritise and remediate vulnerabilities attackers actually exploit at machine speed, with human oversight and evidence to show your progress. |
On 7 July 2026 the ECB wrote to the CEO of every bank it supervises directly.
Its message: Frontier AI models can find vulnerabilities and generate working exploits at unprecedented speed. The ESRB calls it a systemic risk to the EU financial system.
The ask: an action plan with measures, resources, owners and timelines by 31 October 2026.
Supervisors will then monitor progress and compare plans across institutions. The ECB anchors the plan in DORA: AI doesn't change the rules, it raises the stakes.
Monthly patch cycles and a spreadsheet of CVSS scores cannot keep pace with that.
Here’s what a credible plan needs, and where Qualys provides the evidence.
The six focus areas in the ECB annex
The letter asks for short-term action in the first four areas and structural measures in the last two.
Know every ICT asset, including third-party and open-source software. Minimise and continuously monitor what's internet-facing, and fix the perimeter first, without ignoring internal threats.
| Prioritised vulnerability scanning, prepared for more frequent and higher-volume patching, with change management that allows rapid, risk-based remediation without losing stability. |
| Stronger monitoring of application and access logs, network traffic and other indicators of compromise, especially across internet-facing applications, cloud repositories and critical internal systems. |
| Management bodies to check resources can support accelerated patching. Update risk appetite metrics, match training to the risk, and check suppliers' patching readiness. |
| Assume the perimeter will be breached. Apply segmentation, zero trust and strong baseline controls. Replace or protect legacy and end-of-life technology. |
| Tested incident response, backup, failover and recovery arrangements aligned with DORA, exercised against high-speed, high-volume attack scenarios. |
| ECB Action Plan Readiness Checklist |
| The six annex focus areas, each with the questions a JST is likely to ask and the evidence that answers them. Built for the security and ICT risk teams drafting the submission. |
"This is a long-term shift in the threat landscape rather than a temporary phenomenon or a risk tied to any single tool."
ECB Banking Supervision, letter to significant institutions, 7 July 2026
Three gaps AI-speed attacks expose
The ECB wants faster remediation at scale, without losing stability.
| Qualys detects new vulnerabilities within minutes of disclosure. |
| Qualys focuses your teams on what's confirmed exploitable. |
| Qualys deploys patches in controlled waves, with automatic rollback if problems are detected |
Where Qualys evidences your plan
Qualys does not write your governance or crisis-management sections. It provides the technical evidence behind the areas below.
| ECB Focus area | How Qualys Helps |
|---|---|
1. Attack surfaces | Qualys discovers assets across your network and internet-facing estate, including unmanaged and unauthorised devices and the AI models, AI services and AI integrations in use. It keeps one continuously updated inventory with the software on each asset and a criticality score. |
2. Vulnerability and patch | Qualys ranks vulnerabilities by severity, threat intelligence and asset criticality, confirms which are exploitable in your environment, then patches or mitigates them, with rollback if a patch causes problems. |
3. Detection | This area sits mainly with your security operations centre (SOC). Qualys can show which exposures are exploitable in your environment, which helps your team decide where to focus monitoring. |
4. Governance | Qualys can supply risk metrics for your risk appetite framework, show how long vulnerabilities stay open, and keep audit-ready evidence of control compliance. The management-body review, training and supplier assurance stay with you. |
5. Defence in depth | Qualys checks secure configuration and finds end-of-life software. It can uninstall end-of-life applications, or reduce their risk until they're replaced. Replacing end-of-life systems, segmentation, zero trust and multi-factor authentication stay with you. |
6. Resilience | When a new vulnerability is disclosed, Qualys helps you find affected assets and patch, mitigate or isolate them. It also provides technical control evidence for DORA. Incident response, crisis management, backup, recovery and information sharing stay with your teams. |
| Check your plan in 45 minutes |
| Bring your draft or your current posture. A Qualys expert will walk through the six ECB focus areas with you, show where your existing data already provides evidence, and identify the gaps. |
By submitting this form, you consent to Qualys' privacy policy
31 October is the start, not the end
Qualys does not write your governance or crisis-management sections. It provides the technical evidence behind the areas below.
JST engagement
Your Joint Supervisory Team will discuss the plan with you and monitor progress. Trend reporting on risk reduction is what makes those conversations short.
Horizontal analysis
The ECB will compare plans across all significant institutions and share what it finds. Quantified metrics put you on the right side of that comparison.
IT Risk Questionnaire, February 2027
The annual questionnaire has moved to give banks room to act. The same inventory, vulnerability and remediation evidence answers both.
Powered by the Qualys TruRisk Platform
Qualys does not write your governance or crisis-management sections. It provides the technical evidence behind the areas below.
| See your real risk exposure before your supervisor asks |
| Book an Action Plan Review, or start a guided 30-day Enterprise TruRisk Management trial and see unified risk visibility, exploit validation and remediation workflows on your own estate. |
The CEOs of all significant institutions supervised directly by the ECB under the Single Supervisory Mechanism. Advisers expect national competent authorities to set comparable expectations for less significant institutions.
An action plan building on the bank’s existing cyber-risk strategy, with concrete measures, resource allocation, clear roles and responsibilities and implementation timelines, covering both immediate priorities and longer-term structural measures.
No. The ECB states that DORA remains the binding framework and that AI amplifies the speed and scale of known risks rather than creating new categories.
No. Qualys provides technical evidence for attack surface, vulnerability and patch management, defence-in-depth hygiene, and DORA control reporting. Governance, staffing, training, crisis management and information-sharing arrangements sit with the bank and its advisers.
The ECB has moved the annual collection from September 2026 to February 2027 so that institutions can focus on the action plan.
The ECB letter does not, but the Bank of England, FCA and HM Treasury issued a joint statement on frontier AI and cyber resilience in May 2026, and the NCSC has published guidance on preparing for a vulnerability patch wave. The same capabilities apply.