TrustForge.pub

Authors: Ali Khalil, Ayman Khalil

A recent companion analysis on this publication argued that artificial intelligence did not create the buried flaws in the world’s software; it simply made them cheap to dig up.¹ That observation reframes the entire defensive challenge. For most of the history of product security, the cost of finding a vulnerability was itself a form of protection. When discovery was slow and expensive, latent flaws could sit unnoticed for years without being weaponized. As AI compresses that cost, the protective friction disappears, and a different question moves to the center: not whether flaws exist, but whether defenders can act on them in time.

This article argues that Europe’s decisive advantage will come from the speed of trust, that is, structured collaboration built on shared standards, rather than from the speed of regulation alone. Discovery is no longer the bottleneck. Response is.

Three clocks, one challenge

The core challenge is a mismatch of speeds. AI now surfaces vulnerabilities at machine speed, while three of the systems Europe depends on to respond still operate at slower, institutional and operational rhythms.

The first is the clock of standardization and certification. The Cyber Resilience Act entered into force in December 2024, yet the formal request for the roughly forty harmonized standards that will give manufacturers a presumption of conformity was accepted by the European standards organizations only in April 2025, with many product-specific standards expected through 2026 and 2027.² Product design cycles therefore begin before the rulebook is finished.

The second is the clock of mandated reporting. From September 2026, manufacturers must report actively exploited vulnerabilities to ENISA on a tiered timeline, beginning with an early warning within twenty-four hours.³ To receive these notifications, ENISA is building the Single Reporting Platform, a constructive move toward a single, coordinated European channel that is scheduled to be in place as the obligations take effect.⁴ It is a genuine step forward, and it also shows how much new operational machinery has to be ready at once.

The third is the clock of triage and remediation. The more capable teams already use automation, and increasingly AI, to help validate and prioritize findings, so this is not a story of purely manual defense. The point is narrower: human judgment and engineering capacity remain finite, and AI-scale discovery can still generate far more candidate issues than even an automated pipeline can confirm, prioritize, and fix. The World Economic Forum has documented how unevenly organizations are positioned to absorb this load. These three clocks were calibrated for a slower era. The tension is structural, not a failure of any single institution.

Why faster rules are not a complete answer

The intuitive response is to demand faster standards and quicker certification. That instinct is understandable but incomplete. Standardization is a consensus process, and speed traded against quality or legitimacy can erode the very trust a standard is meant to confer. Europe’s own experience shows the difficulty: the European Parliament’s research service has examined the pressures facing the Cybersecurity Act and its certification framework⁵, and industry bodies have publicly noted that the pipeline of certification schemes has not kept pace with expectations.⁶ At the same time, the European institutions are actively working the problem, through the standards organizations developing the CRA catalogue and through simplification efforts such as the January 2026 proposal to streamline overlapping obligations.⁷ The point of this article is not that Europe has stood still. It has not. The point is that rule-making has a natural ceiling, while collaboration does not. That is where the practical leverage lies.

Pillar one: standards-based vendor collaboration

If response time is the new battleground, the first pillar of a durable answer is collaboration anchored in shared, auditable mechanisms rather than informal bilateral trust. Several of these mechanisms already exist. Coordinated vulnerability disclosure, codified in ISO/IEC 29147 and ISO/IEC 30111, gives vendors and finders a common protocol⁸ for reporting and handling flaws.⁹ The Cyber Resilience Act requires manufacturers to operate a disclosure policy and to maintain a software bill of materials that lets an organization answer, quickly, which products contain an affected component. ENISA’s Single Reporting Platform and its European Vulnerability Database provide European-level infrastructure for sharing what has been found and what is being exploited. The advantage of anchoring collaboration in standards is that it scales and it is verifiable. A standards-referenced relationship does not depend on the size, location, or nationality of a supplier; it depends on demonstrable process. This is what turns the general call for closer cooperation with vendors into a concrete operating model.

Collaboration, however, is necessary but not sufficient. It matters just as much how the standards themselves are written. If a standard prescribes a specific tool or a fixed technical solution, it risks freezing defenders into yesterday’s methods while attackers move on. To keep pace with an AI-accelerated threat, requirements should be expressed as outcomes and capabilities to be demonstrated, technology-neutral by design, rather than as mandated implementations. That openness is what lets defenders meet AI with AI, for example by adopting AI-assisted platforms that triage and prioritize vulnerabilities faster, without falling out of conformity. Standards that define the goal and leave room for evolving means are the ones most likely to survive the race they are meant to govern.

Pillar two: closing the capability gap

Collaboration alone is not enough if the ability to use AI defensively is concentrated at the top of the market. The evidence suggests it currently is. Google’s AI-assisted fuzzing surfaced vulnerabilities in widely used open-source software, including a flaw that had gone unnoticed for two decades, and its Big Sleep agent identified a real-world zero-day in SQLite before it could be exploited. DARPA’s AI Cyber Challenge demonstrated that automated systems can find previously unknown flaws across tens of millions of lines of code, but the teams able to do so were large and well-resourced. The downstream risk is that the weakest links in the supply chain, smaller manufacturers and volunteer open-source maintainers, are the least equipped to keep pace.

ENISA has long documented that smaller firms struggle to adopt security standards and to participate in standardization at all. Recent simplification of obligations for smaller entities, while easing administrative burden, raises a fair question about whether security expectations and security capacity move together, and the most recent European threat reporting underscores how exposed this segment remains. Supply-chain security duties under NIS2 already make larger entities responsible for the security of their suppliers, which is precisely why collaboration has to actively push capability down the chain. Otherwise, the capability gap becomes the attack path.

The sovereignty question, kept in proportion

No honest discussion of European cybersecurity standards can ignore that they now sit inside a wider conversation about digital sovereignty. Policies spanning the management of higher-risk suppliers, foreign-investment screening, and aspects of cloud certification illustrate differing national priorities among member states, with approaches varying across the Union. These are legitimate questions about resilience and dependency, and they are unlikely to be settled soon. This article takes no position on them.

The relevant observation here is narrower: origin-based controls, whatever their merits, do not close the timing gap that AI has opened. A restricted supplier list does not, by itself, help a manufacturer find, report, and patch a newly surfaced flaw within twenty-four hours. That work still depends on standards-based collaboration, on standards written to be technology-neutral, and on defensive capability that reaches the whole supply chain.

What this means in practice

For manufacturers, the practical implication is to treat the Cyber Resilience Act’s duties as operational readiness rather than documentation. The bill of materials, the disclosure channel, and the twenty-four-hour reporting muscle should be built and exercised before they are legally required, because the threat clock will not wait for the compliance clock. For customers and operators, vendor security should be expressed as a contractual, standards-referenced expectation, with coordinated disclosure and vulnerability handling named explicitly, rather than left as a procurement checkbox. For the wider ecosystem, including public bodies and large vendors, the priority is to fund and share capability so that smaller suppliers and maintainers can rise toward the same baseline.

Conclusion: the speed of trust

AI is compressing defensive timelines by lowering the cost of discovery. Europe has already moved the needle: its frameworks have strengthened common expectations and improved accountability across the single market, and its institutions are actively refining the system as they learn. The honest conclusion is that regulation has practical limits that operational collaboration does not. The most resilient path is to accelerate trust itself: align vendors and customers around shared, outcome-based standards, and distribute defensive capability across the supply chain so that security no longer depends on the slowest or least-resourced participant. The organizations that succeed will be those that convert new findings into coordinated action with the least delay. Europe has made real progress. The next step is to make that progress faster, together.

What to watch next

• Publication of the CRA harmonized standards through 2026 and 2027.
• The go-live and onboarding of ENISA’s Single Reporting Platform.
• Outcomes of the Cybersecurity Act review and movement on outstanding certification schemes.
• How quickly AI-assisted defensive tooling becomes usable by SMEs and open-source maintainers.

1. Paul Gedeon, “AI Vulnerability Discovery Just Changed the Clock Speed of Product Security,” TrustForge, May 15, 2026. https://trustforge.pub/2026/05/15/ai-vulnerability-discovery-just-changed-the-clock-speed-of-product-security/. ↩︎
2. European Commission. “Cyber Resilience Act: Implementation.” Shaping Europe’s Digital Future. Accessed June 8, 2026. https://digital-strategy.ec.europa.eu/en/factpages/cyber-resilience-act-implementation. ↩︎
3. uropean Parliament and Council of the European Union. Regulation (EU) 2024/2847 of 23 October 2024 on Horizontal Cybersecurity Requirements for Products with Digital Elements (Cyber Resilience Act). Official Journal of the European Union. November 20, 2024. Accessed June 8, 2026. https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng. ↩︎
4. European Union Agency for Cybersecurity (ENISA). “Single Reporting Platform (SRP).” Accessed June 8, 2026. https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp. ↩︎
5. Polona Car. “Cybersecurity Act Review: What to Expect.” European Parliamentary Research Service, European Parliament Think Tank. December 9, 2025. Accessed June 8, 2026. https://www.europarl.europa.eu/thinktank/en/document/EPRS_ATA(2025)779252. ↩︎
6. DIGITALEUROPE. “Updating the EU Cybersecurity Framework: Industry Priorities for the Cybersecurity Act Revision.” June 2025. Accessed June 8, 2026. https://www.digitaleurope.org/resources/updating-the-eu-cybersecurity-framework-industry-priorities-for-the-cybersecurity-act-revision/. ↩︎
7. European Commission. “Proposal for a Directive as Regards Simplification Measures and Alignment with the Cybersecurity Act.” Digital Omnibus (NIS2 Amendment). January 20, 2026. Accessed June 8, 2026. https://digital-strategy.ec.europa.eu/en/library/proposal-directive-regards-simplification-measures-and-alignment-cybersecurity-act. ↩︎
8. International Organization for Standardization. ISO/IEC 30111:2019, Information Technology — Security Techniques — Vulnerability Handling Processes. 2019. Accessed June 8, 2026. https://www.iso.org/standard/69725.html. ↩︎
9. International Organization for Standardization. ISO/IEC 29147:2018, Information Technology — Security Techniques — Vulnerability Disclosure. 2018. Accessed June 8, 2026. https://www.iso.org/standard/72311.html. ↩︎