NIS2

You Have 24 Hours. The Attacker Had 29 Minutes. Neither Number Matters.

NIS2 gives you 24 hours to report. The average intrusion is over in 29 minutes. Everyone points at that gap and calls the regulation obsolete. They are aiming at the wrong number, and the real one is far worse.

Johan Kölhi

Johan Kölhi

— 6 min read
Share
You Have 24 Hours. The Attacker Had 29 Minutes. Neither Number Matters.

Put the two headline numbers next to each other and NIS2 looks ridiculous.

The directive gives you 24 hours from awareness to file an early warning with your national CSIRT. CrowdStrike measured the average eCrime breakout time in 2025 at 29 minutes. The fastest breakout they observed was 27 seconds. In one intrusion, data exfiltration started four minutes after initial access.

So the law grants you a full day to write your first paragraph about an attack that finished before your coffee got cold. That is the argument you hear in every security conference bar right now: Brussels is regulating at human speed while the adversary runs at machine speed.

It is a good line. It is also aimed at the wrong number.

The number nobody puts on the slide is 18 days

NIS2's clock does not start when the attack starts. Article 23 starts it when the entity becomes aware of a significant incident. That single word carries the whole problem.

Average dwell time in Europe, according to CSIRT-derived reporting, is now 18 days. It was 24 the year before, so the trend is good. It is still 18 days.

Line the three numbers up and the real sequence appears:

t = 0          initial access
t = 29 min     attacker has moved laterally (average)
t = 18 days    you notice
t = 18d + 24h  early warning filed, legally on time

NIS2 governs the last 24 hours of a 19-day failure. You can hit every deadline in the directive, file perfectly, satisfy your regulator, and still lose everything that mattered on day one.

The 24-hour deadline is not too slow for AI attacks. It is irrelevant to them. The 18 days is where your loss actually happens, and no regulation in Europe puts a binding number on it.

NIS2 was never a speed limit

Reading NIS2 as an incident response SLA is a category error, and it is why compliance teams feel a mismatch that isn't really there.

The directive is a disclosure and governance instrument. The 24h/72h/one-month cascade exists so national CSIRTs can spot cross-border patterns early, not so your SOC moves faster. Article 21 handles risk management in broad terms and stays deliberately threat-agnostic. It does not care whether the intruder is a person, a script, or an agent.

There is one place where the text does push on speed, and most organisations get it exactly backwards. Delaying your submission to gather full details is itself a violation. You are required to report on incomplete information. Teams routinely sit on a filing while the investigation matures, which breaks the rule they think they are respecting.

Worth knowing before you optimise the wrong thing: reporting failures are penalised independently of how well you handled the incident. Essential entities face up to €10m or 2% of global turnover. Important entities up to €7m or 1.4%. Management bodies carry personal liability. You can run a textbook response and still get fined for the paperwork.

Where the directive genuinely does fall short

The speed criticism is weak. The threat-model criticism is not.

The Carnegie Endowment made the sharp version of it in July 2026. European frameworks are anchored in perimeter defence, certification, and entity resilience. That model assumes something breaks in and something detects the break-in. It has very little to say about systems that act with permission inside environments that already trust them.

CrowdStrike's data says that is now the normal case. 82% of detections were malware-free. Valid account abuse drove 35% of cloud incidents. There is often no payload to catch, because the attacker logged in.

Then add agents to the picture. Attack volume from AI-enabled adversaries rose 89% year over year. More than 90 organisations were compromised through prompt injection into legitimate GenAI tools they had deployed themselves. In November 2025, a state-sponsored operation using Claude ran an estimated 80 to 90% of its operations autonomously, compressing months of skilled human work into days. In May 2026, researchers documented the first fully autonomous post-exploitation attack orchestrated end to end by an LLM agent in the wild.

NIS2 sets no standards for authenticating autonomous agents, logging their actions, or detecting when someone has manipulated them. Certification regimes built for static products cannot handle systems whose behaviour, in Carnegie's words, "varies with context, cannot be fully predicted in advance, and changes as the system acquires new tools."

The AI Act does not cover the hole either. It does not regulate agentic AI as a distinct category, and it excludes military, defence, and national security uses, which is precisely where the most consequential autonomous capability will show up first.

Meanwhile, enforcement has started anyway

None of that stops the regulator. 23 of 27 member states had fully transposed by mid-2026. On 8 July 2026 the Commission referred Ireland, Spain, France, and the Netherlands to the CJEU for failing to notify full transposition. First fines have landed: €185,000 in Belgium, €450,000 in Italy, €78,000 in Hungary.

A January 2026 amendment proposal would add mandatory ransomware reporting, including whether a ransom was demanded, whether it was paid, how much, and to whom. Adoption is expected late 2026 or early 2027, with 12 months to transpose after that.

So you face a regime that is behind schedule, still moving, and already fining people. Waiting for the picture to settle is not a strategy.

What to actually do

Ordered by impact, not by ease.

  1. Attack the awareness gap, not the deadline. 18 days is the number that costs you money. Every euro spent shortening it beats a euro spent on filing speed.
  2. Stress-test against a sub-30-minute breakout. If your tabletop assumes the team has an afternoon to convene, it is theatre. Rerun it against 29 minutes and watch what breaks.
  3. Pre-authorise containment. Human-pace triage averages a 30 to 60 minute alert delay, which is longer than the entire attack. Bounded autonomy fixes this: agents that can isolate a host, revoke credentials, and kill a session inside defined limits without waiting for an approval chain. The Cloud Security Alliance reports MTTR for ransomware-precursor scenarios dropping from 4 to 6 hours down to 8 to 15 minutes when the action sits inside agent parameters. Reserve human authorisation for destructive steps.
  4. Defend identity, not the perimeter. With 82% of detections malware-free, the credential is the attack. Phishing-resistant MFA, short session-token lifetimes, and real privileged-access review beat buying another detection tool.
  5. Segment so 29 minutes buys less. You will not out-run breakout time. You can shrink what it reaches. Microsegmentation is the rare control that degrades attack speed instead of trying to match it.
  6. Patch edge devices on their own SLA. 40% of targeted vulnerabilities were VPNs, firewalls, and gateways, and pre-disclosure zero-day exploitation rose 42%. Edge kit needs an emergency lane, not the monthly cycle.
  7. Make the 24-hour filing boring. Named decision-maker with authority to file on partial information. Pre-written template. CSIRT contact details tested, not looked up during the incident.
  8. Govern your own agents. Your internal AI tooling is in-scope attack surface. Agent identity, action logging, and least-privilege tool access are Article 21 concerns now, whether or not the text spells it out.

The honest summary

NIS2 keeps up fine at the job it was designed for. It makes disclosure honest, it forces cross-border visibility, and management liability has moved more European security budget than any technical mandate ever did.

It does not keep up as a defence framework, and it was never written to be one. The gap is not 24 hours versus 29 minutes. The gap is 18 days of silence that nobody is legislating and everybody is living with.

Fix your detection time. The compliance clock will take care of itself.

Sources

Read more