Vulnerability response is becoming a 24-hour operational duty

Since 11 September 2026, the EU Cyber Resilience Act puts exploited vulnerabilities on a 24-hour clock. The hard part is engineering.