Two remote-access tools that suppliers use were reported exploited as zero-days in the same week. Two other dates look further away than they are. SAP's 2035 depends on a move before 2030, and the pension deadline of 2028 fills 2027.
Items 1 and 2 touch both financial and industrial organisations; 3 and 4 are for financial ones; 5 is for industrial ones.
1.Zero-day exploitation reported at Ivanti, confirmed at BeyondTrust
On 13 October the Dutch National Cyber Security Centre warned about a flaw in Ivanti Connect Secure that lets an attacker run commands remotely without logging in. Ivanti says it is aware of reports of zero-day exploitation, meaning attackers used the flaw before a fix existed. On 16 October the centre warned about BeyondTrust Remote Support up to version 26.2.3, and BeyondTrust confirms its flaw was exploited as a zero-day. The centre rates both high likelihood and high damage. For BeyondTrust it advises patching urgently and checking for signs of earlier compromise.
IT outsourcers, software vendors and machine builders use tools like these to reach your offices, plants and vessels. Patching them, and checking whether someone was already inside, is your IT team's job this week. The question for you sits one level up: who owns supplier access? A supplier account nobody on your side can disable leaves you waiting on the supplier while an attacker uses its access.
Ask your team: Which suppliers can reach our systems remotely, plant and vessel systems included, and who on our side can cut that access off within hours?
Sources: NCSC-NL, NCSC-2026-0416 (Ivanti Connect Secure), 13-10-2026 · NCSC-NL, NCSC-2026-0437 (BeyondTrust Remote Support), 16-10-2026
2.SAP's 2035 date holds only if you move to SAP ERP, private edition, before 2030
On 13 October SAP updated its article on the transition option, the route SAP offers customers moving off the old on-premise system. Subscriptions may now run until 31 December 2035, two years past the earlier 2033, "with further prerequisites". One condition is a move to SAP ERP, private edition on SAP HANA, part of RISE with SAP, before 31 December 2030. SAP has not named the further prerequisites in public; they sit in a support note behind the customer login, which I have not read.
The baseline has not moved. Mainstream maintenance for SAP ECC 6.0 ends on 31 December 2027, with optional extended maintenance to 2030. The extra years are runway after the move, not time for the system on your own servers today. A business case that stays on premise and counts on 2035 plans for years SAP has not offered. The gap returns as a migration you must fund and staff at short notice.
Ask your team: If our SAP roadmap counts on 2035, have we committed to the move, and has SAP told us in writing which further conditions apply?
Sources: SAP News, update of 13-10-2026 · SAP News, maintenance to 2027 and 2030, 04-02-2020 · SAP Note 3591251 (customer login; not read)
3.About 55 Dutch pension funds and circles expect to move to the new pension system after 1 January 2027, most on the legal deadline
On 15 October DNB, the Dutch central bank and pension supervisor, published its quarterly update on the move to the new pension system. It counts funds and the circles within general pension funds together. About two-thirds are expected to have moved by 1 January 2027. About 55 expect to go later, most on 1 January 2028, the legal deadline. Insurers and premium pension institutions still have about 38,000 schemes to convert, more than half of all such schemes.
I expect 2027 to be a year of limited capacity for administrators. A fund board has to decide what its 2027 calendar can carry; an administrator has to decide which clients get its people, and when. Get it wrong and a 2027 programme competes with a legal deadline for the same people, and loses.
Ask your team: Which funds in our administration move on 1 January 2028, and which of our 2027 changes need the same people?
Sources: DNB, quarterly update on transition progress, 15-10-2026
4.The European supervisors keep critical technology providers and cyber preparedness on their 2027 agenda
On 13 October the European supervisors for banking, insurance and markets set their joint priorities for 2027. They will continue overseeing critical technology providers under DORA, the EU's digital resilience rules for financial firms. They list digital operational resilience as a priority, aim to strengthen preparedness against cyber threats, and will assess the growing use of AI.
Nothing here is a new obligation; it tells you where supervisors will look next year. For a bank, insurer or pension fund, I read that as a reason to put third-party risk, exit plans for critical providers and cyber exercises in the 2027 budget. Treat provider oversight as done because the EU list is out, and your exit plans may still be untested when a supervisor asks to see one work.
Ask your team: For each critical technology provider, do we have a tested exit plan, a named owner, and money for both in the 2027 budget?
Sources: EBA, European Supervisory Authorities set priorities for 2027, 13-10-2026
5.Mistral says its new models for sensor data run on ordinary processors, even fully offline
On 15 October Mistral published Timestral, four time-series models from 5 million to 209 million parameters, on Hugging Face under a licence it calls "Modified MIT". Mistral says they run on ordinary processors, without graphics chips. Mistral says they can run on premise, in your own virtual private cloud, or air-gapped, cut off from outside networks. It names anomaly detection and catching equipment drift before it fails.
If Mistral's claims hold, a predictive-maintenance pilot on vessels or plants can start with a small model reading your own sensor data on site. I have not tested any of this. Start with the cloud contract instead and you may send sensor data off site for a job a local model could have done. Either way, the licence needs a lawyer's reading, because "modified" means Mistral changed the standard terms.
Ask your team: Which maintenance or anomaly case could we test on a local model, using our own sensor data?
Sources: Mistral, Timestral, 15-10-2026
From Delfen this week
- The Delfen Practitioner Briefing, promised on delfen.ai, is now this weekly update; if you signed up for the briefing, this is the email you will get each Tuesday.
- On 18 October I published The AI Act's first harmonised standard covers your quality system, not your AI on delfen.ai.
- On 18 October I updated our scored comparison of AI tools for regulated and industrial teams. Since July, Mistral Medium 3.5 can run fully offline through Microsoft Azure Local, on Microsoft's conditions, so three of the thirteen tools have a documented offline route, up from two.
- On 12 October delfen.com published Exit planning for outsourced policy administration and Material cloud use under the Dutch cloud policy.
- No corrections.
Checked and quiet
The Cbw, the Dutch cyber security act, still has no enforcement action I could find, and no new count of registered organisations. I found no DORA fines, and no list of critical technology providers newer than 18 November 2025. The Dutch markets supervisor's 14 October update to its fine policy is mainly technical; nothing in it says fines went up. I found no agreed position yet among EU governments on exempting some older cloud contracts from the new switching rights. The Machinery Regulation, the new EU safety rules for industrial machines, still applies from 20 January 2027.