A performance audit revealed that despite €1.4 billion in spending, critical vulnerability advisories are not shared fast enough.