On 6 August 2026 the German Federal Office for Information Security published a press release with a single number in it. Of the German website operators the BSI measured through its Cyberdome project, 1.8 percent publish a security.txt. The BSI and the Allianz für Cyber-Sicherheit used the occasion to call on operators to set one up, and pointed at the Cyber Resilience Act as the reason the clock matters.
We ran a different scan for a different reason. On 29 July 2026 we measured 342 EU manufacturers drawn from named trade association directories, across automotive suppliers, EV charging, lighting, video surveillance, robotics, medical devices, municipal equipment and smart metering. The question was narrower than the BSI's. We wanted to know whether the specific companies that Article 14 of the CRA binds on 11 September 2026 can be contacted about a vulnerability at all.
Two scans, two populations, two organisations with no connection to each other. Both land on the same finding.
What each number actually measures
These figures are not interchangeable, and treating them as one number would be the easiest mistake to make with them.
The BSI measured German website operators. That population is mostly not manufacturers of products with digital elements. It includes every business, association and public body with a domain, and the CRA does not reach most of them. The release does not state whether the 1.8 percent counts files that merely exist or files that conform to RFC 9116.
We measured EU manufacturers inside CRA scope, selected by membership of sector associations rather than by size or prominence. In that frame, 9.9 percent publish a security.txt of any kind. Only 7.0 percent publish one that meets RFC 9116, meaning it carries a Contact field and has not expired. A discoverable coordinated disclosure policy exists at 5.8 percent. Three quarters of the frame, 75.1 percent, have neither.
So the two headline percentages differ by a factor of five, and that is expected. Manufacturers are a more security-mature slice of the web than the web at large. What the two scans agree on is the shape. Both find that the contact channel a vulnerability report has to arrive through mostly does not exist, at a point when law is about to assume it does.
The BSI's two mandatory fields are where our data gets interesting
The BSI release makes a point of how small the task is. Only two entries are required, a concrete contact for security reports and an expiration date after which the information is treated as stale. The file goes at /.well-known/security.txt and nothing else is mandatory.
Our scan separated presence from conformance precisely because of that second field, and the gap it opens is the part worth reading twice. Of the 342 manufacturers, 34 publish a file. Only 24 of those files are valid. Ten companies in the frame have done the work of publishing a security contact and still do not have a working one, three of them because the Expires date has passed.
That is a 29 percent failure rate among the companies that already tried. An expired security.txt is not a neutral outcome. Under RFC 9116 a researcher is entitled to treat the contact behind it as no longer trustworthy, so the file that was supposed to open a channel is now evidence the channel was abandoned. Whatever number the BSI's 1.8 percent represents, the count of German operators actually reachable through a conforming file is at or below it.
Per sector the gap is wider than the average suggests. Lighting shows 10.6 percent publishing something and 4.3 percent publishing something valid. Municipal and cleaning equipment shows 7.5 percent against 2.5 percent. Video surveillance and robotics, 44 manufacturers each, returned zero discoverable disclosure policies between them.
Firm size explains more than sector does
We scanned a deliberately biased control on the same day with the same tooling. 112 large, well-known European manufacturers, the household names. They reach 31.3 percent on file presence against 9.9 percent for the association-membership frame.
Three times better, and still most of them fail. That comparison is the reason we think the BSI's call is aimed at the right audience but will be hardest to land with the companies that need it most. Readiness concentrates in firms with a product security team. The CRA does not, and the base it actually reaches is the small and mid-sized manufacturer with no such team.
What changes on 11 September 2026
Article 14 of Regulation (EU) 2024/2847 starts to apply on 11 September 2026. From that date a manufacturer that becomes aware of an actively exploited vulnerability in its product has 24 hours to submit an early warning to its CSIRT and ENISA, 72 hours for the detailed vulnerability notification, and a final report within 14 days of a corrective or mitigating measure becoming available. Full applicability of the regulation follows in December 2027.
The reporting duty starts from awareness. Nothing in the text requires a manufacturer to be findable, and no regulator is going to fine anyone for missing a security.txt. The practical consequence is quieter than a penalty. A researcher who cannot find a contact publishes, or reports to a CSIRT that then has to find you, or gives up. In the first two cases your 24 hour clock started before you knew there was a clock. Publishing a contact does not create the obligation. It gives you the chance to be the first to know the obligation has been triggered.
That is why we consider the file a reporting readiness control rather than a hygiene item, and why our scan measured it alongside the disclosure policy rather than on its own.
Doing the thing the BSI asked for
The minimum conforming file is four lines and takes longer to get through change control than to write.
Contact: mailto:[email protected]
Expires: 2027-08-08T00:00:00.000Z
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt
Serve it at https://example.com/.well-known/security.txt as text/plain. Four things determine whether it works.
- The address must reach a monitored inbox. A
security@alias forwarding to a departed employee is the most common way this fails silently. Expiresshould be under a year out, and renewing it has to be somebody's recurring job. This is the field that turned ten of our 34 publishers into a non-contact.- Add
Policypointing at a page that states scope, what you commit to, and your position on good-faith research. The CRA expects a policy under Annex I Part II, and the joint CISA guidance published in July gives sample safe harbour wording. - Signing the file with PGP is optional under RFC 9116 and worth skipping until the rest works.
The Allianz für Cyber-Sicherheit publishes its own implementation note as BSI-CS 149, in German, which is the document to hand to a German administrator who wants the authority's own wording.
Check your own domain
Our exposure scanner probes the same paths the study used and tells you which of the three outcomes you fall into. It is free and takes a domain, no account.
The full study, including the per-sector breakdown, the sampling frame and the limitations, is published at CRA Exposure Study 2026. The aggregate dataset is CC BY 4.0 and no individual company is named in it.
One request for anyone reporting on either measurement. The BSI's 1.8 percent and our 9.9 percent describe different populations, and our 9.9 percent and 7.0 percent describe different things. Publishing a file and publishing a working file are separate findings, and the distance between them is most of what either study has to say.