{
  "name": "CRA Exposure Study 2026: coordinated vulnerability disclosure readiness among EU manufacturers",
  "description": "How many EU manufacturers of products with digital elements publish a machine-readable security contact (RFC 9116 security.txt) and a discoverable coordinated vulnerability disclosure policy, measured before Article 14 of the EU Cyber Resilience Act applies on 11 September 2026.",
  "url": "https://cvdportal.com/research/cra-exposure-2026",
  "publisher": "CVD Portal, Porta Regulus B.V.",
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "scannedAt": "2026-07-29",
  "citation": "CVD Portal, \"CRA Exposure Study 2026: coordinated vulnerability disclosure readiness among EU manufacturers\", 2026-07-29. https://cvdportal.com/research/cra-exposure-2026 (CC BY 4.0)",
  "methodology": {
    "frame": "Manufacturers listed in the published member directories of European sector associations that publish member websites alongside member names. Every source association, including those rejected and the reason, is recorded in research/sources.csv in the CVD Portal repository.",
    "probes": [
      "https://<domain>/.well-known/security.txt",
      "https://<domain>/security.txt",
      "Conventional coordinated disclosure policy paths, and the Policy: URL declared in security.txt where one is present"
    ],
    "inclusionRules": [
      "Non-EU-headquartered members are excluded.",
      "National subsidiary domains are folded into the corporate domain, so the unit of analysis is the manufacturer rather than the website. Where a directory links only a national or product-line site and the corporate domain is not evident from that link, the entry is dropped rather than guessed at.",
      "Trade associations, universities and research institutes appearing in a member list are excluded, because they place no product on the market.",
      "Where an association publishes its own member categories, those categories decide which members belong to a sector, rather than a judgement made after seeing the list.",
      "Selection was fixed before the scan ran and was not adjusted after results were seen."
    ],
    "threeOutcomes": "Results are reported as present, absent, or not determinable. A 403, a 429, a bot-protection challenge or a transport failure says nothing about whether a file exists, so those are never counted as absences. Reporting them as their own category is why the headline differs from a naive scan.",
    "countryBreakdown": "Deliberately not published. Source associations are not evenly distributed across the EU, so a country cut off this frame would measure which national associations publish good directories rather than which countries comply.",
    "limitations": [
      "A manufacturer may operate a disclosure route this scan cannot see, for example on a separate product-security host that is not linked from the probed paths.",
      "Sector cells below 40 are carried in the total but not broken out.",
      "Sector cells are drawn from the associations that publish usable directories, so several are concentrated in one or two member states. That is why no country breakdown is published.",
      "Seven manufacturers appear in both the study frame and the comparison cohort. The two are separate samples and are never pooled.",
      "Where a sector cell is defined by an association's own member category, that category is self-declared by the member. In the video surveillance cell a minority of the companies are primarily installers who also badge product. The category was not overridden after the results were seen, because the only available stricter cut also removes two of the three manufacturers in that cell that do publish a security.txt.",
      "This is a dated snapshot, not a maintained series."
    ],
    "ethics": "Only paths designed for unauthenticated public retrieval were fetched. RFC 9116 exists so that security.txt is found this way. No authentication, no vulnerability probing, no port scanning. Requests were rate-limited and delayed. No individual domain, company name or per-company result is published in this artifact or anywhere else."
  },
  "overall": {
    "total": 342,
    "determinable": 297,
    "securityTxtPresent": 34,
    "securityTxtValid": 24,
    "securityTxtExpired": 3,
    "cvdPolicyFound": 20,
    "both": 14,
    "neither": 257,
    "securityTxtPct": 9.9,
    "securityTxtPctOfDeterminable": 11.4,
    "expiredPctOfPresent": 8.8,
    "cvdPolicyPct": 5.8,
    "bothPct": 4.1,
    "neitherPct": 75.1,
    "indeterminatePct": 13.2
  },
  "bySector": [
    {
      "sector": "automotive-suppliers",
      "label": "Automotive suppliers",
      "reportable": true,
      "total": 55,
      "determinable": 45,
      "securityTxtPresent": 5,
      "securityTxtValid": 3,
      "securityTxtExpired": 0,
      "cvdPolicyFound": 4,
      "both": 3,
      "neither": 39,
      "securityTxtPct": 9.1,
      "securityTxtPctOfDeterminable": 11.1,
      "expiredPctOfPresent": 0,
      "cvdPolicyPct": 7.3,
      "bothPct": 5.5,
      "neitherPct": 70.9,
      "indeterminatePct": 18.2
    },
    {
      "sector": "ev-charging-manufacturers",
      "label": "EV charging",
      "reportable": true,
      "total": 54,
      "determinable": 50,
      "securityTxtPresent": 4,
      "securityTxtValid": 2,
      "securityTxtExpired": 1,
      "cvdPolicyFound": 6,
      "both": 3,
      "neither": 43,
      "securityTxtPct": 7.4,
      "securityTxtPctOfDeterminable": 8,
      "expiredPctOfPresent": 25,
      "cvdPolicyPct": 11.1,
      "bothPct": 5.6,
      "neitherPct": 79.6,
      "indeterminatePct": 7.4
    },
    {
      "sector": "lighting-manufacturers",
      "label": "Lighting",
      "reportable": true,
      "total": 47,
      "determinable": 42,
      "securityTxtPresent": 5,
      "securityTxtValid": 2,
      "securityTxtExpired": 2,
      "cvdPolicyFound": 4,
      "both": 3,
      "neither": 36,
      "securityTxtPct": 10.6,
      "securityTxtPctOfDeterminable": 11.9,
      "expiredPctOfPresent": 40,
      "cvdPolicyPct": 8.5,
      "bothPct": 6.4,
      "neitherPct": 76.6,
      "indeterminatePct": 10.6
    },
    {
      "sector": "video-surveillance-vendors",
      "label": "Video surveillance",
      "reportable": true,
      "total": 44,
      "determinable": 38,
      "securityTxtPresent": 3,
      "securityTxtValid": 3,
      "securityTxtExpired": 0,
      "cvdPolicyFound": 0,
      "both": 0,
      "neither": 35,
      "securityTxtPct": 6.8,
      "securityTxtPctOfDeterminable": 7.9,
      "expiredPctOfPresent": 0,
      "cvdPolicyPct": 0,
      "bothPct": 0,
      "neitherPct": 79.5,
      "indeterminatePct": 13.6
    },
    {
      "sector": "robotics-manufacturers",
      "label": "Robotics and industrial automation",
      "reportable": true,
      "total": 44,
      "determinable": 39,
      "securityTxtPresent": 4,
      "securityTxtValid": 3,
      "securityTxtExpired": 0,
      "cvdPolicyFound": 0,
      "both": 0,
      "neither": 35,
      "securityTxtPct": 9.1,
      "securityTxtPctOfDeterminable": 10.3,
      "expiredPctOfPresent": 0,
      "cvdPolicyPct": 0,
      "bothPct": 0,
      "neitherPct": 79.5,
      "indeterminatePct": 11.4
    },
    {
      "sector": "medical-device-manufacturers",
      "label": "Medical devices",
      "reportable": true,
      "total": 42,
      "determinable": 34,
      "securityTxtPresent": 7,
      "securityTxtValid": 7,
      "securityTxtExpired": 0,
      "cvdPolicyFound": 4,
      "both": 3,
      "neither": 26,
      "securityTxtPct": 16.7,
      "securityTxtPctOfDeterminable": 20.6,
      "expiredPctOfPresent": 0,
      "cvdPolicyPct": 9.5,
      "bothPct": 7.1,
      "neitherPct": 61.9,
      "indeterminatePct": 19
    },
    {
      "sector": "municipal-equipment",
      "label": "Municipal and cleaning equipment",
      "reportable": true,
      "total": 40,
      "determinable": 36,
      "securityTxtPresent": 3,
      "securityTxtValid": 1,
      "securityTxtExpired": 0,
      "cvdPolicyFound": 2,
      "both": 2,
      "neither": 33,
      "securityTxtPct": 7.5,
      "securityTxtPctOfDeterminable": 8.3,
      "expiredPctOfPresent": 0,
      "cvdPolicyPct": 5,
      "bothPct": 5,
      "neitherPct": 82.5,
      "indeterminatePct": 10
    },
    {
      "sector": "smart-meter-manufacturers",
      "label": "Smart metering",
      "reportable": false,
      "total": 16,
      "determinable": 13,
      "securityTxtPresent": 3,
      "securityTxtValid": 3,
      "securityTxtExpired": 0,
      "cvdPolicyFound": 0,
      "both": 0,
      "neither": 10,
      "securityTxtPct": 18.8,
      "securityTxtPctOfDeterminable": 23.1,
      "expiredPctOfPresent": 0,
      "cvdPolicyPct": 0,
      "bothPct": 0,
      "neitherPct": 62.5,
      "indeterminatePct": 18.8
    }
  ],
  "comparisonCohort": {
    "note": "A separate, deliberately biased sample of large and well-known EU manufacturers, scanned with the same tooling on the same date. It exists to test whether the main finding is an artifact of company size. It is not part of the headline figures.",
    "description": "112 large EU manufacturers across 15 countries and 30 sectors",
    "overall": {
      "total": 112,
      "determinable": 90,
      "securityTxtPresent": 35,
      "securityTxtValid": 34,
      "securityTxtExpired": 1,
      "cvdPolicyFound": 15,
      "both": 14,
      "neither": 54,
      "securityTxtPct": 31.3,
      "securityTxtPctOfDeterminable": 38.9,
      "expiredPctOfPresent": 2.9,
      "cvdPolicyPct": 13.4,
      "bothPct": 12.5,
      "neitherPct": 48.2,
      "indeterminatePct": 19.6
    }
  }
}