August 2026. In four weeks, the EU Cyber Resilience Act's Article 14 starts a 24-hour reporting clock the moment a manufacturer becomes aware of an actively exploited vulnerability. The most common way to become aware is a researcher trying to tell you — and three out of four European vendors don't publish the standard file that lets them.
Results
623European software vendor domains scanned (source: the europealternatives.com directory of European SaaS/software companies)
492reachable over HTTPS at scan time
118 (24%)publish a valid security.txt at /.well-known/security.txt (HTTP 200 + a Contact: field, per RFC 9116)
374 (76%)publish none — no standard private channel for a researcher to report a vulnerability
Why this matters after 11 September 2026
CRA Article 14 requires manufacturers of products with digital elements sold in the EU to file an early warning with ENISA and their coordinating CSIRT within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, a fuller notification within 72 hours, and a final report after. It reaches the installed base: Article 69(2) grandfathers products placed on the market before 11 December 2027, but Article 69(3) derogates from that specifically so "the obligations laid down in Article 14 shall apply to all products with digital elements … placed on the market before 11 December 2027". A researcher who can't reach you privately goes public, to a CERT, or to your customers — and your 24-hour clock starts in the worst possible way.
Methodology & caveats
Single GET request to https://<domain>/.well-known/security.txt per domain on 14 August 2026, following up to 3 redirects, 8s timeout. Counted "present" only if the response was HTTP 200 and contained a Contact: line (filtering SPA catch-alls that return 200 for everything). Unreachable domains (131) excluded from percentages. The population is companies listed on europealternatives.com — European SaaS and software vendors; not a random sample of all EU manufacturers. Some vendors accept reports through other channels (bug-bounty platforms, published security emails); this scan measures RFC 9116 adoption specifically. We publish aggregates only, not the list.
Reproduce it
The check is one request per domain, so you can verify the method on any list you like — no need to take our number on trust:
while read -r d; do
curl -sfL -m 8 "https://$d/.well-known/security.txt" \
| grep -qi '^[[:space:]]*contact:' \
&& echo "$d present" || echo "$d missing"
done < domains.txt
We publish the aggregate, not the list of vendors — naming companies that lack a security contact would help the wrong people first. If you believe your domain was misclassified (for example you serve the file only to certain user agents, or it was briefly down on 14 August), email [email protected] and we'll recheck and correct the figure.
Fix yours in 30 seconds
Generate your security.txt Run the 7-minute readiness drill