GoKawiilStudy finds 76% of EU software vendors lack security.txt before CRA deadline
A scan of 623 European software vendor domains found that only 118 (24%) published a valid security.txt file with a working contact address, while 374 (76%) had none, according to a survey using RFC 9116 criteria. The check comes weeks before the EU Cyber Resilience Act's Article 14 takes effect, imposing a 24-hour reporting window once a vendor learns of an actively exploited vulnerability.
GoKawiil's interpretation of the reporting above, not reported fact.
Without a published, standard channel for researchers to privately report flaws, companies risk finding out about exploited vulnerabilities only when they go public or reach regulators first, which starts their legal 24-hour clock under the worst circumstances. Article 69(3) of the CRA extends this obligation even to products already on the market, meaning vendors can't wait for new releases to get compliant channels in place.
- Only 24% of 623 scanned EU vendor domains have a valid security.txt file with a contact method.
- CRA Article 14, effective September 2026, gives manufacturers just 24 hours to report actively exploited vulnerabilities to authorities.
- The reporting duty applies retroactively to already-marketed products, per Article 69(3), leaving little room for delay in fixing disclosure gaps.
Alice and Bob Learn Application Security (Tanya Janca) — If the CRA's 24-hour clock has you auditing your disclosure process, this book is a practical grounding in application security fundamentals — including how to set up vulnerability reporting and handle incoming researcher reports. It's written for developers and teams who need to build secure-by-default habits rather than scramble after an alert.
See Alice and Bob Learn Application Security (Tanya Janca) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: cradrill.com, 2026-08-26
Published there as: “76% of 623 EU software vendors have no security.txt ahead of the CRA 24h rule”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.