1.8 percent.

On 6 August 2026 the German Federal Office for Information Security and the Allianz für Cyber-Sicherheit published a press release with one number in it. Of the German website operators measured through the BSI's Cyberdome project, 1.8 percent publish a security.txt. The two bodies used the occasion to call on operators to set one up, and pointed at the Cyber Resilience Act as the reason the timing matters.

A week earlier we had finished a scan built to answer a narrower question. On 29 July 2026 we measured 342 EU manufacturers drawn from named trade association directories, across automotive suppliers, EV charging, lighting, video surveillance, robotics and industrial automation, medical devices, municipal equipment and smart metering. We wanted to know whether the specific companies that Article 14 of the CRA binds from 11 September 2026 can be contacted about a vulnerability at all.

Two organisations, two populations, two toolchains, no connection between them. The finding is the same.

Do not put the two percentages in one sentence

They are measuring different worlds, and quoting them as a single trend would be the easiest mistake to make with them.

The BSI frame is German website operators of every kind. Every business, association and public body with a domain. The CRA does not reach most of them, and the release does not state whether the 1.8 percent counts files that merely exist or files that conform to RFC 9116.

Our frame is EU manufacturers of products with digital elements, selected by association membership rather than by size or prominence. In that frame 9.9 percent publish a security.txt of any kind. That the manufacturer number runs roughly five times higher is the expected result, because manufacturers are a more security-mature slice of the web than the web at large. What the two measurements agree on is the direction. The channel a vulnerability report has to arrive through mostly does not exist, at the point where law starts assuming it does.

The BSI's two mandatory fields are where the data gets interesting

The release makes a point of how small the task is. Only two entries are required, a concrete contact for security reports and an expiration date after which the information is treated as stale. The file goes at /.well-known/security.txt and nothing else is mandatory.

We separated presence from conformance for exactly that reason, and the gap it opens is the part worth reading twice.

Ten companies in the frame did the work of publishing a security contact and still do not have a working one. Three of those because the Expires date has passed. That is a 29 percent failure rate among the manufacturers who already tried, and the field carrying most of it is one of the two the BSI singles out as mandatory.

An expired security.txt is not a neutral outcome. Under RFC 9116 a researcher is entitled to treat the contact behind an expired file as no longer trustworthy. The document that was supposed to open a channel becomes evidence the channel was abandoned. So whatever the BSI's 1.8 percent represents, if it counts files rather than working files, the number of German operators actually reachable sits below it.

Firm size explains more than sector does

We scanned a deliberately biased control on the same day with the same tooling. 112 large, well-known European manufacturers, the household names. They reach 31.3 percent on file presence against 9.9 percent for the association-membership frame.

Three times better, and most of them still fail. Readiness concentrates in firms with a product security team. The CRA does not scale its obligation by company size, and the base it actually reaches is the small and mid-sized manufacturer with no such team. That is the audience the BSI call is aimed at and the audience hardest to reach with it.

Per sector the presence figure and the working figure diverge further than the average suggests. Lighting shows 10.6 percent publishing something against 4.3 percent publishing something valid. Municipal and cleaning equipment, 7.5 against 2.5. Video surveillance and robotics, 44 manufacturers in each cell, returned zero discoverable disclosure policies between them.

What changes on 11 September 2026

Article 14 of Regulation (EU) 2024/2847 starts to apply on 11 September 2026. From that date a manufacturer that becomes aware of an actively exploited vulnerability in its product has 24 hours for an early warning to its CSIRT and ENISA, 72 hours for the detailed notification, and a final report within 14 days of a corrective or mitigating measure becoming available. Full applicability of the regulation follows in December 2027.

The duty runs from awareness. Nothing in the text obliges a manufacturer to be findable, and no authority is going to penalise a missing security.txt. The consequence is quieter than a penalty. A researcher who cannot find a contact publishes, or reports to a CSIRT that then has to find you, or gives up. In the first two cases your 24 hour clock started before you knew there was a clock.

Publishing a contact does not create the obligation. It buys you the chance to be first to know the obligation has been triggered. That is why we treat the file as a reporting readiness control rather than a hygiene item, and why the scan measured it alongside the disclosure policy instead of on its own.

The thing the BSI asked for, in four lines

The minimum conforming file takes longer to get through change control than to write.

Contact: mailto:security@example.com
Expires: 2027-08-08T00:00:00.000Z
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt

Serve it at https://example.com/.well-known/security.txt as text/plain. Four things decide whether it works. The address has to reach a monitored inbox, and a security@ alias forwarding to a departed employee is the most common silent failure. Expires should be under a year out and renewing it has to be somebody's recurring job, because that is the field that turned ten of our thirty-four publishers into a non-contact. A Policy line should point at a page stating scope, commitments and your position on good-faith research, which the CRA expects under Annex I Part II anyway. Signing the file with PGP is optional under RFC 9116 and worth skipping until the rest works.

The Allianz für Cyber-Sicherheit publishes its own implementation note as BSI-CS 149, in German, dated 30 April 2024. That is the document to hand a German administrator who wants the authority's own wording.

The short version

Two independent measurements, five weeks before Article 14 applies, both find that most of the companies a vulnerability report needs to reach cannot be reached. The BSI's 1.8 percent and our 9.9 percent describe different populations and must not be quoted as one number. Our 9.9 percent and 7.0 percent describe different things, and the distance between them is most of what either study has to say. Publishing a file and publishing a working file are separate achievements, and about a third of the companies that manage the first do not manage the second.

The full study, the per-sector breakdown, the sampling frame and the limitations are published at CRA Exposure Study 2026. The aggregate dataset is CC BY 4.0 and names no individual company. The longer write-up of the BSI comparison is on the CVD Portal blog. To check a single domain, the exposure scanner probes the same paths the study used and needs no account.