On 11 September 2026 the EU Cyber Resilience Act's Article 14 starts a 24-hour reporting clock, running from the moment a manufacturer becomes aware of an actively exploited vulnerability. The most common way to become aware is a researcher trying to tell you. Three out of four European vendors do not publish the standard file that lets them.
/.well-known/security.txt (HTTP 200 + a Contact: field, per RFC 9116)CRA Article 14 requires manufacturers of products with digital elements sold in the EU to file an early warning with ENISA and their coordinating CSIRT within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, a fuller notification within 72 hours, and a final report after. It reaches the installed base: Article 69(2) grandfathers products placed on the market before 11 December 2027, but Article 69(3) derogates from that specifically so "the obligations laid down in Article 14 shall apply to all products with digital elements … placed on the market before 11 December 2027". A researcher who cannot reach you privately goes public, or to a CERT, or straight to your customers. Your 24-hour clock then starts in the worst possible way.
Single GET request to https://<domain>/.well-known/security.txt per domain on 14 August 2026, following up to 3 redirects, 8s timeout. Counted "present" only if the response was HTTP 200 and contained a Contact: line (filtering SPA catch-alls that return 200 for everything). Unreachable domains (131) excluded from percentages. The population is companies listed on europealternatives.com, which are European SaaS and software vendors rather than a random sample of all EU manufacturers. Some vendors accept reports through other channels (bug-bounty platforms, published security emails); this scan measures RFC 9116 adoption specifically. We publish aggregates only, not the list.
The check is one request per domain, so you can verify the method on any list you like rather than take our number on trust:
while read -r d; do
curl -sfL -m 8 "https://$d/.well-known/security.txt" \
| grep -qi '^[[:space:]]*contact:' \
&& echo "$d present" || echo "$d missing"
done < domains.txt
We publish the aggregate, not the list of vendors. Naming companies that lack a security contact would help the wrong people first. If you believe your domain was misclassified (for example you serve the file only to certain user agents, or it was briefly down on 14 August), email hello@cradrill.com and we'll recheck and correct the figure.
If your domain is one of the 374, it takes about half a minute to change that.
Generate your security.txt Run the 7-minute readiness drill