August 2026. In four weeks, the EU Cyber Resilience Act's Article 14 starts a 24-hour reporting clock the moment a manufacturer becomes aware of an actively exploited vulnerability. The most common way to become aware is a researcher trying to tell you — and three out of four European vendors don't publish the standard file that lets them.
/.well-known/security.txt (HTTP 200 + a Contact: field, per RFC 9116)CRA Article 14 requires manufacturers of products with digital elements sold in the EU — including products already on the market — to file an early warning with ENISA and their coordinating CSIRT within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, a fuller notification within 72 hours, and a final report after. A researcher who can't reach you privately goes public, to a CERT, or to your customers — and your 24-hour clock starts in the worst possible way.
Single GET request to https://<domain>/.well-known/security.txt per domain on 14 August 2026, following up to 3 redirects, 8s timeout. Counted "present" only if the response was HTTP 200 and contained a Contact: line (filtering SPA catch-alls that return 200 for everything). Unreachable domains (131) excluded from percentages. The population is companies listed on europealternatives.com — European SaaS and software vendors; not a random sample of all EU manufacturers. Some vendors accept reports through other channels (bug-bounty platforms, published security emails); this scan measures RFC 9116 adoption specifically. We publish aggregates only, not the list.
Generate your security.txt Run the 7-minute readiness drill