Routing Security Update#

Brad Gorman, ARIN (Director of Customer Technical Services)

• Why: Routing security is squarely in the PM's network-security remit, and this is the one session with hard adoption data and a preview of ASPAs — the next RPKI object after ROAs. It also matters for anyone building products that depend on customers having their RPKI in order.
• What: A data-driven status report on RPKI adoption in the ARIN region plus ARIN's RPKI roadmap. Headline numbers: 9,673 organizations registered for RPKI (up 27% year over year), but roughly 1 in 7 hosted-RPKI organizations has never created a single ROA — "registered is not the same as protected." 59.4% of ARIN-registered IPv4 blocks seen in announcements are RPKI Valid. Globally, 3,389 ASPAs (Autonomous System Provider Authorizations) now exist across the five RIR repositories (2,081 at RIPE NCC, 685 at ARIN), and all five RIRs will support ASPA creation by end of 2026 as the RFC finishes ratification.
• How: The adoption analysis slices coverage by entity type (government vs. education vs. commercial) and by geography within the ARIN region, isolating where ROA coverage lags. On the tooling side, ARIN is building "BGP Insight": correlating prefixes on a resource certificate with what's actually seen in the global BGP table, explaining Invalid/Not Found states, showing the impact of proposed ROA changes before they're made, and presenting paths to a Valid state. Also in flight: ASPA info in the RPKI changelog, new Reg-RWS RESTful API capabilities, and inter-RIR work toward RPKI feature parity.
• Where applicable: RPKI validity and ASPA trends are global; the hosted/delegated/repository service tiers and the adoption figures are ARIN-region-specific. ASPA momentum is the transferable takeaway for any operator doing BGP security planning in 2027 — the object class is about to become generally creatable across all RIRs.