Security.txt across the industry#

Sascha Heinemann (EdgeOps)

• Why: Not a deeply technical talk, but a data-driven survey of security.txt (RFC 9116) adoption across DENOG-attending organizations with genuinely useful findings — and a striking gap between "has security.txt" and "has a valid security.txt" that reveals how shallow security readiness is, even among network operators.
• What: An adoption analysis of 239 organizations across industry segments represented at DENOG17. Key findings: only 17–43% have security.txt depending on segment (carriers 17%, hosting/cloud 31%, education/research 40%, IXPs 43%, public authorities 67%); valid rates (correctly formatted, signed, canonical, with proper expiration) are far lower — 0–15%. Notable adopters include Netflix, SAP, BelWü, Init7, Inter.link, KIT, and DE-CIX (though with canonical URL quirks). The BSI's own security.txt expires in 2099.
• How: Analysis of /.well-known/security.txt presence, format validity, PGP signatures, expiration dates, and canonical URL correctness across the sampled organizations. Data as of Nov 6, 2025. An interactive checker was made available at edgeops.de/sectxt.
• Where applicable: Any organization operating public-facing infrastructure. The finding that even IXPs (43% adoption, 0% valid) and hosting providers (31% adoption, 5% valid) have poor readiness is a direct, low-effort call to action. Standards-based (RFC 9116), universally applicable.