Skip to content

Security.txt across the industry#

DENOG 17 (Essen) digest Program Wildcard pick Essen · 9–11 November 2025

Abstract Slides (PDF) Slides (PPTX) Recording

Sascha Heinemann (EdgeOps)

Play the recording: Security.txt across the industry

  • Why: A data-driven analysis of security.txt (RFC 9116) adoption across DENOG-attending organizations — reveals the actual state of vulnerability disclosure readiness in the German/European network industry. Signals a gap the PM should be aware of.
  • What: An adoption survey of security.txt among organizations represented at DENOG17, broken down by industry segment. Key numbers from 239 organizations: overall adoption by segment — consulting/services 21%, carrier 17%, hosting/cloud 31%, education/research 40%, hardware 17%, datacenter/colo 25%, IXPs 43%, public authority 67%. Valid (correctly formatted) rates are much lower — 0–15% across segments. Notable adopters include Netflix, SAP, BelWü, Init7, Inter.link, KIT, and DE-CIX (www.de-cix.net has one, though with canonical URL quirks).
  • How: The security.txt file is a simple, machine-readable standard published at /.well-known/security.txt with fields for contact, encryption key, expiration, and preferred languages. The analysis checked for presence, validity, and correct formatting (PGP-signed, canonical URLs, etc.).
  • Where applicable: Any organization that operates public-facing infrastructure. The finding that only 43% of IXPs and 31% of hosting/cloud providers have security.txt (with much lower valid rates) is a direct call to action. Low-effort, high-value security hygiene.