Skip to main content

Methodology

This page explains how the CRA Data Institute produces its figures. It applies to every study unless a study states otherwise.

Frame​

The study frame is drawn from the published member directories of European sector associations that list member websites alongside member names. Every source association, including those rejected and the reason, is recorded in the study source register. Non-EU-headquartered members are excluded. Trade associations, universities and research institutes are excluded, because they place no product on the market. Where an association publishes its own member categories, those categories decide which members belong to a sector. The selection is fixed before a scan runs and is not adjusted after the results are seen.

What we probe​

For each manufacturer we fetch only paths designed for unauthenticated public retrieval.

  • https://<domain>/.well-known/security.txt
  • https://<domain>/security.txt
  • Conventional coordinated disclosure policy paths, and the Policy URL declared in security.txt where one is present.

Three outcomes, not two​

A result is reported as present, absent, or not determinable. A 403, a 429, a bot-protection challenge or a transport failure says nothing about whether a file exists, so it is never counted as an absence. Reporting these as their own category is why our headline differs from a naive scan that treats every non-answer as a failure.

Why there is no country breakdown​

The source associations are not evenly distributed across the EU. A country cut off this frame would measure which national associations publish good directories, not which countries comply. So no country breakdown is published.

Ethics​

Only public retrieval paths were fetched. RFC 9116 exists so that security.txt is found this way. No authentication, no vulnerability probing, no port scanning. Requests were rate-limited and delayed. No individual domain, company name or per-company result is published anywhere.

Limitations​

  • A manufacturer may operate a disclosure route this scan cannot see, for example on a separate product-security host that is not linked from the probed paths.
  • Some sector cells sit outside the CRA for finished products, such as medical devices and type-approved vehicles, which are governed by their own regulations. Those cells are still measured, because being reachable about a vulnerability matters under either regime, but they are not a claim that those manufacturers are subject to Article 14.
  • Small sector cells are carried in the total but are not broken out on their own.
  • Each study is a dated snapshot. A delta between two snapshots reports count changes and percentage-point changes over the same frame, and reports determinability changes separately, because a manufacturer moving between not-determinable and absent is a change in what the scan could see rather than a change in compliance.