By Alex Johnson, March 10, 2026

Managed Security Services Utah

The Importance of Cybersecurity Standards

In an age where digital threats are increasingly sophisticated, maintaining robust cybersecurity is more essential than ever. As part of a significant effort to bolster internet security, the introduction of RFC9116 in April 2022 was a critical move towards establishing a standardized format for reporting security vulnerabilities. This standard simplifies the reporting process by allowing a text file to be placed in the /.well-known/ folder of a domain, addressing the prevalent issue: security researchers often struggle to find the appropriate channels to report vulnerabilities, leading to many risks remaining unreported.

Assessing Adoption Rates

Our extensive project aims to enhance the understanding and compliance with these standards through a three-pronged approach. First, we evaluate the adoption rates of the security.txt file across internet domains. Among the top one million domains analyzed, only 0.7% (6,816 domains) have adopted this crucial file. Even more concerning is that merely 19% of these domains comply with RFC standards. This data underscores a significant gap in cybersecurity practices that organizations must address to enhance their defenses.

Key Findings from the Analysis

The analysis of these domains revealed several critical areas needing improvement. Here are key findings:

1. Contact Information: The “Contact” field of the security.txt file allows for various Uniform Resource Identifiers (URIs). Our data indicates that 67% use email addresses, 31% list URLs, and a mere 2% provide a telephone number for contact. This variability highlights the need for standardized communication methods within the cybersecurity community.
2. Expiration Date Compliance: The “Expires” field is crucial as it indicates when the security.txt data should be considered obsolete. Alarmingly, 46% of the domains analyzed failed to specify this field. Furthermore, 4% presented invalid expiration dates, 18% had expired entries, 0.3% were set to expire within a week, and 23% set overly distant expiration dates that contradict RFC recommendations.
3. Encryption Inclusion: The presence of an encryption key in 32% of security.txt files is necessary for safe communication. According to our findings, most files utilize htps (92%), while 4% use openpgp4fpr. The remaining percentages feature either invalid values or violate guidelines by presenting the key itself rather than a URI linking to its location.
4. Digital Signature Implementation: To enhance file authenticity, it is recommended that security.txt files include an OpenPGP signature. Yet, only 10% of the files in our study incorporated this essential feature. Notably, we successfully validated 40% of all signed files using a key that was published in the encryption field, shedding light on the issue of verification.
5. Grammatical Discrepancies: An interesting yet minor discrepancy was noted regarding the term “Acknowledgments” vs. “Acknowledgements.” While both variations are grammatically correct, the RFC specifies “Acknowledgments.” Alarmingly, 12% of the analyzed files opted for the less accepted variant, and even prominent companies such as Google have fallen victim to this oversight.
6. Content-Type Compliance: Compliance with the prescribed text/plain format is critical for security.txt files. Surprisingly, 3% of the domains served the file with a format contrary to the regulations, indicating a gap in adherence to standards.
7. Line Separator Standard: Proper formatting dictates that each line in the security.txt file must conclude with designated characters. However, our analysis revealed that 31% of the files neglected this requirement, potentially leading to parsing errors that impede vulnerability reporting.
8. Canonical URL Alignment: Among the 29% of files that specified a “Canonical” field, discrepancies between the provided URI and the URL where the file was accessed were frequent, creating confusion that could hinder effective security communication.
9. Duplicate and Unknown Fields: Additional minor issues included duplication of fields (such as Expires and Preferred-Languages) across five domains. Moreover, 10% of files contained unknown or invalid fields, emphasizing the need for thorough reviews of security.txt configurations.

Implications of Findings

This extensive review highlights both progress made and ongoing challenges in the journey toward a universally secure and reliable internet. It clearly demonstrates the areas in dire need of attention to uphold cybersecurity standards. Organizations need to recognize the importance of these protocols and strive for better implementation practices to fortify their defenses against potential threats.

Tools for Verification and Compliance

To streamline the process of verifying compliance for security.txt files, we have developed URIports. This tool automatically detects whether monitored domains publish a security.txt file, checks for errors, and notifies administrators of any discrepancies for prompt resolution. By making tools like this available, we aim to enhance accountability and foster a more secure cyberspace. More information on these managed security services in Utah can support organizations looking to strengthen their internet security posture.

As the landscape of cyber threats continues to evolve, embracing and adhering to such standards is not just beneficial but essential for safeguarding digital assets. Organizations that prioritize security, transparency, and compliance with established protocols will be better positioned to defend against the ever-present risks looming in the online environment.

In conclusion, the journey toward universal compliance with cybersecurity standards is ongoing and requires collective effort from all stakeholders within the digital ecosystem. By prioritizing education, implementation, and adherence to these standards, we can move towards a safer internet for everyone.

Disclaimer: This article contains information aimed at promoting understanding of cybersecurity practices. It is advisable to consult a professional for specific security concerns or needs.