Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study evaluates the adoption of Coordinated Vulnerability Disclosure (CVD) practices among Germany's DAX-listed companies, revealing a significant increase in adoption from 50% in 2023 to over 90% in 2025. The research highlights that legal obligations, such as the NIS2 and CRA regulations, are key drivers for this trend, while challenges like resource limitations and inconsistent report quality persist. By surveying 40 companies and analyzing their CVD programs, the findings provide valuable insights for policymakers and businesses aiming to enhance cybersecurity practices.
Adoption of Coordinated Vulnerability Disclosure programs among Germany's DAX companies skyrocketed from 50% to over 90% in just two years, driven by new EU regulations.
In our increasingly interconnected world, good IT security practices are necessary to prevent vulnerabilities and data breaches. Providing security contacts, e.g., via Coordinated Vulnerability Disclosure (CVD) programs or security.txt files, is an important practice for businesses to facilitate vulnerability reporting by external parties. As part of a longitudinal study, we analyzed the adoption of, as well as the challenges and experiences with, CVD programs among the 40 companies listed on Germany's DAX (the country's primary stock market index). In addition to monitoring publicly available information about their CVD programs, we sent out questionnaires via email and postal mail in 2023 and 2025, and received answers from 20\% of the companies. The adoption rates show a significant increase from 50\% (2023) to over 90\% (2025), with ten new CVD programs and 25 new security.txt files now available. The survey answers reveal that, for example, legal obligations (e.g., NIS2 and CRA) drive the adoption of CVD practices, but a lack of (human) resources and varying report quality are considered drawbacks. As the first study to survey 40 German stock market index (DAX) companies on their CVD practices, our results can help foster the adoption and understanding of security programs among SMEs and other companies, and provide policymakers with insights into practical challenges and industry experiences.