Loading story…
The security.txt standard, defined in RFC 9116, lets organizations publish a machine-readable vulnerability-reporting contact at /.well-known/security.txt. Dutch authorities and the Digital Trust Center (DTC) promoted the low-cost standard to route responsible-disclosure reports directly to the correct team, reducing the time needed to identify owners of vulnerable systems. Internet.nl added a test for both the presence and validity of the file, and the Netherlands made security.txt a “Pas toe of leg uit” requirement for central and local government bodies and related public organizations.
Adoption has grown but remains inconsistent. More than 77,000 Dutch domains deployed security.txt after the DTC’s 2022 campaign, and an early-2023 measurement found implementation on nearly 20% of assessed government sites; however, only 2.2% of .nl web domains reportedly had a valid file by 2024. SIDN consequently planned to reward registrars with scorecard-related financial discounts for .nl domains carrying usable security.txt files, alongside platform support in DirectAdmin, cPanel, Plesk, and WordPress tooling that can sign files and warn of expiration.
See the reporting duties and controls this puts on the clock.
11 events from the most recent confirmed update back to the earliest known activity.
Forum Standaardisatie added security.txt to the Dutch “Pas toe of leg uit” list, requiring its use by municipalities, provinces, central-government bodies, water authorities, and implementing organizations.
Forum Standaardisatie held a public consultation on whether security.txt should be added to the Dutch “Pas toe of leg uit” list.
An Internet.nl measurement found that nearly 20% of assessed Dutch government websites had implemented a security.txt file.
The Digital Trust Center and numerous ambassadors called on companies and IT service providers to publish security.txt files.
The Digital Trust Center began warning Dutch companies when it identified serious security vulnerabilities, an activity for which it later used security.txt contact details to speed notification.
The IETF began work on a universal standard for reporting security vulnerabilities, work that later produced the security.txt protocol specified in RFC 9116.
The Digital Trust Center became part of the Dutch National Cyber Security Centre.
SIDN announced plans to include security.txt availability and validity in its Registrar Scorecard incentive program, offering a financial discount for .nl domains with usable files. SIDN worked with the Vereniging van Registrars to increase adoption among Dutch domain and hosting providers.
Following the October 2022 adoption appeal, more than 88,000 Dutch domain names had deployed a security.txt file.
An expert assessment commissioned by Forum Standaardisatie concluded that security.txt offered clear value, had a low technical implementation threshold, and should be added to the Dutch “Pas toe of leg uit” list.
Internet.nl added a security.txt test to its website-testing service in collaboration with the Digital Trust Center. The test checks for the presence of a file and whether it conforms to the required format.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcerfc-editor.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Netherlands integrated the Digital Trust Center (DTC) into the National Cyber Security Centre (NCSC) on 1 January 2026, consolidating the DTC, NCSC and CSIRT-DSP into a national capability for public- and private-sector cyber-threat, victim and target notifications. The organizations had already established a single NCSC intake point for threat and incident data and a common assessment framework, aiming to provide organizations with a scalable warning service from one sender. The **Wet bevordering digitale weerbaarheid bedrijven** provides the legal basis to process and share vulnerability, threat and incident information—including necessary IP-address and business-contact data—with non-critical businesses. The DTC’s notification service expanded from targeted alerts launched in 2021 to more than 140,000 company-specific warnings in 2023 and over 238,000 vulnerability warnings during 2024. Notifications covered exposed internet services, configuration errors, vulnerable software and leaked corporate credentials, including alerts connected to **Operation Endgame**. At Saxion University of Applied Sciences, a DTC alert about stolen email credentials enabled rapid password resets, log reviews and user notification; MFA prevented account misuse and the institution found no resulting damage. The integrated NCSC service will continue delivering actionable alerts and supporting Dutch organizations with NIS2 preparedness guidance, community intelligence sharing and cyber-resilience tools.
Aug 31, 2026
The Dutch House of Representatives approved the **Cybersecurity Act** (`Cyberbeveiligingswet`), advancing the Netherlands’ implementation of the EU `NIS2` Directive. The act will replace the existing Network and Information Systems Security Act (`Wbni`) and impose statutory cybersecurity due-care, incident-reporting, and registration obligations on thousands of essential and important organizations. The National Cyber Security Centre’s remit is expected to expand to more than 8,000 organizations. The bill now proceeds to the Senate, while the government continues preparing the Cybersecurity Decree and sector-specific ministerial rules, including incident-reporting thresholds. The government has sought to align commencement of the act, its implementing measures, and the related Critical Entities Resilience Act—implementing the EU `CER` Directive—with a target effective date in the second quarter of 2026, subject to completion of the legislative process. Organizations likely to fall within scope have been urged to prepare controls, governance, supply-chain safeguards, and reporting processes ahead of enforcement.
Aug 31, 2026
The Netherlands’ **Cybersecurity Act** (`Cyberbeveiligingswet`, Cbw) has taken effect, transposing the EU’s NIS2 Directive and replacing the former Wbni framework. More than 8,000 organizations providing essential or important services across 18 sectors must register in the national entity register, manage network and information-system risks, report significant incidents to their designated CSIRT and competent authority, and establish board-level accountability for cybersecurity, including director training. The National Cyber Security Centre manages the register and can provide registered entities or their sectoral CSIRTs with threat intelligence and incident assistance; supervisory authorities will enforce compliance. The accompanying **Critical Entities Resilience Act** (`Wet weerbaarheid kritieke entiteiten`, Wwke) implements the EU CER Directive and will designate roughly 500 critical entities. Those organizations must address resilience against cyber incidents as well as sabotage, terrorism, natural disasters, and other disruptions to essential services. Although the Cbw does not directly regulate suppliers, covered organizations must manage supply-chain risks and may require risk-proportionate security controls and supporting evidence from direct suppliers whose products or services could affect their systems or physical operations.
Aug 31, 2026