Dozens of America's largest companies have no simple way to report security flaws
If you found a security bug or vulnerability at a top American company, there's a good chance that you will have no easy way of alerting them.
This is because around one-third of the largest companies in the United States have no apparent way to notify them about security issues, such as through a dedicated email address or bug bounty program, according to a new analysis of the top 100 companies by revenue and their websites by this week in security.
Some of these companies, like Cencora, Charter, and Home Depot, have experienced major security incidents in the past but still have not opened their virtual doors to outside reports.
I previously wrote about why it's critical for companies and organizations to make it easier for people to report bugs. Security researchers and regular consumers alike find issues all the time, from the highly complex flaws to the dead-simple data exposures. People who care about brands want to help them succeed, but often find no way to escalate a potential issue.
A company that lets people contact them through a dedicated security channel, like an email address, a web form, or a more formalized vulnerability disclosure or bug bounty program, can make the difference between resolving a security issue before it can be exploited, or knowing nothing and having to mop up after a malicious cyberattack.
An open door is all the more important because of the fear of repercussions and legal risks that comes with security research and reporting security issues. All too often, companies invoke their attorneys out of fear of damage to the company's reputation or outright ignorance. Having a way to let people report flaws sends a message to the outside world that the company is willing to be helped, rather than ready to sue someone into silence.
There are easy, commonly used, and industry standard ways that companies can achieve this. These options range from the very simple, like adding a security.txt text file in a well-known location on a company's domain that contains the best email address for researchers to contact, all the way through to formal vulnerability disclosure programs and bug bounties that compensate people for their findings.
This week, I analyzed the main websites and core platforms and services of the top 100 largest American companies, known as the Fortune 100. I looked for security contact information, such as security.txt files and mentions of any vulnerability or security disclosure programs on their websites. This process included manually scanning the websites of tech and phone giants, retail conglomerates, healthcare and insurance companies, banks, financiers, carmakers, and more.
The results are, in my view, not great! This is what I found:
Almost three-quarters (73%) of the Fortune 100 have no security.txt file on their website. This file is one of the first things that an outside researcher will look for on a company's website to immediately find their contact information. This means 73 companies have no easy-to-find security contact information for someone to report a security flaw.
That said, 65% of the Fortune 100 do have some form of vulnerability or coordinated disclosure policy, or bug bounty program. This suggests that there is willingness among many of the top companies to receive security reports from people; it's just not always as immediately obvious how to find these company pages to begin with. Much of my discovery relied on searching for "company name" + "vulnerability disclosure" or similar language in search engines.
However, around half (47%)of the bug bounties offered by these companies do not financially reward outsiders for their submissions, despite being run by some of the most revenue-driving companies in the United States.
Most of the tech companies, such as Amazon, Apple, Google, Microsoft, and Uber, compensate security researchers for their bug reports, but outliers include Cisco, Nvidia, HP, and Oracle, which do not pay security researchers for their work.
In total, around one-third (30%) of the Fortune 100 have no obvious or clear way to report a security issue at all, or make it clear where to report security issues.
PLEASE SUPPORT THIS NEWSLETTER!
*\~this week in security\~ is my weekly cybersecurity newsletter supported by readers like you. Please consider signing up for a *paying subscription starting at $10/month for exclusive articles, analysis, and more.
Or, you can **submit a one-time tip to show your support!
Subscribe to access premium blogs
My observations from this analysis is that companies should still make it easier for people to reach out to them. The optics are important and it sends a signal that a company cares. The information could be helpful, and could help spare a company — and its users' data — from a cybersecurity disaster.
I've reported on countless breaches in the past in my career as a cyber reporter. And I can tell you how frustrating it is scrambling around trying to find (or guess) the email address of a company's CEO to notify them of an ongoing security lapse, only to get nothing back — or correspondence from their lawyers.
But the wealthiest companies in America certainly have no excuses. They have more money, power, and resources than some countries. Good-faith researchers and customers alike shouldn't have to traverse every circle of Hell just to do a company a favor.
Shoutout to EdOverflow, who is behind the security.txt project and suggested that I check out findsecuritycontacts.com; and Casey Ellis who helps to run disclose.io, both of which have granular lists to search for security contact information and more. These projects are great, so bookmark them for when you need them. Also, Katie Moussouris who runs consultancy Luta Security keeps a regular blog with tons of information about why bug bounties and vulnerability disclosure programs can benefit you and others.
I have included the raw data below for all paid subscribers to peruse. Yes, this took some time to figure out. No, AI wasn't used at all. Please let me know if you see any errors or corrections needed, as humans make mistakes, too.
All the cyber news you need to know, delivered weekly.
sign up for Zack Whittaker's weekly cybersecurity newsletter. Hand-written, zero slop.
Subscribe
Email sent! Check your inbox to complete your signup.
No email open or link tracking. Unsubscribe anytime.
This article is for subscribers on the Loyal subscribers, Cyber compatriots and Astonishing admins tiers only
Subscribe now
You might also like...
28
Jun
'26
Reflections on eight years of writing \~this week in security\~
Your favorite weekly cybersecurity newsletter marks eight years on the web.
6 min read
[](https://this.weekinsecurity.com/reflections-on-eight-years-of-writing-this-week-in-security/)
10
Jun
'26
The sneaky ways that governments get your private data
Discover some of the most common ways that authorities, police, and spies obtain your personal data, and how you can prevent it from ending up in their hands.
12 min read
[](https://this.weekinsecurity.com/the-sneaky-ways-that-governments-get-your-private-data/)
06
Jun
'26
Meta confirms thousands of Instagram accounts were hacked by abusing its AI chatbot
Meta fixed the bug that let anyone trick its Meta AI chatbot into resetting the password on Instagram accounts that didn't have two-factor authentication.
4 min read
[](https://this.weekinsecurity.com/meta-confirms-thousands-of-instagram-accounts-were-hacked-by-abusing-its-ai-chatbot/)
23
May
'26
Oura says it gets government demands for user data. Will it share how many?
Oura users' data is not end-to-end encrypted and can be handed to the government. Will the wearable tech maker say how often it turns over data?
4 min read
[](https://this.weekinsecurity.com/oura-says-it-gets-government-demands-for-user-data-will-it-share-how-many/)
20
May
'26
AI can find bugs and flaws, but don't forget the cybersecurity basics
The leading cause of big breaches is failing to do the cybersecurity fundamentals.
5 min read
[](https://this.weekinsecurity.com/ai-can-find-bugs-and-flaws-but-do-not-forget-the-cybersecurity-basics/)