A Level Four study · Version 1.0
Assessed on Faith
This is the frozen copy of version 1.0, published 27 October 2026. It never changes. The current version is at l4is.ai/study.
What dealer software vendors publish about their own security, measured on the four things a security reviewer looks for before signing: a security or trust page, a way to report a vulnerability, a sub-processor list, and breach notification terms.
62%
of the companies assessed publish none of the four.1
77 of 124 companies. The study covers 147 brands across 126 independent companies, assessed from public sources only, as of 5 September 2026.
Finding 1
Most of the market publishes none of the four.#
A dealer reviewing a vendor under the Safeguards Rule starts with what the vendor publishes. For 77 of the 124 companies, there is nothing to start with.
- Publish none of the four77 of 12462%
- Security or trust page42 of 12434%
- Sub-processor list18 of 12415%
- Vulnerability disclosure route15 of 12412%
- Breach notification terms4 of 1243%
A company publishes a signal when any of its verified brands does. At brand level, 87 of the 145 brands (60%) publish none of the four.1
Finding 2
Nobody publishes all nine.#
Add five more things a reviewer can check from outside — SOC 2, ISO 27001, penetration testing, documented MFA or SSO, and an enforcing email policy — and the best any company manages is eight. 97 of the 124 publish three or fewer.
- 0All nine
- 86 to 8
- 194 or 5
- 731 to 3
- 24None
Companies, by how many of the nine signals they publish. A floor, not a census: a signal that could not be read on an otherwise verified site counts as not published.
Finding 3
Only the vendor can stop mail forging its domain.#
A DMARC policy tells receiving mail servers to refuse messages that forge a domain. It costs nothing to publish, and a dealer cannot publish it for the vendor.
43 of 145
brands do not enforce a DMARC policy (29.7%). 38 publish a monitor-only policy; 5 publish none.
32 of 43
already have SPF and DKIM working. For most of them the fix is one change to a record they already publish.
40 of the 124 companies have at least one brand that does not enforce.3 Enforcing means a policy of quarantine or reject.
Ask your critical suppliers one question: is your DMARC policy set to quarantine or reject?
Credit
Fifteen of 124 give anyone a way to report a security flaw.#
A vulnerability disclosure route is the simplest signal to publish: a page or a security.txt file that says where to send a report. These are the companies that publish one, named by the brand that publishes it.
- AutoFi
- Autosoft
- Canopy Connect
- Carfax
- CarsDirect
- Cox Automotive
- DriveCentric
- Experian Automotive
- Fullpath
- iPacket
- Jupiter Warranty Management
- Orbee
- RevolutionParts
- Toma
- TrueCar
The study names companies only for what they publish, never alongside a missing result.
For dealers
The Rule makes the review yours. The evidence is the vendor’s.#
The FTC Safeguards Rule requires a dealer to oversee its service providers.2 When a vendor publishes nothing, that oversight rests on faith. Four questions turn it back into evidence:
- Where is your security or trust page?
- Where do I report a vulnerability in your product?
- Who else handles my customers’ data? Send me your sub-processor list.
- How quickly will you tell me about a breach, and where is that in writing?
The Walkthrough
The whole study in eight minutes.#
The full argument, signal by signal: what was checked, what was found, and what it does and does not mean for a dealer signing a vendor.
Limits
What this study does not claim#
- It is not a finding about how secure any company is. It measures what a vendor publishes. Many of these companies may run excellent programs that they simply do not describe in public.
- Nothing was scanned or tested. Only public DNS records and public web pages were read — what any customer can see for themselves.
- It is not a compliance finding. No company is said to be in or out of compliance with any rule.
- No vendor is named alongside a missing result. Companies are named only for what they publish, as credit.
Method
How it was done#
Scope. 147 brands across 126 independent companies serving automotive retail. Data as of 5 September 2026.
Two layers. Email authentication records in public DNS, and the security documentation on each vendor’s own website, including vulnerability reporting routes.
Checked by hand. Every automated positive was verified against the live page. A second pass in a rendering browser read claims that sit in images and badges, which a text fetcher cannot see.
Unknown stays unknown. A page that could not be reached is excluded, never counted as publishing nothing.
For vendors
Ask for your scorecard. Send us a correction.#
Every brand in the study has a private scorecard showing exactly what was read on its site and in its DNS. If something published during the collection window was missed, send the page and we will correct it in the open.
The scorecard is free, with no obligation. If it would help, a short call with the author to walk through it is available on request.
Not in the study? You can still request a scorecard, and your company will be included in the next version. We intend to rerun the study periodically to measure the industry’s progress.
Versions
Every version stays published#
This page is always the current version. Each version also has its own frozen copy, PDF and DOI that never change. Every change to a published figure goes in the corrections log, dated, with what changed and why.
Corrections log: none yet. It opened with version 1.0. Read the log.
Cite
Cite, author, notes#
Tubbs, Andrew. Assessed on Faith: Vendor Security Transparency Study. Version 1.0. Level Four LLC, 2026. https://doi.org/10.5281/zenodo.23600828
About the author
Andrew Tubbs — thirty years in software and information security, including as Director of Information Security at Cox Automotive, where he led the business information security team for the retail brands.
Disclosure: Cox Automotive is a past employer of the author and Cox brands are in the sample; the study credits Cox as one of the fifteen companies publishing a vulnerability disclosure route. The study is self-funded. The author’s consultancy, Level Four, has commercial relationships in this market.
Notes
- Percentages are calculated on the 145 brands and 124 companies that could be verified. Two brands could not be reached and are excluded rather than counted as publishing nothing. ↩a ↩b
- Federal Trade Commission, Standards for Safeguarding Customer Information, 16 C.F.R. § 314.4(f). ↩
- Counted when at least one of the company’s brands does not enforce. Companies with no enforcing brand at all: 38. ↩