76% of 623 EU software vendors have no security.txt ahead of the CRA 24h rule