Buy your .security domain today

A .security domain covers both halves of the industry, which is broader than people assume. Cybersecurity vendors, infosec consultancies, penetration testers and managed detection providers are the obvious half.

The other half is physical: alarm and CCTV installers, access control specialists, guarding companies and event security firms all use the word in exactly the same sense.

Both are visible on the extension today, so neither reading is a stretch or a repurposing of somebody else’s word.

A .security domain is available first come, first served, with no license, certification or industry credential required.

No professional body is involved in issuing the name, and nobody verifies that you work in security at all.

What does apply is a set of technical conditions on how the site is served, which is unusual and is covered below.

A .security domain has been open to the public since it launched, though it very nearly was not. The extension was originally applied for by a major antivirus company as a closed generic, meaning one company would have held every name.

That plan changed as the industry turned against exclusive-access extensions, and the string was sold to its current operator before it was ever delegated. It therefore did not run as a closed namespace at any point.

The practical upshot is that the whole extension opened at once with nothing grandfathered, so availability was not carved up among insiders.

Yes, real security companies run on .security addresses, at both ends of the market. Oasis Security, a non-human identity management vendor since acquired by a larger security company, uses one for its main site.

At the physical end, Arrow Security operates a guarding business on a .security address, which shows the word is not reserved in practice for the software side.

It is a small namespace, so a recognizable name is a meaningful signal rather than a statistical one. At least one company has also rebranded away from it, which is worth knowing before you assume adoption only runs one way.

No, a .security domain suits physical security work just as naturally as it suits infosec, and the registry markets it to both.

Home and commercial alarm installation, CCTV and monitoring, access control, locksmithing, event security and close protection all describe themselves with the same word.

For a local installer it is often the clearer option, because the sector extensions aimed at trades do not name the service and this one does.

Effectively yes, and this is the single most unusual thing about a .security domain. The registry publishes security requirements for the extension that expect modern TLS, HTTP requests redirected to HTTPS and strict transport security enabled.

It also backs them up. The registry states that it scans the namespace and reserves the right to suspend a registration immediately where a deficiency creates a high likelihood of harm.

For most sites this changes nothing practical, since an SSL certificate is included and enabled by default. It is worth knowing about because it is a real condition of holding the name rather than a recommendation.

A .security domain needs an extended validation certificate only in specific circumstances. The registry’s requirements call for one on sites handling personal information or card and bank data, and allow an ordinary certificate elsewhere.

A marketing site, an advisory blog or a company brochure sits comfortably in the second group and needs nothing beyond the standard certificate.

If you plan to take payments or collect sensitive client data directly on the site, factor the stricter certificate into the setup rather than discovering it afterwards.

A .security domain costs far more than an ordinary extension, and unlike most extensions the renewal is often higher than the first year rather than lower. Both numbers are worth checking before you commit.

The price reflects a deliberately small, premium namespace rather than a volume business. Only a few hundred names were registered in its early years, and the cost has kept it that way.

There is an argument that the price is doing useful work, since it prices out the casual registrations that give cheap extensions their reputation. Where it does not work is for a small installer or an independent consultant, and for them a conventional extension is the sensible call.