Skip to main content
All Industries

EU Industry Benchmark

Banking

Anonymized security posture data for the banking sector across the EU. Based on 2986 monitored sites.

44.6

Avg. Score /100

D

Avg. Grade

2986

Sites Tracked

+5.0

vs. EU Average

Critical findings in this industry

2353 of 2986 without HTTPS redirect

79.0%

2947 of 2986 with unencrypted email (no STARTTLS)

99.0%

2976 of 2986 without DMARC protection (spoofable)

100.0%

355 of 2986 missing 3+ critical security headers

12.0%

2553 of 2986 without DNSSEC (vulnerable to DNS spoofing)

85.0%

2613 of 2986 without CAA records (unrestricted certificate issuance)

88.0%

2920 of 2986 without MTA-STS (email downgrade attacks possible)

98.0%

Grade Distribution

A
0 (0.0%)
B
11 (0.0%)
C
355 (12.0%)
D
1651 (55.0%)
F
969 (32.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 41.4/100 (126 sites) Belgium: 43.9/100 (60 sites) Bulgaria: 45.7/100 (28 sites) Croatia: 42.2/100 (24 sites) Cyprus: 41.5/100 (25 sites) Czech Republic: 42.9/100 (53 sites) Denmark: 50.1/100 (46 sites) Estonia: 44.9/100 (17 sites) Finland: 48.2/100 (18 sites) France: 40.3/100 (174 sites) Germany: 47.0/100 (1106 sites) Greece: 40.5/100 (17 sites) Hungary: 42.1/100 (39 sites) Ireland: 45.8/100 (109 sites) Italy: 40.6/100 (179 sites) Latvia: 44.2/100 (20 sites) Lithuania: 37.6/100 (26 sites) Luxembourg: 46.8/100 (14 sites) Netherlands: 48.3/100 (38 sites) Norway: 53.4/100 (57 sites) Poland: 42.4/100 (285 sites) Portugal: 44.8/100 (29 sites) Romania: 42.4/100 (36 sites) Slovakia: 44.5/100 (30 sites) Slovenia: 49.1/100 (14 sites) Spain: 39.9/100 (83 sites) Sweden: 48.6/100 (30 sites) Switzerland: 45.0/100 (104 sites) United Kingdom: 41.5/100 (168 sites)
Worse
Better

Score by Country

🇦🇹 Austria
41.4 126 🇧🇪 Belgium
43.9 60 🇧🇬 Bulgaria
45.7 28 🇭🇷 Croatia
42.2 24 🇨🇾 Cyprus
41.5 25 🇨🇿 Czech Republic
42.9 53 🇩🇰 Denmark
50.1 46 🇪🇪 Estonia
44.9 17 🇪🇺 European Union
47.5 4 🇫🇮 Finland
48.2 18 🇫🇷 France
40.3 174 🇩🇪 Germany
47.0 1106 🇬🇷 Greece
40.5 17 🇭🇺 Hungary
42.1 39 🇮🇸 Iceland
54.0 7 🇮🇪 Ireland
45.8 109 🇮🇹 Italy
40.6 179 🇱🇻 Latvia
44.2 20 🇱🇮 Liechtenstein
45.1 11 🇱🇹 Lithuania
37.6 26 🇱🇺 Luxembourg
46.8 14 🇲🇹 Malta
45.6 9 🇳🇱 Netherlands
48.3 38 🇳🇴 Norway
53.4 57 🇵🇱 Poland
42.4 285 🇵🇹 Portugal
44.8 29 🇷🇴 Romania
42.4 36 🇸🇰 Slovakia
44.5 30 🇸🇮 Slovenia
49.1 14 🇪🇸 Spain
39.9 83 🇸🇪 Sweden
48.6 30 🇨🇭 Switzerland
45.0 104 🇬🇧 United Kingdom
41.5 168

Hosting & Data Residency

30%

EU-headquartered provider

70%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 237 22.9%
Microsoft Azure (US) 200 19.3%
Amazon Web Services (US) 162 15.7%
Akamai (US) 122 11.8%
OVHcloud (FR) 101 9.8%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.