Skip to main content
All Industries

EU Industry Benchmark

Banking

Anonymized security posture data for the banking sector across the EU. Based on 2995 monitored sites.

52.2

Avg. Score /100

D

Avg. Grade

2995

Sites Tracked

+8.0

vs. EU Average

Critical findings in this industry

2371 of 2995 without HTTPS redirect

79.0%

1543 of 2995 with unencrypted email (no STARTTLS)

52.0%

1968 of 2995 without DMARC protection (spoofable)

66.0%

300 of 2995 missing 3+ critical security headers

10.0%

2551 of 2995 without DNSSEC (vulnerable to DNS spoofing)

85.0%

2613 of 2995 without CAA records (unrestricted certificate issuance)

87.0%

2928 of 2995 without MTA-STS (email downgrade attacks possible)

98.0%

Grade Distribution

A
1 (0.0%)
B
220 (7.0%)
C
399 (13.0%)
D
1972 (66.0%)
F
403 (13.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 48.9/100 (125 sites) Belgium: 50.7/100 (61 sites) Bulgaria: 48.4/100 (28 sites) Croatia: 46.5/100 (24 sites) Cyprus: 48.8/100 (26 sites) Czech Republic: 46.1/100 (52 sites) Denmark: 58.4/100 (46 sites) Estonia: 49.1/100 (17 sites) Finland: 55.4/100 (18 sites) France: 48.2/100 (175 sites) Germany: 57.0/100 (1109 sites) Greece: 44.5/100 (17 sites) Hungary: 45.4/100 (40 sites) Ireland: 49.9/100 (109 sites) Italy: 47.0/100 (179 sites) Latvia: 47.0/100 (20 sites) Lithuania: 46.5/100 (26 sites) Luxembourg: 53.9/100 (14 sites) Netherlands: 55.9/100 (38 sites) Norway: 56.8/100 (57 sites) Poland: 46.4/100 (285 sites) Portugal: 49.0/100 (29 sites) Romania: 47.0/100 (37 sites) Slovakia: 53.8/100 (30 sites) Slovenia: 50.7/100 (14 sites) Spain: 46.1/100 (83 sites) Sweden: 62.7/100 (30 sites) Switzerland: 50.7/100 (105 sites) United Kingdom: 52.1/100 (169 sites)
Worse
Better

Score by Country

🇦🇹 Austria
48.9 125 🇧🇪 Belgium
50.7 61 🇧🇬 Bulgaria
48.4 28 🇭🇷 Croatia
46.5 24 🇨🇾 Cyprus
48.8 26 🇨🇿 Czech Republic
46.1 52 🇩🇰 Denmark
58.4 46 🇪🇪 Estonia
49.1 17 🇪🇺 European Union
56.2 4 🇫🇮 Finland
55.4 18 🇫🇷 France
48.2 175 🇩🇪 Germany
57.0 1109 🇬🇷 Greece
44.5 17 🇭🇺 Hungary
45.4 40 🇮🇸 Iceland
52.5 8 🇮🇪 Ireland
49.9 109 🇮🇹 Italy
47.0 179 🇱🇻 Latvia
47.0 20 🇱🇮 Liechtenstein
52.9 11 🇱🇹 Lithuania
46.5 26 🇱🇺 Luxembourg
53.9 14 🇲🇹 Malta
52.8 9 🇳🇱 Netherlands
55.9 38 🇳🇴 Norway
56.8 57 🇵🇱 Poland
46.4 285 🇵🇹 Portugal
49.0 29 🇷🇴 Romania
47.0 37 🇸🇰 Slovakia
53.8 30 🇸🇮 Slovenia
50.7 14 🇪🇸 Spain
46.1 83 🇸🇪 Sweden
62.7 30 🇨🇭 Switzerland
50.7 105 🇬🇧 United Kingdom
52.1 169

Hosting & Data Residency

30%

EU-headquartered provider

70%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 237 22.9%
Microsoft Azure (US) 200 19.3%
Amazon Web Services (US) 162 15.6%
Akamai (US) 122 11.8%
OVHcloud (FR) 101 9.7%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.