Skip to main content
All Industries

EU Industry Benchmark

Banking

Anonymized security posture data for the banking sector across the EU. Based on 2983 monitored sites.

50.5

Avg. Score /100

D

Avg. Grade

2983

Sites Tracked

+11.0

vs. EU Average

Critical findings in this industry

1607 of 2983 without HTTPS redirect

54.0%

2944 of 2983 with unencrypted email (no STARTTLS)

99.0%

2973 of 2983 without DMARC protection (spoofable)

100.0%

524 of 2983 missing 3+ critical security headers

18.0%

2547 of 2983 without DNSSEC (vulnerable to DNS spoofing)

85.0%

2609 of 2983 without CAA records (unrestricted certificate issuance)

87.0%

2916 of 2983 without MTA-STS (email downgrade attacks possible)

98.0%

Grade Distribution

A
0 (0.0%)
B
21 (1.0%)
C
879 (29.0%)
D
1465 (49.0%)
F
618 (21.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 47.0/100 (125 sites) Belgium: 47.0/100 (60 sites) Bulgaria: 44.0/100 (28 sites) Croatia: 43.4/100 (24 sites) Cyprus: 47.1/100 (25 sites) Czech Republic: 48.0/100 (52 sites) Denmark: 53.9/100 (46 sites) Estonia: 50.1/100 (17 sites) Finland: 60.3/100 (18 sites) France: 44.3/100 (174 sites) Germany: 54.1/100 (1106 sites) Greece: 49.1/100 (17 sites) Hungary: 44.0/100 (39 sites) Ireland: 51.3/100 (109 sites) Italy: 45.2/100 (178 sites) Latvia: 45.0/100 (20 sites) Lithuania: 44.5/100 (26 sites) Luxembourg: 52.4/100 (14 sites) Netherlands: 58.0/100 (38 sites) Norway: 55.0/100 (57 sites) Poland: 46.3/100 (285 sites) Portugal: 48.0/100 (29 sites) Romania: 47.9/100 (36 sites) Slovakia: 50.5/100 (30 sites) Slovenia: 51.1/100 (14 sites) Spain: 46.8/100 (83 sites) Sweden: 66.1/100 (30 sites) Switzerland: 49.0/100 (104 sites) United Kingdom: 52.0/100 (168 sites)
Worse
Better

Score by Country

🇦🇹 Austria
47.0 125 🇧🇪 Belgium
47.0 60 🇧🇬 Bulgaria
44.0 28 🇭🇷 Croatia
43.4 24 🇨🇾 Cyprus
47.1 25 🇨🇿 Czech Republic
48.0 52 🇩🇰 Denmark
53.9 46 🇪🇪 Estonia
50.1 17 🇪🇺 European Union
50.2 4 🇫🇮 Finland
60.3 18 🇫🇷 France
44.3 174 🇩🇪 Germany
54.1 1106 🇬🇷 Greece
49.1 17 🇭🇺 Hungary
44.0 39 🇮🇸 Iceland
49.0 7 🇮🇪 Ireland
51.3 109 🇮🇹 Italy
45.2 178 🇱🇻 Latvia
45.0 20 🇱🇮 Liechtenstein
45.4 11 🇱🇹 Lithuania
44.5 26 🇱🇺 Luxembourg
52.4 14 🇲🇹 Malta
47.4 9 🇳🇱 Netherlands
58.0 38 🇳🇴 Norway
55.0 57 🇵🇱 Poland
46.3 285 🇵🇹 Portugal
48.0 29 🇷🇴 Romania
47.9 36 🇸🇰 Slovakia
50.5 30 🇸🇮 Slovenia
51.1 14 🇪🇸 Spain
46.8 83 🇸🇪 Sweden
66.1 30 🇨🇭 Switzerland
49.0 104 🇬🇧 United Kingdom
52.0 168

Hosting & Data Residency

30%

EU-headquartered provider

70%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 238 23.0%
Microsoft Azure (US) 200 19.3%
Amazon Web Services (US) 162 15.6%
Akamai (US) 122 11.8%
OVHcloud (FR) 101 9.7%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.