Skip to main content
All Industries

EU Industry Benchmark

Government

Anonymized security posture data for the government sector across the EU. Based on 1623 monitored sites.

47.5

Avg. Score /100

D

Avg. Grade

1623

Sites Tracked

+7.0

vs. EU Average

Critical findings in this industry

861 of 1623 without HTTPS redirect

53.0%

1595 of 1623 with unencrypted email (no STARTTLS)

98.0%

1614 of 1623 without DMARC protection (spoofable)

99.0%

463 of 1623 missing 3+ critical security headers

29.0%

1187 of 1623 without DNSSEC (vulnerable to DNS spoofing)

73.0%

1371 of 1623 without CAA records (unrestricted certificate issuance)

84.0%

1517 of 1623 without MTA-STS (email downgrade attacks possible)

93.0%

Grade Distribution

A
0 (0.0%)
B
25 (2.0%)
C
298 (18.0%)
D
850 (52.0%)
F
450 (28.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 47.6/100 (50 sites) Belgium: 50.1/100 (34 sites) Bulgaria: 44.9/100 (35 sites) Croatia: 37.4/100 (35 sites) Cyprus: 36.8/100 (17 sites) Czech Republic: 46.5/100 (53 sites) Denmark: 52.5/100 (39 sites) Estonia: 49.5/100 (40 sites) Finland: 46.5/100 (37 sites) France: 48.0/100 (121 sites) Germany: 49.8/100 (168 sites) Greece: 40.7/100 (43 sites) Hungary: 41.9/100 (32 sites) Ireland: 48.6/100 (36 sites) Italy: 44.7/100 (83 sites) Latvia: 46.5/100 (37 sites) Lithuania: 44.3/100 (41 sites) Luxembourg: 46.6/100 (38 sites) Netherlands: 57.2/100 (50 sites) Norway: 55.8/100 (33 sites) Poland: 46.8/100 (65 sites) Portugal: 48.8/100 (31 sites) Romania: 41.1/100 (31 sites) Slovakia: 44.0/100 (32 sites) Slovenia: 43.5/100 (20 sites) Spain: 43.8/100 (93 sites) Sweden: 54.0/100 (53 sites) Switzerland: 46.4/100 (58 sites) United Kingdom: 51.7/100 (140 sites)
Worse
Better

Score by Country

🇦🇹 Austria
47.6 50 🇧🇪 Belgium
50.1 34 🇧🇬 Bulgaria
44.9 35 🇭🇷 Croatia
37.4 35 🇨🇾 Cyprus
36.8 17 🇨🇿 Czech Republic
46.5 53 🇩🇰 Denmark
52.5 39 🇪🇪 Estonia
49.5 40 🇪🇺 European Union
48.5 14 🇫🇮 Finland
46.5 37 🇫🇷 France
48.0 121 🇩🇪 Germany
49.8 168 🇬🇷 Greece
40.7 43 🇭🇺 Hungary
41.9 32 🇮🇸 Iceland
46.1 29 🇮🇪 Ireland
48.6 36 🇮🇹 Italy
44.7 83 🇱🇻 Latvia
46.5 37 🇱🇮 Liechtenstein
42.7 9 🇱🇹 Lithuania
44.3 41 🇱🇺 Luxembourg
46.6 38 🇲🇹 Malta
48.2 26 🇳🇱 Netherlands
57.2 50 🇳🇴 Norway
55.8 33 🇵🇱 Poland
46.8 65 🇵🇹 Portugal
48.8 31 🇷🇴 Romania
41.1 31 🇸🇰 Slovakia
44.0 32 🇸🇮 Slovenia
43.5 20 🇪🇸 Spain
43.8 93 🇸🇪 Sweden
54.0 53 🇨🇭 Switzerland
46.4 58 🇬🇧 United Kingdom
51.7 140

Hosting & Data Residency

38%

EU-headquartered provider

62%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 198 33.6%
Amazon Web Services (US) 93 15.8%
Microsoft Azure (US) 92 15.6%
Hetzner (DE) 51 8.7%
OVHcloud (FR) 39 6.6%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.