Skip to main content
All Industries

EU Industry Benchmark

Government

Anonymized security posture data for the government sector across the EU. Based on 1625 monitored sites.

50.8

Avg. Score /100

D

Avg. Grade

1625

Sites Tracked

+7.0

vs. EU Average

Critical findings in this industry

1439 of 1625 without HTTPS redirect

89.0%

903 of 1625 with unencrypted email (no STARTTLS)

56.0%

887 of 1625 without DMARC protection (spoofable)

55.0%

148 of 1625 missing 3+ critical security headers

9.0%

1181 of 1625 without DNSSEC (vulnerable to DNS spoofing)

73.0%

1371 of 1625 without CAA records (unrestricted certificate issuance)

84.0%

1517 of 1625 without MTA-STS (email downgrade attacks possible)

93.0%

Grade Distribution

A
1 (0.0%)
B
32 (2.0%)
C
255 (16.0%)
D
1131 (70.0%)
F
206 (13.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 51.7/100 (50 sites) Belgium: 52.7/100 (34 sites) Bulgaria: 49.1/100 (35 sites) Croatia: 44.5/100 (35 sites) Cyprus: 41.6/100 (17 sites) Czech Republic: 48.2/100 (53 sites) Denmark: 57.3/100 (39 sites) Estonia: 50.8/100 (40 sites) Finland: 51.8/100 (37 sites) France: 51.7/100 (120 sites) Germany: 51.3/100 (169 sites) Greece: 44.5/100 (43 sites) Hungary: 47.3/100 (32 sites) Ireland: 47.2/100 (36 sites) Italy: 48.7/100 (83 sites) Latvia: 47.9/100 (37 sites) Lithuania: 44.0/100 (41 sites) Luxembourg: 49.3/100 (38 sites) Netherlands: 63.5/100 (50 sites) Norway: 59.1/100 (33 sites) Poland: 52.0/100 (65 sites) Portugal: 48.4/100 (31 sites) Romania: 46.8/100 (31 sites) Slovakia: 48.0/100 (32 sites) Slovenia: 43.9/100 (20 sites) Spain: 47.7/100 (93 sites) Sweden: 60.1/100 (53 sites) Switzerland: 48.6/100 (58 sites) United Kingdom: 56.2/100 (140 sites)
Worse
Better

Score by Country

🇦🇹 Austria
51.7 50 🇧🇪 Belgium
52.7 34 🇧🇬 Bulgaria
49.1 35 🇭🇷 Croatia
44.5 35 🇨🇾 Cyprus
41.6 17 🇨🇿 Czech Republic
48.2 53 🇩🇰 Denmark
57.3 39 🇪🇪 Estonia
50.8 40 🇪🇺 European Union
51.0 14 🇫🇮 Finland
51.8 37 🇫🇷 France
51.7 120 🇩🇪 Germany
51.3 169 🇬🇷 Greece
44.5 43 🇭🇺 Hungary
47.3 32 🇮🇸 Iceland
48.1 31 🇮🇪 Ireland
47.2 36 🇮🇹 Italy
48.7 83 🇱🇻 Latvia
47.9 37 🇱🇮 Liechtenstein
51.8 9 🇱🇹 Lithuania
44.0 41 🇱🇺 Luxembourg
49.3 38 🇲🇹 Malta
42.2 26 🇳🇱 Netherlands
63.5 50 🇳🇴 Norway
59.1 33 🇵🇱 Poland
52.0 65 🇵🇹 Portugal
48.4 31 🇷🇴 Romania
46.8 31 🇸🇰 Slovakia
48.0 32 🇸🇮 Slovenia
43.9 20 🇪🇸 Spain
47.7 93 🇸🇪 Sweden
60.1 53 🇨🇭 Switzerland
48.6 58 🇬🇧 United Kingdom
56.2 140

Hosting & Data Residency

38%

EU-headquartered provider

62%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 198 33.5%
Amazon Web Services (US) 94 15.9%
Microsoft Azure (US) 92 15.6%
Hetzner (DE) 51 8.6%
OVHcloud (FR) 39 6.6%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.