Skip to main content
All Industries

EU Industry Benchmark

Government

Anonymized security posture data for the government sector across the EU. Based on 1623 monitored sites.

51.5

Avg. Score /100

D

Avg. Grade

1623

Sites Tracked

+12.0

vs. EU Average

Critical findings in this industry

508 of 1623 without HTTPS redirect

31.0%

1595 of 1623 with unencrypted email (no STARTTLS)

98.0%

1614 of 1623 without DMARC protection (spoofable)

99.0%

638 of 1623 missing 3+ critical security headers

39.0%

1185 of 1623 without DNSSEC (vulnerable to DNS spoofing)

73.0%

1372 of 1623 without CAA records (unrestricted certificate issuance)

85.0%

1517 of 1623 without MTA-STS (email downgrade attacks possible)

93.0%

Grade Distribution

A
0 (0.0%)
B
39 (2.0%)
C
423 (26.0%)
D
893 (55.0%)
F
268 (17.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 52.3/100 (50 sites) Belgium: 52.4/100 (34 sites) Bulgaria: 50.9/100 (35 sites) Croatia: 41.2/100 (35 sites) Cyprus: 42.4/100 (17 sites) Czech Republic: 49.3/100 (53 sites) Denmark: 59.4/100 (39 sites) Estonia: 49.5/100 (40 sites) Finland: 53.6/100 (37 sites) France: 52.7/100 (121 sites) Germany: 54.4/100 (168 sites) Greece: 43.8/100 (43 sites) Hungary: 47.2/100 (32 sites) Ireland: 49.2/100 (36 sites) Italy: 48.9/100 (83 sites) Latvia: 45.7/100 (37 sites) Lithuania: 44.2/100 (41 sites) Luxembourg: 51.4/100 (38 sites) Netherlands: 68.7/100 (50 sites) Norway: 59.6/100 (33 sites) Poland: 50.0/100 (65 sites) Portugal: 46.2/100 (31 sites) Romania: 45.7/100 (31 sites) Slovakia: 46.0/100 (32 sites) Slovenia: 45.5/100 (20 sites) Spain: 45.9/100 (93 sites) Sweden: 62.1/100 (53 sites) Switzerland: 53.7/100 (58 sites) United Kingdom: 54.6/100 (140 sites)
Worse
Better

Score by Country

🇦🇹 Austria
52.3 50 🇧🇪 Belgium
52.4 34 🇧🇬 Bulgaria
50.9 35 🇭🇷 Croatia
41.2 35 🇨🇾 Cyprus
42.4 17 🇨🇿 Czech Republic
49.3 53 🇩🇰 Denmark
59.4 39 🇪🇪 Estonia
49.5 40 🇪🇺 European Union
49.6 14 🇫🇮 Finland
53.6 37 🇫🇷 France
52.7 121 🇩🇪 Germany
54.4 168 🇬🇷 Greece
43.8 43 🇭🇺 Hungary
47.2 32 🇮🇸 Iceland
52.4 29 🇮🇪 Ireland
49.2 36 🇮🇹 Italy
48.9 83 🇱🇻 Latvia
45.7 37 🇱🇮 Liechtenstein
43.8 9 🇱🇹 Lithuania
44.2 41 🇱🇺 Luxembourg
51.4 38 🇲🇹 Malta
55.1 26 🇳🇱 Netherlands
68.7 50 🇳🇴 Norway
59.6 33 🇵🇱 Poland
50.0 65 🇵🇹 Portugal
46.2 31 🇷🇴 Romania
45.7 31 🇸🇰 Slovakia
46.0 32 🇸🇮 Slovenia
45.5 20 🇪🇸 Spain
45.9 93 🇸🇪 Sweden
62.1 53 🇨🇭 Switzerland
53.7 58 🇬🇧 United Kingdom
54.6 140

Hosting & Data Residency

38%

EU-headquartered provider

62%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 198 33.6%
Amazon Web Services (US) 93 15.8%
Microsoft Azure (US) 92 15.6%
Hetzner (DE) 51 8.7%
OVHcloud (FR) 39 6.6%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.