Skip to main content
All Industries

EU Industry Benchmark

NGO & Nonprofit

Anonymized security posture data for the ngo & nonprofit sector across the EU. Based on 11915 monitored sites.

39.6

Avg. Score /100

F

Avg. Grade

11915

Sites Tracked

-0.0

vs. EU Average

Critical findings in this industry

8894 of 11915 without HTTPS redirect

75.0%

11687 of 11915 with unencrypted email (no STARTTLS)

98.0%

11892 of 11915 without DMARC protection (spoofable)

100.0%

3306 of 11915 missing 3+ critical security headers

28.0%

10367 of 11915 without DNSSEC (vulnerable to DNS spoofing)

87.0%

11508 of 11915 without CAA records (unrestricted certificate issuance)

97.0%

11770 of 11915 without MTA-STS (email downgrade attacks possible)

99.0%

Grade Distribution

A
0 (0.0%)
B
2 (0.0%)
C
266 (2.0%)
D
5369 (45.0%)
F
6278 (53.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 40.7/100 (270 sites) Belgium: 41.3/100 (194 sites) Bulgaria: 37.5/100 (34 sites) Croatia: 39.6/100 (78 sites) Cyprus: 35.4/100 (15 sites) Czech Republic: 41.7/100 (96 sites) Denmark: 43.5/100 (162 sites) Estonia: 39.2/100 (13 sites) Finland: 40.7/100 (269 sites) France: 37.2/100 (2154 sites) Germany: 40.4/100 (3724 sites) Greece: 40.0/100 (73 sites) Hungary: 37.3/100 (79 sites) Ireland: 41.8/100 (158 sites) Italy: 38.4/100 (1159 sites) Latvia: 38.1/100 (14 sites) Lithuania: 40.0/100 (29 sites) Luxembourg: 39.9/100 (27 sites) Netherlands: 44.1/100 (385 sites) Norway: 42.9/100 (63 sites) Poland: 38.8/100 (521 sites) Portugal: 39.7/100 (143 sites) Romania: 39.0/100 (66 sites) Slovakia: 40.5/100 (67 sites) Slovenia: 38.8/100 (75 sites) Spain: 38.8/100 (821 sites) Sweden: 42.3/100 (118 sites) Switzerland: 42.4/100 (367 sites) United Kingdom: 39.9/100 (721 sites)
Worse
Better

Score by Country

🇦🇹 Austria
40.7 270 🇧🇪 Belgium
41.3 194 🇧🇬 Bulgaria
37.5 34 🇭🇷 Croatia
39.6 78 🇨🇾 Cyprus
35.4 15 🇨🇿 Czech Republic
41.7 96 🇩🇰 Denmark
43.5 162 🇪🇪 Estonia
39.2 13 🇫🇮 Finland
40.7 269 🇫🇷 France
37.2 2154 🇩🇪 Germany
40.4 3724 🇬🇷 Greece
40.0 73 🇭🇺 Hungary
37.3 79 🇮🇸 Iceland
38.0 6 🇮🇪 Ireland
41.8 158 🇮🇹 Italy
38.4 1159 🇱🇻 Latvia
38.1 14 🇱🇮 Liechtenstein
39.8 5 🇱🇹 Lithuania
40.0 29 🇱🇺 Luxembourg
39.9 27 🇲🇹 Malta
41.3 9 🇳🇱 Netherlands
44.1 385 🇳🇴 Norway
42.9 63 🇵🇱 Poland
38.8 521 🇵🇹 Portugal
39.7 143 🇷🇴 Romania
39.0 66 🇸🇰 Slovakia
40.5 67 🇸🇮 Slovenia
38.8 75 🇪🇸 Spain
38.8 821 🇸🇪 Sweden
42.3 118 🇨🇭 Switzerland
42.4 367 🇬🇧 United Kingdom
39.9 721

Hosting & Data Residency

65%

EU-headquartered provider

35%

Non-EU provider (CLOUD Act / Schrems II)

OVHcloud (FR) 1092 18.9%
Cloudflare (US) 1034 17.9%
Hetzner (DE) 932 16.1%
IONOS (1&1) (DE) 743 12.8%
Aruba S.p.A. (IT) 480 8.3%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.