Skip to main content
All Industries

EU Industry Benchmark

NGO & Nonprofit

Anonymized security posture data for the ngo & nonprofit sector across the EU. Based on 11896 monitored sites.

38.2

Avg. Score /100

F

Avg. Grade

11896

Sites Tracked

-1.0

vs. EU Average

Critical findings in this industry

11283 of 11896 without HTTPS redirect

95.0%

11693 of 11896 with unencrypted email (no STARTTLS)

98.0%

11878 of 11896 without DMARC protection (spoofable)

100.0%

2066 of 11896 missing 3+ critical security headers

17.0%

10354 of 11896 without DNSSEC (vulnerable to DNS spoofing)

87.0%

11493 of 11896 without CAA records (unrestricted certificate issuance)

97.0%

11752 of 11896 without MTA-STS (email downgrade attacks possible)

99.0%

Grade Distribution

A
0 (0.0%)
B
0 (0.0%)
C
86 (1.0%)
D
4793 (40.0%)
F
7017 (59.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 40.0/100 (270 sites) Belgium: 41.0/100 (194 sites) Bulgaria: 37.9/100 (34 sites) Croatia: 38.4/100 (78 sites) Cyprus: 34.9/100 (15 sites) Czech Republic: 40.4/100 (96 sites) Denmark: 40.8/100 (162 sites) Estonia: 39.2/100 (13 sites) Finland: 39.3/100 (268 sites) France: 36.1/100 (2154 sites) Germany: 38.2/100 (3712 sites) Greece: 39.1/100 (73 sites) Hungary: 36.2/100 (79 sites) Ireland: 40.4/100 (158 sites) Italy: 37.1/100 (1157 sites) Latvia: 37.6/100 (14 sites) Lithuania: 35.7/100 (29 sites) Luxembourg: 38.5/100 (27 sites) Netherlands: 42.1/100 (385 sites) Norway: 40.2/100 (63 sites) Poland: 37.6/100 (520 sites) Portugal: 39.5/100 (142 sites) Romania: 38.7/100 (66 sites) Slovakia: 38.3/100 (67 sites) Slovenia: 36.5/100 (75 sites) Spain: 37.8/100 (820 sites) Sweden: 39.7/100 (118 sites) Switzerland: 43.7/100 (367 sites) United Kingdom: 38.1/100 (720 sites)
Worse
Better

Score by Country

🇦🇹 Austria
40.0 270 🇧🇪 Belgium
41.0 194 🇧🇬 Bulgaria
37.9 34 🇭🇷 Croatia
38.4 78 🇨🇾 Cyprus
34.9 15 🇨🇿 Czech Republic
40.4 96 🇩🇰 Denmark
40.8 162 🇪🇪 Estonia
39.2 13 🇫🇮 Finland
39.3 268 🇫🇷 France
36.1 2154 🇩🇪 Germany
38.2 3712 🇬🇷 Greece
39.1 73 🇭🇺 Hungary
36.2 79 🇮🇸 Iceland
38.2 6 🇮🇪 Ireland
40.4 158 🇮🇹 Italy
37.1 1157 🇱🇻 Latvia
37.6 14 🇱🇮 Liechtenstein
36.0 5 🇱🇹 Lithuania
35.7 29 🇱🇺 Luxembourg
38.5 27 🇲🇹 Malta
40.0 9 🇳🇱 Netherlands
42.1 385 🇳🇴 Norway
40.2 63 🇵🇱 Poland
37.6 520 🇵🇹 Portugal
39.5 142 🇷🇴 Romania
38.7 66 🇸🇰 Slovakia
38.3 67 🇸🇮 Slovenia
36.5 75 🇪🇸 Spain
37.8 820 🇸🇪 Sweden
39.7 118 🇨🇭 Switzerland
43.7 367 🇬🇧 United Kingdom
38.1 720

Hosting & Data Residency

66%

EU-headquartered provider

34%

Non-EU provider (CLOUD Act / Schrems II)

OVHcloud (FR) 1091 19.0%
Cloudflare (US) 994 17.3%
Hetzner (DE) 932 16.2%
IONOS (1&1) (DE) 743 12.9%
Aruba S.p.A. (IT) 480 8.4%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.