Skip to main content
All Industries

EU Industry Benchmark

NGO & Nonprofit

Anonymized security posture data for the ngo & nonprofit sector across the EU. Based on 11997 monitored sites.

46.1

Avg. Score /100

D

Avg. Grade

11997

Sites Tracked

+1.0

vs. EU Average

Critical findings in this industry

6607 of 11997 without HTTPS redirect

55.0%

9452 of 11997 with unencrypted email (no STARTTLS)

79.0%

10597 of 11997 without DMARC protection (spoofable)

88.0%

5197 of 11997 missing 3+ critical security headers

43.0%

10440 of 11997 without DNSSEC (vulnerable to DNS spoofing)

87.0%

11575 of 11997 without CAA records (unrestricted certificate issuance)

96.0%

11852 of 11997 without MTA-STS (email downgrade attacks possible)

99.0%

Grade Distribution

A
1 (0.0%)
B
77 (1.0%)
C
1030 (9.0%)
D
7705 (64.0%)
F
3184 (27.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 45.9/100 (270 sites) Belgium: 46.2/100 (196 sites) Bulgaria: 43.5/100 (37 sites) Croatia: 43.4/100 (78 sites) Cyprus: 46.2/100 (15 sites) Czech Republic: 45.9/100 (96 sites) Denmark: 47.5/100 (162 sites) Estonia: 50.5/100 (13 sites) Finland: 45.5/100 (270 sites) France: 43.8/100 (2169 sites) Germany: 50.6/100 (3736 sites) Greece: 44.8/100 (73 sites) Hungary: 42.4/100 (79 sites) Ireland: 45.5/100 (159 sites) Italy: 41.7/100 (1162 sites) Latvia: 47.0/100 (14 sites) Lithuania: 44.9/100 (30 sites) Luxembourg: 47.1/100 (27 sites) Netherlands: 47.2/100 (385 sites) Norway: 47.5/100 (63 sites) Poland: 39.6/100 (521 sites) Portugal: 42.9/100 (143 sites) Romania: 43.0/100 (66 sites) Slovakia: 45.0/100 (67 sites) Slovenia: 41.6/100 (74 sites) Spain: 40.3/100 (862 sites) Sweden: 45.8/100 (120 sites) Switzerland: 47.9/100 (366 sites) United Kingdom: 48.3/100 (724 sites)
Worse
Better

Score by Country

🇦🇹 Austria
45.9 270 🇧🇪 Belgium
46.2 196 🇧🇬 Bulgaria
43.5 37 🇭🇷 Croatia
43.4 78 🇨🇾 Cyprus
46.2 15 🇨🇿 Czech Republic
45.9 96 🇩🇰 Denmark
47.5 162 🇪🇪 Estonia
50.5 13 🇫🇮 Finland
45.5 270 🇫🇷 France
43.8 2169 🇩🇪 Germany
50.6 3736 🇬🇷 Greece
44.8 73 🇭🇺 Hungary
42.4 79 🇮🇸 Iceland
54.7 6 🇮🇪 Ireland
45.5 159 🇮🇹 Italy
41.7 1162 🇱🇻 Latvia
47.0 14 🇱🇮 Liechtenstein
48.4 5 🇱🇹 Lithuania
44.9 30 🇱🇺 Luxembourg
47.1 27 🇲🇹 Malta
44.8 9 🇳🇱 Netherlands
47.2 385 🇳🇴 Norway
47.5 63 🇵🇱 Poland
39.6 521 🇵🇹 Portugal
42.9 143 🇷🇴 Romania
43.0 66 🇸🇰 Slovakia
45.0 67 🇸🇮 Slovenia
41.6 74 🇪🇸 Spain
40.3 862 🇸🇪 Sweden
45.8 120 🇨🇭 Switzerland
47.9 366 🇬🇧 United Kingdom
48.3 724

Hosting & Data Residency

65%

EU-headquartered provider

35%

Non-EU provider (CLOUD Act / Schrems II)

OVHcloud (FR) 1097 18.8%
Cloudflare (US) 1058 18.2%
Hetzner (DE) 933 16.0%
IONOS (1&1) (DE) 745 12.8%
Aruba S.p.A. (IT) 480 8.2%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.