Skip to main content
All Industries

EU Industry Benchmark

Regulatory

Anonymized security posture data for the regulatory sector across the EU. Based on 349 monitored sites.

47.5

Avg. Score /100

D

Avg. Grade

349

Sites Tracked

+4.0

vs. EU Average

Critical findings in this industry

317 of 349 without HTTPS redirect

91.0%

225 of 349 with unencrypted email (no STARTTLS)

64.0%

234 of 349 without DMARC protection (spoofable)

67.0%

27 of 349 missing 3+ critical security headers

8.0%

249 of 349 without DNSSEC (vulnerable to DNS spoofing)

71.0%

296 of 349 without CAA records (unrestricted certificate issuance)

85.0%

333 of 349 without MTA-STS (email downgrade attacks possible)

95.0%

Grade Distribution

A
0 (0.0%)
B
4 (1.0%)
C
43 (12.0%)
D
218 (62.0%)
F
84 (24.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 44.9/100 (10 sites) Belgium: 46.7/100 (10 sites) Bulgaria: 47.0/100 (9 sites) Croatia: 43.8/100 (8 sites) Cyprus: 39.5/100 (4 sites) Czech Republic: 57.5/100 (10 sites) Denmark: 55.8/100 (12 sites) Estonia: 47.0/100 (8 sites) Finland: 44.4/100 (10 sites) France: 50.7/100 (17 sites) Germany: 50.9/100 (34 sites) Greece: 40.7/100 (9 sites) Hungary: 40.3/100 (10 sites) Ireland: 52.7/100 (9 sites) Italy: 50.1/100 (9 sites) Latvia: 45.1/100 (9 sites) Lithuania: 35.4/100 (9 sites) Luxembourg: 51.8/100 (5 sites) Netherlands: 53.3/100 (9 sites) Norway: 48.1/100 (11 sites) Poland: 48.6/100 (8 sites) Portugal: 34.6/100 (7 sites) Romania: 40.6/100 (12 sites) Slovakia: 39.5/100 (8 sites) Slovenia: 41.1/100 (9 sites) Spain: 48.8/100 (9 sites) Sweden: 54.9/100 (9 sites) Switzerland: 46.8/100 (9 sites) United Kingdom: 53.2/100 (13 sites)
Worse
Better

Score by Country

🇦🇹 Austria
44.9 10 🇧🇪 Belgium
46.7 10 🇧🇬 Bulgaria
47.0 9 🇭🇷 Croatia
43.8 8 🇨🇾 Cyprus
39.5 4 🇨🇿 Czech Republic
57.5 10 🇩🇰 Denmark
55.8 12 🇪🇪 Estonia
47.0 8 🇪🇺 European Union
51.8 20 🇫🇮 Finland
44.4 10 🇫🇷 France
50.7 17 🇩🇪 Germany
50.9 34 🇬🇷 Greece
40.7 9 🇭🇺 Hungary
40.3 10 🇮🇸 Iceland
45.0 10 🇮🇪 Ireland
52.7 9 🇮🇹 Italy
50.1 9 🇱🇻 Latvia
45.1 9 🇱🇮 Liechtenstein
46.0 7 🇱🇹 Lithuania
35.4 9 🇱🇺 Luxembourg
51.8 5 🇲🇹 Malta
45.1 16 🇳🇱 Netherlands
53.3 9 🇳🇴 Norway
48.1 11 🇵🇱 Poland
48.6 8 🇵🇹 Portugal
34.6 7 🇷🇴 Romania
40.6 12 🇸🇰 Slovakia
39.5 8 🇸🇮 Slovenia
41.1 9 🇪🇸 Spain
48.8 9 🇸🇪 Sweden
54.9 9 🇨🇭 Switzerland
46.8 9 🇬🇧 United Kingdom
53.2 13

Hosting & Data Residency

29%

EU-headquartered provider

71%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 49 35.5%
Amazon Web Services (US) 25 18.1%
Microsoft Azure (US) 17 12.3%
Hetzner (DE) 12 8.7%
OVHcloud (FR) 9 6.5%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.