Skip to main content
All Industries

EU Industry Benchmark

Regulatory

Anonymized security posture data for the regulatory sector across the EU. Based on 348 monitored sites.

49.3

Avg. Score /100

D

Avg. Grade

348

Sites Tracked

+10.0

vs. EU Average

Critical findings in this industry

158 of 348 without HTTPS redirect

45.0%

339 of 348 with unencrypted email (no STARTTLS)

97.0%

348 of 348 without DMARC protection (spoofable)

100.0%

109 of 348 missing 3+ critical security headers

31.0%

249 of 348 without DNSSEC (vulnerable to DNS spoofing)

72.0%

295 of 348 without CAA records (unrestricted certificate issuance)

85.0%

331 of 348 without MTA-STS (email downgrade attacks possible)

95.0%

Grade Distribution

A
0 (0.0%)
B
6 (2.0%)
C
74 (21.0%)
D
192 (55.0%)
F
76 (22.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 41.9/100 (10 sites) Belgium: 49.9/100 (10 sites) Bulgaria: 48.3/100 (9 sites) Croatia: 38.0/100 (8 sites) Cyprus: 42.5/100 (4 sites) Czech Republic: 56.1/100 (10 sites) Denmark: 56.1/100 (11 sites) Estonia: 41.0/100 (8 sites) Finland: 48.2/100 (10 sites) France: 55.8/100 (17 sites) Germany: 52.0/100 (34 sites) Greece: 39.4/100 (9 sites) Hungary: 41.7/100 (10 sites) Ireland: 51.7/100 (9 sites) Italy: 54.7/100 (9 sites) Latvia: 48.4/100 (9 sites) Lithuania: 44.8/100 (9 sites) Luxembourg: 49.6/100 (5 sites) Netherlands: 63.3/100 (9 sites) Norway: 48.6/100 (11 sites) Poland: 51.5/100 (8 sites) Portugal: 41.4/100 (7 sites) Romania: 42.1/100 (12 sites) Slovakia: 44.8/100 (8 sites) Slovenia: 43.9/100 (9 sites) Spain: 47.6/100 (9 sites) Sweden: 47.4/100 (9 sites) Switzerland: 50.4/100 (9 sites) United Kingdom: 50.8/100 (13 sites)
Worse
Better

Score by Country

🇦🇹 Austria
41.9 10 🇧🇪 Belgium
49.9 10 🇧🇬 Bulgaria
48.3 9 🇭🇷 Croatia
38.0 8 🇨🇾 Cyprus
42.5 4 🇨🇿 Czech Republic
56.1 10 🇩🇰 Denmark
56.1 11 🇪🇪 Estonia
41.0 8 🇪🇺 European Union
53.2 20 🇫🇮 Finland
48.2 10 🇫🇷 France
55.8 17 🇩🇪 Germany
52.0 34 🇬🇷 Greece
39.4 9 🇭🇺 Hungary
41.7 10 🇮🇸 Iceland
55.3 10 🇮🇪 Ireland
51.7 9 🇮🇹 Italy
54.7 9 🇱🇻 Latvia
48.4 9 🇱🇮 Liechtenstein
45.9 7 🇱🇹 Lithuania
44.8 9 🇱🇺 Luxembourg
49.6 5 🇲🇹 Malta
52.7 16 🇳🇱 Netherlands
63.3 9 🇳🇴 Norway
48.6 11 🇵🇱 Poland
51.5 8 🇵🇹 Portugal
41.4 7 🇷🇴 Romania
42.1 12 🇸🇰 Slovakia
44.8 8 🇸🇮 Slovenia
43.9 9 🇪🇸 Spain
47.6 9 🇸🇪 Sweden
47.4 9 🇨🇭 Switzerland
50.4 9 🇬🇧 United Kingdom
50.8 13

Hosting & Data Residency

29%

EU-headquartered provider

71%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 49 35.5%
Amazon Web Services (US) 25 18.1%
Microsoft Azure (US) 17 12.3%
Hetzner (DE) 12 8.7%
OVHcloud (FR) 9 6.5%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.