Skip to main content
All Industries

EU Industry Benchmark

Regulatory

Anonymized security posture data for the regulatory sector across the EU. Based on 347 monitored sites.

45.5

Avg. Score /100

D

Avg. Grade

347

Sites Tracked

+5.0

vs. EU Average

Critical findings in this industry

281 of 347 without HTTPS redirect

81.0%

344 of 347 with unencrypted email (no STARTTLS)

99.0%

347 of 347 without DMARC protection (spoofable)

100.0%

84 of 347 missing 3+ critical security headers

24.0%

249 of 347 without DNSSEC (vulnerable to DNS spoofing)

72.0%

297 of 347 without CAA records (unrestricted certificate issuance)

86.0%

330 of 347 without MTA-STS (email downgrade attacks possible)

95.0%

Grade Distribution

A
0 (0.0%)
B
2 (1.0%)
C
41 (12.0%)
D
205 (59.0%)
F
99 (29.0%)

Security across Europe

Average security score by country — hover for details, click to explore.

Austria: 43.3/100 (10 sites) Belgium: 47.5/100 (10 sites) Bulgaria: 46.3/100 (9 sites) Croatia: 40.1/100 (8 sites) Cyprus: 30.5/100 (4 sites) Czech Republic: 55.4/100 (10 sites) Denmark: 53.5/100 (11 sites) Estonia: 49.1/100 (8 sites) Finland: 48.4/100 (10 sites) France: 49.2/100 (17 sites) Germany: 45.3/100 (34 sites) Greece: 36.2/100 (9 sites) Hungary: 42.7/100 (10 sites) Ireland: 46.0/100 (9 sites) Italy: 47.2/100 (9 sites) Latvia: 42.7/100 (9 sites) Lithuania: 46.2/100 (9 sites) Luxembourg: 46.8/100 (4 sites) Netherlands: 53.3/100 (9 sites) Norway: 45.0/100 (11 sites) Poland: 43.4/100 (8 sites) Portugal: 38.9/100 (7 sites) Romania: 39.7/100 (12 sites) Slovakia: 40.2/100 (8 sites) Slovenia: 42.1/100 (9 sites) Spain: 40.4/100 (9 sites) Sweden: 47.6/100 (9 sites) Switzerland: 42.6/100 (9 sites) United Kingdom: 49.0/100 (13 sites)
Worse
Better

Score by Country

🇦🇹 Austria
43.3 10 🇧🇪 Belgium
47.5 10 🇧🇬 Bulgaria
46.3 9 🇭🇷 Croatia
40.1 8 🇨🇾 Cyprus
30.5 4 🇨🇿 Czech Republic
55.4 10 🇩🇰 Denmark
53.5 11 🇪🇪 Estonia
49.1 8 🇪🇺 European Union
47.6 20 🇫🇮 Finland
48.4 10 🇫🇷 France
49.2 17 🇩🇪 Germany
45.3 34 🇬🇷 Greece
36.2 9 🇭🇺 Hungary
42.7 10 🇮🇸 Iceland
42.5 10 🇮🇪 Ireland
46.0 9 🇮🇹 Italy
47.2 9 🇱🇻 Latvia
42.7 9 🇱🇮 Liechtenstein
44.7 7 🇱🇹 Lithuania
46.2 9 🇱🇺 Luxembourg
46.8 4 🇲🇹 Malta
48.9 16 🇳🇱 Netherlands
53.3 9 🇳🇴 Norway
45.0 11 🇵🇱 Poland
43.4 8 🇵🇹 Portugal
38.9 7 🇷🇴 Romania
39.7 12 🇸🇰 Slovakia
40.2 8 🇸🇮 Slovenia
42.1 9 🇪🇸 Spain
40.4 9 🇸🇪 Sweden
47.6 9 🇨🇭 Switzerland
42.6 9 🇬🇧 United Kingdom
49.0 13

Hosting & Data Residency

28%

EU-headquartered provider

72%

Non-EU provider (CLOUD Act / Schrems II)

Cloudflare (US) 49 35.8%
Amazon Web Services (US) 25 18.2%
Microsoft Azure (US) 17 12.4%
Hetzner (DE) 11 8.0%
OVHcloud (FR) 9 6.6%

Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49

How does your site compare?

Run a free security scan and see your grade instantly.

Scan your site

All data is anonymized. No individual sites are identified. Statistics updated weekly.