EU Industry Benchmark
Travel
Anonymized security posture data for the travel sector across the EU. Based on 227 monitored sites.
52.0
Avg. Score /100
D
Avg. Grade
227
Sites Tracked
-2.0
vs. EU Average
Critical findings in this industry
17 of 227 without HTTPS redirect
7 of 227 with unencrypted email (no STARTTLS)
24 of 227 without DMARC protection (spoofable)
144 of 227 missing 3+ critical security headers
41 of 227 without DNSSEC (vulnerable to DNS spoofing)
46 of 227 without CAA records (unrestricted certificate issuance)
49 of 227 without MTA-STS (email downgrade attacks possible)
Grade Distribution
Score by Country
Hosting & Data Residency
14%
EU-headquartered provider
86%
Non-EU provider (CLOUD Act / Schrems II)
Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49
All data is anonymized. No individual sites are identified. Statistics updated weekly.