Updated 9 August 2026
The UK SMB Security Benchmark
Aggregated insights from 613 anonymous Mode 1 scans across 16 UK sectors. All figures are cohort-derived; no individual sites are identified.
Headline findings
- 100%100% of UK financial sites scanned have "UK GDPR: 4 UK GDPR gaps detected — Article 32 requires "appropriate technical measures""
- 100%100% of UK legal sites scanned have "Does not meet bulk-sender email requirements"
- 100%100% of UK public-sector sites scanned have "Email authentication grade: F (0/100)"
- 97%97% of UK financial sites scanned have "EU NIS2: Sector suggests NIS2 may apply — 3 baseline cybersecurity gaps"
- 91%91% of UK general sites scanned have "Content Security Policy missing"
- 87%87% of UK general sites scanned have "Missing HSTS header"
- 80%80% of UK education sites scanned have "No DKIM records found"
- 66%66% of UK financial sites scanned have "EU DORA: Financial services entity — 3 DORA baseline gaps"
Sector cohorts
Median score, cohort size, and top three issues per UK sector. Click a sector to deep-dive.
General / uncategorised
n=160
61/100
median score
p25 57 · p75 67
p25 57 · p75 67
- criticalHomepage unreachable48%
- criticalNo TLS certificate21%
- criticalNo modern TLS protocol supported21%
E-commerce
n=91
72/100
median score
p25 65 · p75 77
p25 65 · p75 77
- criticalHomepage unreachable4%
- criticalNo TLS certificate2%
- criticalnext@unknown — CVE-2025-29927 (CVSS 9.1)2%
Financial services
n=68
75/100
median score
p25 71 · p75 79
p25 71 · p75 79
- criticalnext@unknown — CVE-2025-29927 (CVSS 9.1)1%
- criticalNo modern TLS protocol supported1%
- criticalCVE-2024-45440: 87.5% exploitation probability1%
Healthcare
n=60
74/100
median score
p25 70 · p75 78
p25 70 · p75 78
- criticalnext@unknown — CVE-2025-29927 (CVSS 9.1)8%
- criticalHomepage unreachable5%
- criticalCVE-2024-45440: 87.5% exploitation probability3%
Media & Publishing
n=54
73/100
median score
p25 68 · p75 75
p25 68 · p75 75
- criticalPossible Generic API Key in rendered page19%
- criticalHomepage unreachable4%
- criticalnext@unknown — CVE-2025-29927 (CVSS 9.1)4%
Legal
n=51
73/100
median score
p25 68 · p75 77
p25 68 · p75 77
- criticalnext@unknown — CVE-2025-29927 (CVSS 9.1)8%
- criticalPublic bucket listing: azure-blob — feaasstatic/assets6%
- criticalLogin form uses GET method (credentials in URL)4%
SaaS / Technology
n=42
77/100
median score
p25 71 · p75 78
p25 71 · p75 78
- criticalnext@unknown — CVE-2025-29927 (CVSS 9.1)10%
- criticalOpenAI API key exposed in page source7%
- criticalPossible Generic API Key in rendered page2%
Manufacturing
n=30
71/100
median score
p25 66 · p75 77
p25 66 · p75 77
- criticalNo modern TLS protocol supported7%
- critical.git/config exposed (full source code recoverable)3%
- criticalHomepage unreachable3%
charity-non-profit
n=16
74/100
median score
p25 68 · p75 76
p25 68 · p75 76
- criticalNo TLS certificate6%
- criticalHomepage unreachable6%
- criticalCVE-2024-45440: 87.5% exploitation probability6%
public-sector
n=15
69/100
median score
p25 66 · p75 70
p25 66 · p75 70
- criticalOpenAI API key exposed in page source20%
- highUK GDPR: 4 UK GDPR gaps detected — Article 32 requires "appropriate technical measures"100%
- highEmail authentication grade: F (0/100)100%
education
n=10
71/100
median score
p25 68 · p75 75
p25 68 · p75 75
- criticalPossible Generic API Key in rendered page20%
- criticalHomepage unreachable10%
- criticalCVE-2020-11023: 83.8% exploitation probability10%
retail
n=7
59/100
median score
p25 59 · p75 63
p25 59 · p75 63
- criticalHomepage unreachable57%
- highEmail authentication grade: F (24/100)100%
- highContent Security Policy missing100%
hospitality
n=3
68/100
median score
p25 67 · p75 68
p25 67 · p75 68
- highEmail authentication grade: F (0/100)100%
- highUK GDPR: 4 UK GDPR gaps detected — Article 32 requires "appropriate technical measures"100%
- highMissing HSTS header100%
technology
n=3
64/100
median score
p25 54 · p75 64
p25 54 · p75 64
- criticalNo modern TLS protocol supported67%
- criticalHomepage unreachable33%
- highDoes not meet bulk-sender email requirements100%
media
n=2
59/100
median score
p25 59 · p75 59
p25 59 · p75 59
- criticalHomepage unreachable100%
- highMissing HSTS header100%
- highContent Security Policy missing100%
real-estate
n=1
75/100
median score
p25 75 · p75 75
p25 75 · p75 75
- highUK GDPR: 4 UK GDPR gaps detected — Article 32 requires "appropriate technical measures"100%
- highContent Security Policy missing100%
- highDoes not meet bulk-sender email requirements100%
Methodology
- Scope: SiteIntel Mode 1 (Public Passive) — 46 checks across DNS, TLS, headers, supply-chain, breach exposure, threat intel.
- Corpus: Public UK sites from FCA register, IMRG Top 500, ABPI member list, The Lawyer 200, Make UK members, Press Gazette top 50. Anonymised at ingest (domain hashed, no identifying metadata persisted).
- Score: Composite 0-100; weighted across security, performance, SEO, accessibility, tech-debt.
- Composite signals: Pairs of finding codes with ≥5% co-occurrence and ≥1.5× score-drop lift versus sector baseline.
- Cohort floor: Sectors with <5 scans are excluded from percentile reporting (too thin to be stable).
- Refresh: Cached 1 hour. PDF report regenerated on demand.