Security Directory

R

Retarus GmbH

retarus.com

62

Retarus GmbH is a leading enterprise cloud services provider specializing in secure and efficient digital communication solutions including email, fax, SMS, and EDI. Positioned as a top player in the secure email market and certified under ISO 27001 and HITRUST, Retarus serves a global enterprise clientele with a comprehensive portfolio of cloud-based messaging platforms. Their services emphasize compliance, reliability, and integration with major business ecosystems such as SAP and Microsoft 365. Technically, the website is built on WordPress with modern frameworks and libraries, hosted on Amazon AWS infrastructure, and employs strong security practices including TLS 1.3, OCSP stapling, and SPF/DMARC email authentication. However, there is room for improvement in DNS security and HTTP security headers. The company demonstrates a mature security posture with certifications and a GDPR-compliant cookie consent mechanism, though incident response contact details are not publicly disclosed. Overall, Retarus presents a professional, trustworthy, and technically sound digital presence aligned with enterprise-grade security and compliance standards.

S

SoSafe

sosafe-awareness.com

70

SoSafe is a leading European provider specializing in security awareness training and human risk management solutions. The company offers a behavioral science-based platform that empowers organizations to enhance their cybersecurity posture by educating employees and managing human-related risks. Positioned as Europe's largest provider in this niche, SoSafe delivers personalized, gamified training, phishing simulations, an AI-powered chatbot, and a comprehensive human risk management platform. Their market presence is reinforced by multiple certifications including ISO 27001, TISAX, and GDPR compliance, alongside strong customer testimonials and industry recognitions. Technically, SoSafe's website is built on WordPress and integrates a robust set of analytics and marketing tools such as Google Analytics, Matomo, Cookiebot for consent management, HubSpot forms, and Visual Website Optimizer for A/B testing. The infrastructure is hosted on Amazon AWS with DNS managed via Route53. While the site supports modern TLS protocols and has valid SPF and DMARC records, it lacks DNSSEC, CAA records, and HSTS, which are recommended for enhanced security. The website performance is moderate to slow, with room for optimization. From a security perspective, SoSafe demonstrates good practices including strong SSL configuration, OCSP stapling, and comprehensive cookie consent mechanisms. However, there is no public vulnerability disclosure or security.txt file, and incident response contact details are not explicitly provided. The company maintains a strong security posture with certifications and compliance but could improve transparency and DNS security. Overall, SoSafe presents a mature digital presence with a focus on privacy and compliance, extensive integration with enterprise platforms, and a clear commitment to security awareness. Strategic improvements in DNS security and incident response transparency would further strengthen their security posture and trustworthiness.

F

Formalize ApS

formalize.com

79

Formalize ApS is a Denmark-based technology company specializing in compliance software solutions designed to streamline governance, risk, and compliance operations for organizations. Their platform supports compliance with major regulatory frameworks such as NIS2, DORA, ISO 27001, and GDPR, offering customizable dashboards, automation, and a Trust Center for sharing compliance documentation. The company is positioned as a trusted provider with over 8,000 customers and strong partnerships with leading law and accounting firms. Technically, Formalize leverages modern web technologies including Alpine.js, AWS hosting, and integrates marketing and analytics tools such as Hubspot, Google Tag Manager, and Cookiebot for consent management. However, the website currently suffers from an invalid SSL certificate and lacks modern TLS protocol support, which poses a significant security risk. Despite this, the company demonstrates strong security practices with SPF, DMARC, and HSTS configurations, alongside certifications like ISO 27001 and ISAE 3000. Overall, Formalize presents a mature compliance platform with excellent user experience and comprehensive content, but should urgently address SSL and TLS issues to maintain trust and security.

S

Storytel AB (publ).

storytelgroup.com

65

Storytel AB operates one of the world's largest audiobook and e-book streaming platforms, serving over 2.3 million subscribers with a vast catalog in multiple languages. The company combines digital streaming with print publishing, positioning itself as a leading media entity in Sweden and internationally. Their website reflects a mature digital presence with strong investor relations and corporate governance transparency. Technically, the site is built on WordPress with Bootstrap, hosted via Cloudflare, and integrates Cookiebot for GDPR-compliant cookie management and Google Tag Manager for marketing analytics. However, the absence of a valid SSL certificate and lack of modern TLS protocols represent significant security weaknesses. The site also exhibits slow load times, which could impact user experience and SEO. Security headers are minimal, with only SPF and DMARC configured, and no advanced protections like HSTS or CSP are present. Overall, while the business and content quality are excellent, the security posture requires urgent improvement to protect user data and maintain trust.

M

Mofibo

mofibo.com

62

Mofibo is a prominent Danish digital media platform specializing in subscription-based access to a vast library of over 600,000 audiobooks, e-books, and podcasts. As part of the Storytel group, it holds a strong market position in Denmark, offering tailored subscription plans including individual, family, and student options. The platform emphasizes user experience with features like offline downloads and exclusive content under the Mofibo Originals brand. Technically, Mofibo leverages modern web technologies such as Next.js, Cloudflare, and integrates multiple third-party services for analytics, marketing, and payment processing. The website demonstrates good digital maturity with a comprehensive cookie consent mechanism and GDPR compliance. Security-wise, Mofibo maintains a valid SSL certificate and implements SPF and DMARC policies, though improvements like enabling HSTS and DNSSEC are recommended. Overall, Mofibo presents a professional, trustworthy, and user-centric digital service with extensive tracking and marketing integrations.

H

HBL Solutions

hblsolutions.ch

61

HBL Solutions is a Swiss Banking-as-a-Service provider operating under the regulated banking license of Hypothekarbank Lenzburg AG. The company specializes in embedding banking products such as accounts, cards, payments, securities portfolios, and pension plans into the digital customer journeys of partner companies. Their market position is that of a Swiss pioneer in embedded and open finance, supported by a robust banking infrastructure and regulatory compliance. Technically, the website is built on Umbraco CMS with modern JavaScript libraries like Swiper.js and jQuery, and employs Cookiebot for GDPR-compliant cookie consent management. However, the absence of a valid SSL certificate is a critical security gap. The security posture shows strengths in regulatory compliance and consent management but weaknesses in transport security and DNS security features. Overall, the business is well-positioned in the Swiss finance sector with a clear focus on embedded finance, but should urgently address SSL and DNS security to improve trust and compliance.

F

Finstar AG

finstar.ch

69

Finstar AG is a Swiss-based company specializing in integrated IT solutions for private and universal banks as well as fintechs. With over 40 years of experience, the company offers customized and cost-effective banking software and services, positioning itself as a trusted partner in the financial technology sector. Their offerings include a broad range of products and services such as APIs, digital onboarding, and digital asset platforms, supported by a strong ecosystem of partner banks and financial institutions. The company is a subsidiary of Hypothekarbank Lenzburg AG and holds the prestigious 'swiss made software' label, underscoring its commitment to quality and reliability. Technically, the website is built on the Umbraco CMS and leverages modern JavaScript libraries including GSAP and ScrollMagic for enhanced user experience. It integrates Cookiebot for GDPR-compliant cookie consent management and Google Tag Manager for analytics and marketing. However, the website currently lacks a valid SSL certificate and does not support modern TLS protocols, which is a critical security gap. Performance is slow, likely due to the large page size and resource count, but mobile optimization and accessibility are rated good. From a security perspective, the domain has well-configured SPF and DMARC records with a strict reject policy, reducing email spoofing risks. Despite this, the absence of HTTPS and security headers significantly lowers the security posture. No explicit security policy, incident response contacts, or vulnerability disclosure mechanisms were found. The cookie consent mechanism is comprehensive and transparent, supporting GDPR compliance. Overall, Finstar AG presents a professional and trustworthy digital presence with strong business credentials and compliance in privacy and cookie management. The primary risk lies in the lack of HTTPS, which should be addressed urgently to protect user data and maintain trust. Strategic improvements in security infrastructure and transparency around security policies would enhance the company's risk profile and customer confidence.

H

Hypothekarbank Lenzburg AG

hblasset.ch

56

HBL Asset Management, a brand of Hypothekarbank Lenzburg AG, operates a professional asset management and investment product platform targeting private investors primarily in Switzerland. The website offers financial market news, investment insights, and profiling tools to support investor decision-making. Technically, the site is built on the Umbraco CMS and integrates several modern web technologies including Google Analytics, Cookiebot for GDPR-compliant cookie consent, and Google Tag Manager. However, the site lacks HTTPS encryption, which is a critical security deficiency. While cookie consent and privacy policies are well implemented, the absence of SSL/TLS and security headers exposes users to risks. The company maintains a strong digital presence with social media integration and clear contact information, but should urgently address security gaps to protect user data and enhance trust.

F

FoccoLOJAS

foccolojas.com.br

51

FoccoLOJAS is a specialized software-as-a-service platform focused on providing comprehensive management solutions for furniture retail stores in Brazil. The company offers a 100% web-based system that integrates all store processes from customer entry to product delivery, aiming to increase sales efficiency and profitability. Their key services include sales management, budgeting and negotiation tools, client portfolio management, mobile applications for remote management, and business intelligence analytics. The business is positioned as a trusted partner for over 2,000 furniture stores nationwide, supported by a strong brand presence and customer testimonials. Technically, the website is built on WordPress with the Elementor framework, utilizing a variety of modern web technologies and third-party integrations such as Cloudflare for DNS and CDN services, Cookiebot for cookie consent management, and multiple analytics and marketing tools including Google Analytics, Hotjar, and Microsoft Application Insights. Despite a rich technology stack, the website suffers from performance issues due to a large number of resources and lacks a valid SSL certificate, which impacts security and user trust. From a security perspective, the site has implemented SPF for email protection but lacks DMARC, DNSSEC, and CAA records, and does not have a valid SSL certificate or HSTS enabled. The extensive use of third-party tracking and marketing scripts indicates a high level of user data collection, though managed through Cookiebot's consent mechanism. No explicit security policy, incident response, or data protection officer information is found, indicating potential gaps in formal security governance. Overall, FoccoLOJAS presents a mature business with a specialized market focus and a comprehensive digital presence. However, its security posture requires significant improvements, particularly in SSL/TLS configuration and formal security policies, to enhance trust and compliance. Performance optimization and clearer contact information would also benefit user experience and credibility.

S

Ströer X GmbH

stroeer-x.de

50

Ströer X GmbH is a large German-based outsourcing partner specializing in dialog marketing, sales, and customer experience services. As part of the Ströer Group, it leverages the strength of a major corporation combined with the agility of a mid-sized service provider. The company offers a broad portfolio including customer service, digital transformation, social media management, and value-added services such as chat software and AI automation. Their market position is strong within media and related sectors, serving clients across multiple industries including e-commerce, energy, financial services, telecommunications, and tourism. Technically, the website is built on TYPO3 CMS and integrates modern marketing and analytics tools like Google Tag Manager, TikTok Pixel, and HubSpot forms, with GDPR-compliant cookie consent managed by Cookiebot. However, the site currently lacks a valid SSL certificate and modern TLS support, which is a critical security concern. Security policies such as SPF and DMARC are properly configured, but DNSSEC and other advanced DNS security measures are absent. Overall, the company demonstrates good digital maturity but needs to address fundamental security gaps to protect user data and maintain trust.

S

Ströer SE & Co. KGaA

stroeer.com

65

Ströer SE & Co. KGaA is a leading German media company specializing in Out-of-Home (OOH) advertising, digital advertising, dialog marketing, and e-commerce services. Listed on the MDAX, Ströer holds a strong market position in Germany with a comprehensive portfolio of advertising solutions supported by subsidiaries and partner companies. The company emphasizes sustainability and diversity, aiming for CO2 neutrality by 2025 and fostering an inclusive work environment. Technically, the website is built on TYPO3 CMS with modern frontend technologies like Alpine.js and uses Cloudflare for DNS and CDN services. Analytics are managed via Matomo, and cookie consent is handled by Cookiebot, ensuring GDPR compliance. Security posture is solid with valid SSL certificates, SPF and DMARC records, but lacks advanced DNS security features like DNSSEC and CAA records. The site does not currently publish a security policy or incident response plan publicly. Overall, the website demonstrates a professional, trustworthy, and well-maintained digital presence aligned with business goals and regulatory requirements.

S

Storytel

storytel.com

65

Storytel is a leading digital media company specializing in subscription-based audiobook and e-book streaming services, primarily serving the Nordic market with over 2.3 million users globally. Their platform offers a wide range of content including exclusive Storytel Originals, targeting diverse audiences such as regular listeners, families, and students. The company demonstrates strong brand consistency and a comprehensive digital presence with localized content and multiple subscription tiers. Technically, Storytel employs modern web technologies including React and Next.js, supported by robust third-party services for analytics, marketing, and customer support. While their SSL configuration is valid, there are opportunities to enhance security by enabling HSTS, DNSSEC, and improving CAA records. The site features extensive cookie management and complies with GDPR, reflecting a mature privacy posture. However, explicit security policies and incident response information are not publicly available, indicating an area for improvement. Overall, Storytel maintains a high level of professionalism and trustworthiness, with a strong focus on user experience and content quality.

M

Münchener Hypothekenbank eG

mhb.de

60

Münchener Hypothekenbank eG is a specialized financial institution focused on long-term real estate financing, serving private customers, commercial clients, and investors primarily in Germany. The bank emphasizes sustainability in its lending practices and maintains a strong market position with a history dating back to 1896. The website reflects a mature digital presence built on Drupal 10, integrating modern frontend technologies and a comprehensive cookie consent mechanism via Cookiebot. Analytics are handled through Matomo, balancing user tracking with privacy compliance. Security posture is solid with modern TLS protocols and no known vulnerabilities, though improvements such as DNSSEC, DMARC, and HSTS could enhance protection. Contact information is clearly presented, supporting customer engagement. Overall, the site demonstrates professionalism and trustworthiness aligned with its financial services business.

H

Hypothekarbank Lenzburg AG

hbl.ch

67

Hypothekarbank Lenzburg AG is a Swiss regional bank offering a hybrid model of digital and personal banking services targeting private and corporate customers. The website reflects a mature digital presence with comprehensive service offerings including e-banking, mortgages, savings, investments, and financial planning. The bank positions itself as a trusted regional financial institution with a focus on customer-centric solutions. Technically, the website is built on Umbraco CMS and leverages modern frontend libraries such as Swiper, GSAP, and Cookiebot for consent management. However, the current SSL/TLS configuration is invalid, which poses a significant security risk and undermines user trust. Security headers like SPF and DMARC are properly configured, but the absence of DNSSEC, CAA, and HSTS reduces the overall security posture. The site employs extensive tracking and advertising technologies including Google Analytics, TikTok, and Meta Platforms, with a robust cookie consent mechanism ensuring GDPR compliance. Overall, the bank demonstrates a strong market position with a professional and user-friendly website but must urgently address SSL/TLS issues to maintain security and trust.

S

Saulės spektras, UAB

saulesspektras.lt

54

Saulės spektras, UAB is a Lithuanian digital marketing company specializing in providing digital marketing solutions for small and medium-sized businesses. Their offerings include website creation, SEO, SEM, and social media marketing services, supported by a network of business information portals. The company positions itself as a trusted partner in the Lithuanian market with certifications such as Google Partner and Duda Expert badges, indicating a strong commitment to quality and professionalism. Their target audience primarily consists of small and medium enterprises seeking to enhance their online presence and marketing effectiveness. Technically, the website is built on the Duda CMS platform, leveraging modern web technologies including Google Analytics, Google Tag Manager, and Cookiebot for privacy compliance. While the site demonstrates good mobile optimization and SEO practices, performance is somewhat slow due to a large page size and numerous resources. Security-wise, the site employs strong TLS protocols and has a valid SPF record, but lacks advanced security headers, HSTS, OCSP stapling, and DMARC, which are recommended for enhanced protection. Privacy and cookie policies are comprehensive and GDPR compliant, with an effective consent mechanism in place. Overall, the company maintains a solid digital infrastructure with room for security enhancements and performance optimization to further strengthen trust and compliance.

Q

Qwist GmbH

qwist.com

63

Qwist GmbH is a leading open finance platform operating primarily in the DACH and Iberian markets, offering a comprehensive suite of B2B2X financial technology products. Their key offerings include digital account and portfolio switching, open banking compliance solutions, financial data analytics, and digital lending integration. The company positions itself as the #1 open finance company in its region, serving major banks and financial institutions with a strong investor backing from Finch Capital and Finleap. Technically, the website is built on WordPress with the Divi theme and leverages modern marketing and analytics tools such as HubSpot, Matomo, and SalesLoft. The site employs GDPR-compliant cookie consent via Cookiebot and maintains a valid SSL certificate, although some security enhancements like HSTS and DNSSEC are absent. Performance is moderate with good mobile optimization and SEO practices. From a security perspective, Qwist demonstrates solid foundational practices including SPF and DMARC email protections and encrypted communications. However, the absence of advanced DNS security measures and a public security or incident response policy suggests room for improvement. No critical vulnerabilities were detected in the current analysis. Overall, Qwist presents a professional and trustworthy digital presence aligned with its market leadership in open finance. Strategic security enhancements and transparency in incident response would further strengthen its risk posture and customer confidence.

P

PlentyONE GmbH

plentysystems.com

56

PlentyONE GmbH operates a cloud-native all-in-one e-commerce ERP platform that connects brands, manufacturers, and retailers with over 150 marketplaces globally. The company holds a strong market position with 55,000 users and significant transaction volumes, offering comprehensive services including multi-channel sales, order management, product data management, and strategic growth consulting. Technically, the website is built on HubSpot CMS, integrates multiple marketing and analytics tools such as Google Analytics, HubSpot, and Cookiebot, and is hosted on AWS infrastructure. However, the site currently lacks a valid SSL certificate and modern TLS support, which poses a critical security risk. The company demonstrates good privacy compliance with GDPR-aligned policies and cookie consent mechanisms. Strategic improvements in security posture, especially SSL/TLS implementation and security headers, are recommended to enhance trust and protect user data.

C

Criteo

criteo.com

69

Criteo is a leading global Commerce Media Platform provider headquartered in France, founded in 2005. The company offers a comprehensive suite of advertising and retail media solutions powered by extensive commerce data and AI technologies. Their platform connects brands, retailers, media owners, and agencies to deliver personalized and performance-driven advertising across multiple channels. Technically, the website is built on WordPress with modern frameworks and integrates various analytics and marketing tools such as Google Tag Manager, New Relic, Dreamdata, and OneTrust for privacy compliance. Security measures include a valid SSL certificate, HSTS enabled, and no detected vulnerabilities, although improvements in DNSSEC and CAA records are recommended. The company maintains a strong privacy and cookie policy presence with GDPR compliance and provides multiple contact points via forms. Overall, Criteo demonstrates a mature digital infrastructure, strong security posture, and a high level of professionalism and trustworthiness in its online presence.

C

Cludo ApS

cludo.com

66

Cludo ApS is a medium-sized technology company based in Denmark specializing in AI-powered site search solutions. Their platform enhances website search experiences by leveraging AI technologies such as AI Chat and AI Summary, targeting website owners and marketing teams globally. The company positions itself as a trusted partner with over 1000+ websites using their services, supported by strong customer testimonials and partner endorsements. Technically, Cludo utilizes a modern tech stack including HubSpot CMS, Cloudflare hosting, and integrates multiple marketing and analytics tools such as Google Analytics 4 and Microsoft Clarity. Security posture is solid with HSTS and content security policies in place, though the absence of modern TLS protocols and DNSSEC indicates room for improvement. Overall, Cludo demonstrates a mature digital presence with good privacy compliance and user experience, but could enhance security transparency and incident response readiness.

S

SiteGround

mailspamprotection.com

62

SiteGround is a large, well-established web hosting provider offering a broad range of hosting services including shared, cloud, reseller, WordPress, and WooCommerce hosting, as well as website building and email marketing tools. The company targets small to medium businesses, web professionals, and agencies, emphasizing performance, security, and customer support. Their market position is strong with over 3 million domains hosted and high customer satisfaction ratings. Technically, the website leverages modern web technologies including nginx, PHP, Google Tag Manager, Cookiebot for consent management, and reCAPTCHA for bot protection. The hosting infrastructure is based on Google Cloud, promising high availability and speed. Security headers are well implemented, but the SSL certificate is invalid for the domain, and no modern TLS protocols are enabled, indicating a critical security misconfiguration. Privacy and cookie policies are present and comprehensive, with GDPR compliance mechanisms in place. Overall, the website is professionally designed with excellent user experience and SEO optimization.

Serveris.lv, operated by SIA Datateks, is a Latvian hosting service provider established in 2002, offering web hosting, virtual servers, SSL certificates, and server rental services. The company targets Latvian businesses and individuals requiring reliable and professional hosting solutions with 24/7 technical support. Their market position is solid within the local telecommunications sector, supported by long-term customer relationships and positive testimonials. Technically, the website runs on Apache with PHP 5.6.40, uses common JavaScript libraries like jQuery, and integrates marketing and analytics tools such as Google Analytics, Facebook Pixel, and Cookiebot for cookie consent. The SSL certificate is valid but lacks modern TLS protocol support, and security headers are minimal. No explicit privacy or security policies are published, though cookie consent is implemented. Contact information is clearly provided, including phone, email, WhatsApp, and Skype.

S

SIA Blue Bridge Technologies

piearsta.lv

61

Piearsta.lv is an established Latvian healthcare portal operated by SIA Blue Bridge Technologies, providing an online platform for patients to book appointments with doctors and specialists, including options for remote consultations. The portal integrates with the SmartMedical healthcare management system, positioning itself as a convenient and accessible service for patients and healthcare providers. The website supports Latvian and English languages and emphasizes user convenience and accessibility. Technically, the site uses Apache server, JavaScript libraries including jQuery, and integrates third-party services such as Cookiebot for consent management, Google Analytics, and Facebook SDK for tracking and marketing. Security measures include a valid SSL certificate and several HTTP security headers; however, modern TLS protocols are not enabled, which is a notable gap. The site demonstrates good privacy and cookie policy compliance with GDPR considerations but lacks explicit published security and incident response policies. Overall, the portal shows a mature digital presence with room for security enhancements and improved transparency in security governance.

D

Die neue Dimension der Geldanlage-Investieren in eine digitale Zukunft

superfund.de

51

The website's security posture is currently weak, with significant deficiencies across multiple critical areas including privacy compliance, email authentication, and security policy frameworks. Critical gaps in GDPR adherence expose the business to regulatory penalties and reputational damage, especially given its EU operations without adequate privacy measures. The absence of key HTTP security headers leaves the site vulnerable to common web-based attacks such as clickjacking, content injection, and cross-site scripting. Email infrastructure lacks essential authentication mechanisms, increasing risks of phishing and email spoofing. Additionally, missing incident response and security documentation undermines the organization’s ability to detect, respond to, and recover from security incidents effectively. While SSL/TLS and DNS configurations are relatively stronger, urgent attention is needed to enable HSTS and extend certificate validity. Overall, this assessment reveals a pressing need to implement foundational security controls and compliance policies to safeguard the business and its customers. Failure to address these issues promptly could result in severe operational, financial, and legal consequences.

D

Die neue Dimension der Geldanlage-Investieren in eine digitale Zukunft

superfund.at

57

The website's security posture is currently weak, with critical and high severity issues impacting key areas such as privacy compliance, security headers, and information security management. Notably, the absence of essential security headers like Strict-Transport-Security and Content-Security-Policy leaves the site vulnerable to man-in-the-middle attacks, clickjacking, and cross-site scripting. GDPR compliance is critically lacking, with no privacy or cookie policies and no consent mechanisms, exposing the business to regulatory fines and reputational damage. Furthermore, the lack of a formal information security framework, incident response procedures, and security policy documentation undermines the organization's ability to manage and respond to cyber threats effectively. While email security, SSL/TLS, DNS health, and network security score moderately well, imminent SSL certificate expiration and missing DNSSEC are concerns. Overall, urgent remediation is required to reduce legal, operational, and cybersecurity risks. Implementing prioritized controls will strengthen defenses, ensure regulatory compliance, and protect customer trust.

The website's overall security posture reveals significant gaps, particularly in compliance with EU privacy regulations and foundational security controls. Critical and high-severity issues indicate the absence of essential headers, privacy measures, and security governance frameworks, exposing the business to legal, reputational, and operational risks. GDPR compliance is notably deficient, with no cookie policy, consent mechanisms, or adequate privacy practices in place, creating a critical risk for EU operations. The lack of incident response and security policy documentation further exacerbates vulnerability to cyber threats and breaches. While network security and DNS health demonstrate relatively strong postures, gaps in email security and SSL/TLS configurations could facilitate phishing and data interception attacks. Immediate remediation is required to align with regulatory requirements and industry best practices to protect customer data and maintain trust. Failure to act promptly may result in regulatory penalties, customer attrition, and increased exposure to cyberattacks.

B

Besins Healthcare

besins-healthcare.com

53

The website's overall security posture is currently weak and poses significant risks to both business operations and customer trust. A critical failure to implement HTTPS encryption exposes all data exchanges to interception and undermines compliance with GDPR and NIS2 regulations. The absence of fundamental security policies and incident response procedures further increases vulnerability to cyber threats and regulatory penalties. Weak security headers and missing cookie consent mechanisms exacerbate privacy risks, potentially damaging the company’s reputation. While email security and network security show relatively stronger performance, critical gaps remain in governance and data protection frameworks. Immediate remediation is essential to prevent data breaches, ensure legal compliance, and maintain stakeholder confidence. Without urgent action, the business risks financial loss, regulatory fines, and erosion of customer trust. Strengthening encryption, policies, and compliance measures must be prioritized to safeguard the organization’s digital presence.

The website demonstrates a concerning security posture with no critical vulnerabilities but a significant number of high and medium severity issues across multiple domains. Key gaps include missing essential security headers, lack of GDPR compliance elements such as privacy and cookie policies, and absence of a formal information security framework aligned with NIS2 requirements. Network exposure of high-risk services like FTP further elevates the risk of unauthorized access or data compromise. Email and DNS security are relatively stronger but still show room for improvement. The SSL/TLS configuration is adequate but requires timely certificate renewal and enabling HSTS for better protection. Overall, the current state exposes the business to regulatory penalties, reputational damage, and increased risk from common web-based attacks. Immediate remediation efforts should focus on closing compliance gaps and strengthening perimeter defenses to mitigate potential breaches and legal liabilities.

F

Façonnable

faconnable.com

80

The website demonstrates a generally solid security posture with no critical vulnerabilities detected and strong scores in email and network security. However, significant gaps exist in compliance with GDPR and NIS2 regulations, particularly around cookie consent, incident response, and security contact information, which expose the business to legal and operational risks. Security headers are partially configured but lack important protections against common web attacks, potentially increasing exposure to client-side threats. Mixed content and DNS security weaknesses also undermine the integrity and confidentiality of user interactions. While SSL/TLS and network configurations are mostly robust, improvements are needed to fully secure data transmission. Addressing these issues will not only enhance security but also improve regulatory compliance and customer trust. Prioritizing GDPR and NIS2 compliance will mitigate legal risks and strengthen incident readiness. Overall, the site is secure but requires targeted improvements to protect business continuity and reputation effectively.

E

Equiom

equiomgroup.com

38

Equiomgroup.com currently exhibits a severely deficient security posture, with critical vulnerabilities including the complete absence of HTTPS encryption and multiple DNS-related risks, exposing the business to data breaches and reputational damage. Additionally, the lack of GDPR compliance and NIS2 regulatory adherence presents significant legal and operational risks that must be urgently addressed.

E

Expand International AB

expandmedia.com

46

The website expandmedia.com currently exhibits a severely weak security posture, primarily due to the absence of HTTPS encryption and multiple critical security header misconfigurations. This exposes the business to significant risks including data interception, regulatory non-compliance, and increased vulnerability to attacks. Immediate remediation is essential to protect customer data, maintain trust, and comply with GDPR and NIS2 requirements.

L

Laboratoire Therascience

therascience.es

48

The website therascience.es currently exhibits a highly vulnerable security posture with multiple critical issues, most notably the complete lack of HTTPS encryption and non-compliance with GDPR requirements despite operating in the EU. These gaps expose the business to significant legal, reputational, and operational risks, necessitating immediate remediation to protect user data and maintain trust.

E

Edmond de Rothschild

edmond-de-rothschild.fr

49

The website's overall security posture is critically deficient, primarily due to the complete lack of HTTPS encryption, which exposes all data transmissions to interception and undermines user trust. Compliance with GDPR is severely lacking, with missing privacy and cookie policies, absence of a consent banner, and inadequate privacy measures for EU users, creating significant legal and reputational risks. The NIS2 compliance score is extremely low, indicating insufficient organizational security frameworks, policies, and incident response readiness, which heightens vulnerability to cyber incidents and regulatory penalties. While network security and DNS health show relatively strong results, essential protections like DNSSEC are not fully implemented. Security headers are mostly present but missing critical components such as the X-XSS-Protection header. Email security has gaps with missing DKIM records, potentially impacting email deliverability and phishing protections. Immediate remediation is needed to address encryption, privacy compliance, and governance frameworks to safeguard user data, maintain regulatory compliance, and protect business continuity. Without urgent action, the organization risks data breaches, regulatory fines, and loss of customer trust.

H

Holman Fenwick Willan LLP

hfw.com

66

The website https://hfw.com demonstrates a generally strong network and email security posture but shows significant deficiencies in GDPR compliance and information security policies, exposing the business to regulatory and reputational risks. Critical gaps in privacy documentation, incident response, and cryptographic practices need immediate attention to safeguard data and maintain trust.

P

Pantaenius

pantaenius.com

65

The website https://pantaenius.com exhibits several significant security and compliance gaps, particularly in areas related to web security headers, GDPR compliance, and incident response preparedness. While network security and email security show relative strength, critical vulnerabilities such as missing security headers, lack of GDPR-aligned cookie management, and absence of incident response documentation expose the business to regulatory risks and potential cyber threats.

D

Dietsmann

dietsmann.com

60

The website dietsmann.com currently exhibits significant security and compliance gaps, particularly in web security headers, GDPR compliance, and information security governance, placing the business at risk of data breaches, regulatory penalties, and reputational damage. While foundational network security and email security are relatively strong, critical improvements are needed urgently to protect sensitive data and meet regulatory requirements.

D

Dienas Bizness

ekiosks.lv

57

The website ekiosks.lv exhibits significant security and compliance deficiencies, particularly in privacy measures and foundational cybersecurity frameworks, exposing the business to regulatory, reputational, and operational risks. While some network and email security controls are in place, critical gaps like missing GDPR compliance elements and weak SSL configurations undermine overall security posture.

Z

Zelta Zivtiņa

zeltazivtina.lv

61

The website https://zeltazivtina.lv exhibits significant security and compliance deficiencies, particularly in GDPR and NIS2 regulatory adherence, posing substantial legal and operational risks. While network and email security are relatively strong, critical gaps in privacy policies, incident response, and encryption standards undermine overall trustworthiness and expose the business to potential data breaches and regulatory penalties.

The website ekstrabladet.dk exhibits significant security and compliance gaps, particularly in privacy governance and regulatory adherence, posing substantial risks to business reputation and legal standing. While network and email security are relatively strong, critical deficiencies in GDPR compliance, security policies, and HTTP security headers undermine overall security posture and expose the organization to data breaches and regulatory penalties.

J

Jyllands-Posten

jyllands-posten.dk

57

The website jyllands-posten.dk exhibits significant security and compliance deficiencies, particularly in foundational web security headers and GDPR compliance, exposing the business to legal risks and potential cyber threats. While network and email security postures are relatively strong, the absence of critical privacy policies and security frameworks undermines trust and regulatory adherence.

The website https://watchmedier.dk currently exhibits significant security gaps, particularly in foundational security headers, GDPR compliance, and NIS2 regulatory readiness. Although network and email security are relatively strong, the absence of critical policies and protective headers exposes the business to data breaches, regulatory fines, and reputational damage. Immediate remediation is essential to strengthen the security posture and ensure compliance with data protection regulations.