Security Directory

Expansion Group is a San Marino-based media and communication agency established in 2011, providing advertising, digital marketing, design, and media portfolio services to a diverse client base. The company maintains a mature online presence with a well-structured website showcasing its portfolio and client successes. Technically, the website is built on WordPress with popular plugins and integrates common marketing and analytics tools such as Google Analytics, Facebook Pixel, and LinkedIn Insight Tag. However, the site suffers from significant security shortcomings, notably the absence of a valid SSL certificate and HTTPS support, which exposes visitors to potential risks. Privacy compliance is addressed with a cookie consent banner and a privacy policy, but incident response and security policies are not publicly documented. Overall, the website demonstrates moderate digital maturity but requires urgent security improvements to protect user data and enhance trust.

S

SEO Optimizers

seooptimizers.com

40

SEO Optimizers is a well-established digital marketing and advertising agency based in Los Angeles, specializing in SEO, paid advertising, social media marketing, and website design. The company targets small to medium-sized businesses seeking to increase online visibility, sales, and leads. With a domain age of 17 years and a strong portfolio of client testimonials and reviews, SEO Optimizers holds a credible market position in the digital marketing sector. The website is built on WordPress and leverages multiple modern marketing and SEO tools, reflecting a mature digital infrastructure. However, the absence of a valid SSL certificate and HTTPS implementation represents a significant security gap, impacting user trust and security posture. While the site includes comprehensive business contact information and structured data, privacy compliance features such as cookie consent mechanisms and GDPR indicators are minimal or absent. Overall, the site demonstrates good content quality and business credibility but requires urgent security improvements to meet modern standards.

A

AFTES - Association Française des Tunnels et de l'Espace Souterrain

aftes.fr

35

AFTES is a French non-profit association specializing in the field of tunnels and underground spaces, representing all trades involved in the design and construction of such infrastructures. The organization provides a range of services including training, publications, events, and working groups to advance knowledge and techniques in underground construction. The website is professionally designed, targeting industry professionals and organizations in transportation and energy sectors. Technically, the site is built on WordPress with Elementor and WooCommerce, hosted on OVH, and uses various modern web technologies and analytics tools. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which is a significant security concern. Cookie consent and privacy policies are well implemented, reflecting good GDPR compliance. Overall, the site is content-rich and trustworthy but requires urgent improvements in its security posture.

I

Isadmission

isadmission.com

48

Isadmission is a French-based company specializing in digital solutions for managing student admission contests, targeting educational institutions. The website presents a professional and well-structured platform built on WordPress with modern plugins and tools, offering a good user experience and clear navigation. However, the technical infrastructure shows weaknesses, notably the absence of a valid SSL certificate, resulting in no HTTPS support, which significantly impacts security posture. The site implements basic privacy compliance measures including cookie consent and a privacy policy, but lacks advanced security policies or incident response information. Overall, the business appears credible with testimonials and social media presence, but the security shortcomings pose risks that should be addressed promptly.

S

Sodern

sodern.com

50

Sodern is a French technology company specializing in space optronics and neutron technology, operating as a subsidiary of ArianeGroup. The company holds a leading position globally and in Europe in its niche markets, providing advanced products such as star trackers, spatial cameras, and neutron analysis equipment primarily for defense, space, and mining sectors. The website reflects a professional corporate presence with comprehensive content, legal compliance pages, and active social media engagement. Technically, the site is built on WordPress with modern plugins and frameworks, but suffers from critical security shortcomings due to the absence of a valid SSL certificate and HTTPS support, which significantly impacts its security posture. Privacy compliance is well addressed with GDPR-aligned policies and consent mechanisms. Overall, the site demonstrates good business credibility and content quality but requires urgent security improvements to protect user data and enhance trust.

E

EELISA

eelisa.eu

40

EELISA is a European university alliance focused on engineering education, research, and innovation. It brings together multiple prestigious partner universities across Europe to provide joint educational programs, research networking, and community engagement. The website reflects a mature digital presence with comprehensive content, including detailed event listings and partner information. Technically, the site is built on WordPress with various plugins for events and page building, but suffers from slow performance and lacks a valid SSL certificate, which impacts security. The security posture is weak due to missing HTTPS, HSTS, DNSSEC, and other security headers. Privacy compliance is good with clear privacy and cookie policies and consent mechanisms. Overall, the site is professional and trustworthy but requires significant improvements in security configuration to enhance user trust and data protection.

U

URL Networks

url.net.au

49

URL Networks is an Australian telecommunications provider specializing in business telephony and internet services, including hosted cloud PBX, SIP trunking, and various internet connectivity plans. The company positions itself as a trusted provider for businesses seeking stress-free telecommunications solutions. Their website is built on WordPress with modern plugins and tools, targeting Australian business customers with a focus on cloud and virtualized telephony services. The site includes detailed service descriptions and multiple contact channels, including phone, email, and social media. Technically, the website uses a WordPress CMS with Elementor, Yoast SEO, and several marketing and analytics tools such as Google Tag Manager and Chatlio live chat. Hosting appears to be on AWS infrastructure. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which is a critical security deficiency. Performance data is missing, and no cookie consent mechanism is present, indicating limited privacy compliance. Security posture is weak due to the absence of HTTPS, no security headers, and no modern TLS protocols enabled. While no active vulnerabilities like Heartbleed or POODLE are detected, the lack of encryption exposes users to significant risks. Privacy policy is present and comprehensive but GDPR compliance is uncertain due to missing cookie consent. Incident response and security policies are not published. Overall, the website is functional and professionally designed but requires urgent security improvements, especially enabling HTTPS and implementing security best practices. Privacy compliance should be enhanced with cookie consent mechanisms. Business credibility is supported by clear contact information and social media presence, but security gaps reduce trustworthiness.

W

WEBKINDER AG

webkinder.ch

71

WEBKINDER AG is a Swiss digital agency specializing in web design, development, and online strategies, primarily serving clients in Luzern and Zürich. The company offers comprehensive services including WordPress and WooCommerce development, SEO, and custom web applications, positioning itself as a trusted partner for businesses and non-profit organizations seeking effective digital solutions. The website reflects a mature digital presence with professional design, clear navigation, and rich content including client references and insights. Technically, the website is built on WordPress with a modern tech stack including Gravity Forms, Yoast SEO, and WP Rocket for performance optimization. Hosting is managed via cyon.ch, and the site employs HTTPS with valid SSL certificates and SPF records for email security. The site is mobile-optimized and accessible, with good SEO practices implemented. From a security perspective, the site enforces HTTPS, uses security headers like HSTS (though not fully enabled), and employs Google reCAPTCHA v3 on forms. No critical vulnerabilities or exposed sensitive data were detected. Privacy compliance is well addressed with a comprehensive privacy policy, cookie consent mechanisms, and GDPR adherence. Contact information is clearly presented, enhancing trust and credibility. Overall, WEBKINDER AG demonstrates a strong digital maturity and security posture suitable for its business model. Strategic improvements could include enabling full HSTS policies, OCSP stapling, and publishing a security.txt file to further enhance security transparency and resilience.

T

truzzer

truzzer.com

68

truzzer.com is a professionally designed e-commerce website specializing in customer trust solutions, including products to increase Google reviews and social media followers via NFC-enabled marketing materials. The company targets businesses seeking to enhance their online reputation and customer engagement. The site is built on WordPress with WooCommerce and uses modern marketing and analytics tools such as Google Tag Manager, Facebook Pixel, and Pinterest Pixel. Security posture is solid with HTTPS and several security headers, though improvements like HSTS could enhance it further. Privacy compliance is good with clear privacy and cookie policies and consent mechanisms. Overall, the website presents a trustworthy and professional front with clear business information and contact options.

E

empfehlio

empfehlio.de

40

empfehlio is a leading European provider specializing in NFC and QR code solutions designed to enhance customer engagement and online reputation management. The company offers a comprehensive range of products and services including NFC tags, QR code stickers, digital business cards, and software solutions aimed at generating Google and social media reviews, as well as increasing followers on platforms like Instagram and TikTok. Their market position as a leader in this niche is supported by a strong brand presence and partnerships with notable clients. Technically, the website is built on a modern WordPress and WooCommerce stack with extensive use of marketing and analytics tools such as Google Tag Manager and Facebook Pixel. However, the absence of a valid SSL certificate and lack of modern TLS protocols represent significant security weaknesses that must be addressed to protect user data and maintain trust. Privacy compliance is well managed with clear privacy and cookie policies and consent mechanisms in place. Overall, empfehlio demonstrates a strong business model and digital maturity but requires urgent improvements in security infrastructure to align with best practices.

H

Hamburg Innovation

hamburginnovation.de

35

Hamburg Innovation GmbH is a medium-sized innovation and technology transfer company based in Hamburg, Germany, founded in 2004. It serves as a bridge between academic research and practical application by connecting universities with businesses, policymakers, and society to foster innovation. The company offers consulting, mediation, and coordination services to support knowledge transfer, spin-offs, and new technologies. Technically, the website is built on WordPress with Elementor and Slider Revolution, providing a professional and content-rich user experience. However, the absence of a valid SSL certificate and HTTPS implementation represents a critical security vulnerability. Privacy and cookie policies are well implemented with consent mechanisms, and contact information is clearly provided. The site uses Matomo for analytics, indicating a privacy-conscious approach. Overall, the website is professional and trustworthy but requires urgent security improvements to protect user data and enhance trust.

W

WSD

solvians.com

60

WSD is a technology company specializing in full automation solutions for structured products, serving a global clientele primarily in the financial sector. The company positions itself as a critical infrastructure provider in the structured products value chain, offering cloud-based, scalable, and resilient technology solutions. Their website reflects a professional and consistent brand with strong industry partnerships and certifications such as ISO and EcoVadis. Technically, the site is built on WordPress with Elementor and uses various modern JavaScript libraries and plugins, but suffers from slow load times and lacks HTTPS encryption, which is a significant security concern. Privacy compliance is well addressed with clear cookie and privacy policies and consent mechanisms. However, the absence of SSL and security headers lowers the overall security posture. The company provides multiple contact channels including email, phone, and a detailed contact form, supporting good business credibility. Strategic recommendations include immediate implementation of HTTPS, enhancement of security headers, and performance optimization to improve user experience and security.

G

GO-2B AG

go-2b.de

60

GO-2B AG is a German-based technology company specializing in product data management solutions tailored for industries such as furniture and retail. As a brand under Compusoft Deutschland AG, it offers a suite of services including software applications, configurators, and data management platforms to support complex product marketing and sales processes. The website reflects a professional and consistent brand image with clear business information and client references, targeting B2B customers in industrial and retail sectors. Technically, the site is built on WordPress with popular plugins and frameworks, but suffers from slow load times and lacks some modern security configurations. Security posture is moderate with valid SSL and SPF records but missing critical headers and HSTS. Privacy compliance is strong with comprehensive policies and consent mechanisms. Overall, the site is functional and trustworthy but would benefit from technical and security enhancements.

S

SAE University College

sae.edu.au

48

SAE University College is a leading higher education provider specializing in creative media and technology courses across Australia and internationally. It offers a wide range of industry-led programs in Animation, Audio, Design, Film, Games, Music, and related fields. The institution is part of the Navitas Group and holds important accreditations such as TEQSA and CRICOS, positioning it as a reputable player in the education sector. Technically, the website is built on WordPress with modern technologies and integrates multiple marketing and analytics tools, reflecting a mature digital presence. Security-wise, the site supports modern TLS protocols and has some best practices in place but is vulnerable to subdomain takeover and lacks HSTS enforcement, indicating areas for improvement. Overall, SAE University College maintains a professional and trustworthy online presence with comprehensive content and good user experience, though it should enhance its security posture and privacy compliance mechanisms.

S

Score Media Group

scoremedia.de

55

Score Media Group operates as a national marketing platform for regional media brands in Germany, focusing on over 420 regional daily newspaper titles and associated digital and print media. The company targets advertisers and agencies seeking crossmedia advertising solutions, leveraging a strong market position with a comprehensive portfolio and high audience reach. Technically, the website is built on WordPress with modern plugins and frameworks, but performance is slow and some technical optimizations are possible. Security posture is generally good with modern TLS support and valid SPF records, but lacks advanced protections such as HSTS, DNSSEC, and OCSP stapling. Privacy compliance is addressed with a cookie consent mechanism and a comprehensive privacy policy. Overall, the company demonstrates a mature digital presence with room for security and performance improvements.

P

PwC-Stiftung

pwc-stiftung.de

53

PwC-Stiftung is a German non-profit foundation focused on promoting economic ethics and cultural education through project funding and its own educational programs. The foundation operates several participatory programs such as Wirtschafts.Forscher!, Hör.Forscher!, and Kultur.Forscher!, targeting schools and students, especially addressing pandemic-related educational gaps and refugee integration. The website is built on WordPress with a moderate technical infrastructure including common plugins for SEO, sliders, and cookie management. Hosting is provided by IONOS, and the site includes structured data for SEO and social media optimization. However, the security posture is weak due to an invalid SSL certificate, lack of modern TLS protocols, and missing security headers and DNS security features. Cookie consent is implemented in compliance with GDPR, enhancing privacy protections. Overall, the site presents a professional and trustworthy image but requires urgent improvements in SSL and security configurations to protect users and data.

S

Score Media Group

score-media.de

55

Score Media Group operates as a national marketing platform for regional media brands in Germany, focusing on regional daily newspapers, their digital and print editions, and associated advertising services. The company holds a strong market position with a portfolio of over 420 regional newspaper titles reaching 62 million readers monthly. Their business model centers on cross-media advertising solutions, combining print, online, and e-paper channels to deliver targeted campaigns for advertisers and agencies. Technically, the website is built on WordPress with modern frameworks like React and uses various plugins and tools such as WPBakery, Slider Revolution, and Google Analytics, indicating a mature digital infrastructure but with room for performance optimization due to high page size and load times. Security-wise, the site supports modern TLS protocols and has valid SPF records but lacks advanced security headers like HSTS and OCSP stapling, and the DMARC policy is set to none, which could expose email spoofing risks. Overall, the site demonstrates good SEO, branding consistency, and user experience but would benefit from enhanced security configurations and clearer contact information.

D

dimension2 economics & philosophy GmbH

dimension2.consulting

64

dimension2 economics & philosophy GmbH is a small German consulting firm specializing in Corporate Digital Responsibility (CDR) and ethical data usage to help businesses gain competitive advantages. Their website presents a professional and well-structured digital presence built on WordPress with modern design elements and SEO optimizations. However, the technical infrastructure shows significant security weaknesses, including the absence of a valid SSL certificate and lack of modern TLS protocols, which exposes the site to risks and undermines user trust. The company provides contact primarily through a contact form, with no direct email or phone contacts publicly listed. Privacy policy is present and GDPR compliant, but cookie consent mechanisms and terms of service are missing. Overall, the business is positioned as a niche consulting provider with a focus on trustworthy data practices, but the website's security posture requires urgent improvements to align with best practices and enhance client confidence.

V

Ventura Foods, LLC

louana.com

68

LouAna.com represents the digital presence of LouAna Oils, a well-established brand under Ventura Foods, LLC, specializing in cooking oils and related recipe content. The website targets consumers interested in cooking and beauty uses of oils, offering product information, recipes, tips, and beauty advice. The business model combines product retail with content marketing to engage and retain customers. Technically, the site is built on WordPress, leveraging common plugins and third-party marketing tools, hosted via WP Engine and protected by Cloudflare. Performance and mobile optimization are good, with SEO practices supported by Yoast SEO plugin. Security posture is moderate with valid SSL certificates and several security headers implemented; however, the lack of modern TLS protocols and disabled X-XSS-Protection header reduce the overall security score. No cookie consent mechanism or explicit GDPR compliance is evident, and no incident response or vulnerability disclosure policies are published. The site integrates multiple marketing and tracking tools including Google Analytics, Facebook and Pinterest pixels, and affiliate marketing via Hopster. Overall, LouAna.com is a professionally maintained retail and content site with room for security and privacy enhancements.

G

Gaming Associates Europe

gamingassociates.org

60

Gaming Associates Europe is an accredited ISO/IEC 17065 certification body specializing in independent assessment and certification of online gaming products and remote gaming systems. With over 20 years of industry experience and UKAS accreditation, the company serves operators and regulators globally, providing trusted compliance services. The website demonstrates a professional digital presence built on WordPress with modern performance optimizations and integration of analytics tools. Security posture is adequate with a valid SSL certificate and absence of known vulnerabilities, though TLS protocols are disabled and HSTS is not enabled, indicating room for improvement. No explicit privacy, cookie, or terms of service policies were found, which may impact compliance and user trust. Overall, the company maintains a strong market position in the gaming certification sector with clear contact channels and social media presence.

G

Gaming Associates Europe AB

gamingassociates.se

53

Gaming Associates Europe AB is a specialized certification body accredited under ISO/IEC 17065:2012, focusing on online gambling systems certification in Sweden. They hold the distinction of being the first SWEDAC accredited certification body in this domain, providing product certification, testing, and ISMS assessments through trusted partners. Their services ensure compliance with Swedish gambling regulations, targeting online gambling operators seeking regulatory approval. Technically, the website is built on WordPress with modern plugins and optimized for performance and mobile use, though there are notable security configuration gaps in SSL/TLS protocols. The company maintains a professional online presence with clear contact information and social media engagement on LinkedIn and Twitter.

B

Best Media Rates

bestmediarates.com.au

63

The website's overall security posture is concerning, with multiple critical and high-severity issues that expose it to significant risks including data breaches, regulatory non-compliance, and service disruptions. Key deficiencies in security headers and the absence of fundamental security controls like Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options increase vulnerability to common web attacks such as XSS and clickjacking. GDPR compliance gaps, including missing cookie policies and consent banners, expose the business to legal and financial penalties. The lack of documented security policies, incident response plans, and vulnerability disclosure under the NIS2 framework reflects immature security governance. Network exposure of critical services like MySQL and FTP significantly heightens the risk of unauthorized access and data exfiltration. While email security and SSL/TLS configurations are relatively strong, critical gaps remain in network security and DNS configurations. Immediate remediation is essential to protect sensitive data, maintain customer trust, and ensure regulatory compliance. Without swift action, the business faces increased risk of cyber incidents and reputational damage.

The website demonstrates a concerning security posture with no critical vulnerabilities but multiple high and medium risks that could expose the business to significant threats. Key security headers are missing, exposing the site to common web attacks such as clickjacking, content injection, and cross-site scripting. Compliance gaps around GDPR and NIS2 regulations pose legal and reputational risks, including the absence of privacy policies, cookie consent mechanisms, incident response plans, and security documentation. The presence of an exposed FTP service introduces a high-risk attack vector that could lead to unauthorized access or data breaches. Although email security and DNS health are relatively stronger, SSL/TLS configurations need attention, especially with an expiring certificate and lack of HSTS enforcement. Overall, the site requires immediate remediation to secure user data, meet regulatory requirements, and prevent potential operational disruptions or fines. Addressing these issues will improve customer trust, reduce liability, and enhance the organization's cyber resilience.

The website's security posture is currently weak, with critical gaps in privacy compliance, network security, and foundational security headers. Critical services like MySQL are exposed, significantly increasing the risk of data breaches and unauthorized access. The absence of GDPR-required policies and consent mechanisms puts the business at high legal and reputational risk, especially as it operates within the EU. Security headers are largely missing or misconfigured, leaving the site vulnerable to common web attacks such as clickjacking, XSS, and content injection. The lack of an established information security framework, incident response procedures, and vulnerability disclosure policies indicates immature cybersecurity governance. While email security and DNS health show moderate strength, SSL/TLS implementation needs improvement to ensure secure communications. Immediate remediation is necessary to reduce risk exposure and ensure regulatory compliance, protecting both customer data and business continuity.

N

Namebay

namebay.com

48

The website's security posture is currently inadequate, with critical vulnerabilities that expose the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is the most severe issue, compromising data confidentiality and integrity for all users. Additionally, missing GDPR compliance elements such as privacy and cookie policies, along with a lack of consent mechanisms, expose the business to legal penalties and customer trust erosion. Security governance is weak, with no documented incident response, security policies, or vulnerability disclosure processes, increasing the risk of unmanaged security incidents. Security headers are partially implemented but lack essential protections against common web attacks. Network-level controls are strong, but this does not offset the critical application-layer and compliance deficiencies. Immediate remediation is required to safeguard customer data and meet regulatory requirements. Without prompt action, the business faces heightened operational and legal risks.

I

Icon Connect

iconconnect.com

47

The website's overall security posture is critically weak, with significant gaps in foundational security controls and compliance requirements. The absence of HTTPS encryption is the most severe vulnerability, exposing all data transmissions to interception and undermining user trust. Key security headers are missing, increasing the risk of cross-site scripting, clickjacking, and other web-based attacks. Compliance with GDPR is poor, lacking a cookie policy, consent mechanisms, and sufficient privacy disclosures, exposing the business to regulatory penalties. The NIS2 directive requirements are largely unmet, with no documented security frameworks, incident response plans, or business continuity strategies. While email security and network posture are relatively strong, these do not compensate for the critical web and compliance deficiencies. Immediate remediation is essential to protect sensitive data, ensure regulatory compliance, and maintain customer confidence. Without urgent action, the business faces heightened cyber risk, legal exposure, and reputational damage.

P

ProTech Monte-Carlo

protech.mc

42

The website's overall security posture is critically weak, with major deficiencies in foundational security controls such as HTTPS encryption and essential security headers. Lack of HTTPS exposes user data to interception and undermines trust, while missing security headers increase vulnerability to common web attacks like clickjacking and XSS. Additionally, the absence of GDPR compliance elements such as Privacy and Cookie Policies and consent mechanisms risks regulatory penalties and damages customer trust. The site also lacks critical NIS2 framework components including incident response, security policies, and business continuity plans, which could impair the organization's ability to respond to and recover from cyber incidents. While email security and network security show relatively strong scores, the critical gaps in encryption and policy documentation represent immediate threats to business continuity and reputation. Overall, urgent remediation is needed to secure customer data, ensure regulatory compliance, and protect the business from reputational and financial harm. Failure to act promptly may result in data breaches, legal consequences, and loss of customer confidence.

P

Phoenix Hotel Management Company

phoenixhmc.com

38

The website's overall security posture is critically weak, exposing the business to significant risks from data breaches, regulatory penalties, and operational disruptions. Key foundational controls such as HTTPS encryption, security headers, and incident response mechanisms are missing, leaving data vulnerable in transit and at rest. Compliance with GDPR and NIS2 regulations is severely lacking, increasing legal and financial exposure. Sensitive services like MySQL and PostgreSQL are openly accessible, creating high-risk attack vectors. Although email security and DNS health are relatively stronger, critical gaps in network and application security overshadow these strengths. Immediate remediation is essential to protect customer data, maintain trust, and ensure regulatory compliance. Without urgent action, the business faces potential data loss, reputational damage, and costly fines. Strengthening security controls will also support business continuity and resilience against cyber threats.

The website's security posture is currently poor, with multiple critical and high-severity issues exposing the business to significant risks including data breaches, regulatory non-compliance, and operational disruptions. The complete lack of HTTPS encryption is a critical vulnerability that undermines all web traffic security and violates GDPR and NIS2 regulations. Key security headers are missing, increasing the risk of cross-site scripting, clickjacking, and data leakage attacks. Additionally, the absence of privacy and cookie policies, as well as consent mechanisms, exposes the organization to legal penalties under GDPR. The lack of documented information security frameworks and incident response procedures further increases the risk of inadequate breach handling and prolonged downtime. Exposed high-risk services like FTP and SSH without proper controls elevate the attack surface. Email security is moderately strong but should be improved with DMARC enforcement. Overall, immediate remediation is essential to protect sensitive data, ensure regulatory compliance, and maintain customer trust.

W

Wyser

wyser-search.com

47

The website's current security posture is critically weak, with multiple severe vulnerabilities exposing it to significant risk. The absence of HTTPS encryption is a fundamental flaw, affecting data confidentiality and trust, and violates GDPR and NIS2 requirements. Key security headers such as Strict-Transport-Security and Content-Security-Policy are missing, increasing exposure to common web attacks like XSS and protocol downgrade attacks. GDPR compliance is notably poor, lacking essential elements like a cookie policy and consent mechanisms, which can lead to regulatory fines and reputational damage. The absence of documented information security frameworks, security policies, and incident response procedures indicates immature organizational security governance. While email security and network security are relatively strong, this does not compensate for the critical gaps in web application and data protection. Immediate remediation is necessary to protect customer data, maintain regulatory compliance, and preserve business reputation. Without swift action, the organization risks data breaches, regulatory penalties, and loss of customer trust.

G

Groupe Banque Richelieu

banquerichelieu.com

42

The website's security posture is currently poor, with multiple critical and high-severity issues significantly increasing business risk. The absence of HTTPS encryption is a critical vulnerability, exposing all data transmissions to interception and undermining customer trust and compliance with regulations. Key security headers are missing, which weakens protection against common web attacks such as clickjacking and cross-site scripting. The lack of GDPR compliance elements like privacy and cookie policies, and consent mechanisms, exposes the business to legal penalties and reputational damage. Additionally, the absence of fundamental NIS2 controls such as incident response procedures, security policies, and a security framework indicates immature security governance. Email authentication mechanisms are partially implemented but need enforcement to reduce phishing risks. DNS security is moderately healthy but could be improved by enabling DNSSEC. Overall, immediate remediation is essential to protect sensitive data, maintain regulatory compliance, and safeguard customer trust.

N

Nico Rosberg

nicorosberg.com

38

The website's security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and service disruptions. Key deficiencies include the absence of HTTPS encryption, leading to insecure data transmission, and missing fundamental security headers that protect against common web attacks. Additionally, the lack of GDPR compliance elements—such as privacy policies and cookie consent—poses legal risks and potential fines. Network exposure of critical services like MySQL and FTP further increases the attack surface, making unauthorized access more likely. The organization's security governance is underdeveloped, with no formal information security framework, incident response procedures, or vulnerability disclosure policies in place. Although email security and DNS health show moderate maturity, the overall low scores in core security domains highlight urgent remediation needs. Immediate action is required to safeguard business assets, maintain customer trust, and comply with regulatory requirements.

I

ITECO Oil Field Supply Group

iteco-supply.com

38

The website's security posture is critically weak, exposing the business to substantial risks including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is a critical vulnerability that jeopardizes all data transmissions, undermining user trust and violating GDPR and NIS2 requirements. Key security headers are largely missing, increasing susceptibility to common web attacks like clickjacking and cross-site scripting. The lack of fundamental GDPR compliance elements such as a Privacy Policy, Cookie Policy, and Consent Banner further exposes the company to legal penalties. Network services like FTP and SSH are unnecessarily exposed, elevating the risk of unauthorized access. Email security is moderately strong, but critical DNS security measures such as DNSSEC are absent. Overall, urgent remediation is required to protect customer data, ensure compliance with industry regulations, and maintain business continuity.

F

Frank Europe GmbH

frankeurope.com

53

The website's overall security posture presents significant concerns, particularly regarding foundational protections and regulatory compliance. Critical issues such as the lack of HTTPS encryption severely expose user data to interception and compromise trust. GDPR compliance is markedly deficient, posing legal and reputational risks due to missing cookie policies, consent mechanisms, and inadequate privacy documentation. The absence of a formal information security framework and incident response plans under NIS2 regulations further escalates operational and compliance vulnerabilities. While network security and email security scores are relatively strong, the missing security headers and weak configurations increase susceptibility to web-based attacks. DNS health is adequate but could be improved by enabling DNSSEC and configuring CAA records. Immediate remediation is essential to protect sensitive data, maintain customer confidence, and avoid regulatory penalties. Addressing these gaps will also enhance the company’s resilience against cyber threats and align security practices with industry standards.

O

Oxygen Aviation Ltd

oxygenaviation.com

61

The website exhibits significant security and compliance gaps, particularly in foundational security headers, GDPR adherence, and NIS2 regulatory requirements. Although there are no critical vulnerabilities, multiple high and medium severity issues expose the business to increased risk of data breaches, regulatory penalties, and reputational damage. Key weaknesses include missing essential HTTP security headers, absence of cookie policies and consent mechanisms, and lack of documented information security and incident response procedures. Additionally, outdated or expiring SSL certificates and exposed high-risk services like FTP further elevate the risk profile. While email security and DNS health show generally better scores, the overall security posture is weak, especially around compliance and network security frameworks. Immediate attention is needed to close these gaps to protect customer data, ensure regulatory compliance, and maintain business continuity. Proactive remediation will reduce attack surface and demonstrate commitment to cybersecurity best practices to stakeholders and regulators.

M

Monaco Business Solutions (MBS)

mbs.mc

67

The website demonstrates a moderate overall security posture with no critical vulnerabilities but multiple high and medium risk issues that pose significant business and compliance risks. Key deficiencies include missing essential security headers, inadequate GDPR compliance due to absence of privacy policies and cookie consent mechanisms, and substantial gaps in NIS2 regulatory requirements such as lack of incident response plans and security documentation. Network security is impaired by exposure of high-risk services like FTP, increasing the attack surface. While email security, SSL/TLS, and DNS health scores are relatively strong, issues such as an expiring SSL certificate and mixed content could undermine user trust. The absence of a comprehensive information security framework and vulnerability disclosure process further expose the business to potential data breaches and regulatory penalties. Immediate remediation is necessary to strengthen legal compliance, protect customer data, and reduce operational risks associated with cyber threats.

A

ASCOMA

ascoma.com

72

The website's overall security posture reveals significant compliance and network security deficiencies that pose considerable business risks. While foundational elements like email security and SSL/TLS configurations score well, critical vulnerabilities exist such as exposure of a critical MySQL service and lack of incident response and security policy documentation. GDPR compliance is notably weak with missing cookie policies and consent mechanisms, exposing the business to regulatory penalties and reputational damage. The absence of a structured information security framework and vulnerability disclosure policy further weakens the organization's resilience against cyber threats. Network security is compromised due to high-risk and critical services being exposed unnecessarily. Additionally, DNS and security headers require enhancements to improve defense-in-depth. Immediate remediation is essential to reduce attack surfaces, comply with regulations, and protect sensitive data, thereby safeguarding business continuity and customer trust.

T

Tennant Metals

tennantmetals.com.au

75

The website demonstrates a moderate security posture with no critical vulnerabilities detected, but several high and medium-risk issues that could expose the business to significant risks. Key security headers are missing, such as Strict-Transport-Security, X-Frame-Options, and Content-Security-Policy, increasing susceptibility to common web attacks like clickjacking and man-in-the-middle attacks. Compliance gaps related to GDPR and NIS2 frameworks highlight insufficient data protection policies, lack of incident response procedures, and absence of documented security policies, which could lead to regulatory penalties and operational disruptions. While SSL/TLS and DNS configurations are generally strong, the absence of HSTS and DNSSEC reduces communication security and trustworthiness. The company benefits from strong email and network security, but overall low scores in governance and security policy areas present material business risks. Immediate remediation is necessary to prevent data breaches, maintain customer trust, and ensure regulatory compliance. Addressing these weaknesses will enhance resilience, reduce liability, and safeguard the organization’s reputation.

E

Emancipe

ecoledesparents.be

42

The website ecoledesparents.be currently exhibits a severely deficient security posture, primarily due to the absence of HTTPS encryption and critical security headers, exposing the business to data breaches, regulatory non-compliance, and reputational damage. Additionally, the lack of privacy policies and incident response frameworks significantly increases legal and operational risks, especially under EU regulations.

M

Monaco Planning

monacoplanning.nl

61

The website monacoplanning.nl currently exhibits a weak security posture with multiple critical and high-severity issues, particularly in privacy compliance and security header implementation. This poses significant risks including regulatory non-compliance with GDPR, potential data exposure, and vulnerability to common web-based attacks, which could impact customer trust and legal standing. Immediate remediation is needed to safeguard sensitive data and uphold business reputation.

M

mim | interiors

miminteriors.com

64

The website miminteriors.com currently exhibits a weak security posture with multiple high and medium risk issues, particularly in web security headers, GDPR compliance, and organizational security policies. While network security and SSL/TLS configurations are relatively strong, the absence of key security controls and privacy policies exposes the business to legal, reputational, and operational risks.

The website demonstrates a solid technical security foundation with strong email security, network security, and SSL/TLS configurations, but significant gaps exist in compliance and governance areas, particularly GDPR and NIS2 requirements. These deficiencies expose the business to regulatory risks, potential data privacy violations, and operational vulnerabilities from inadequate incident response and security policies.