Security Directory

A

Australia Post

auspost.com.au

70

The website demonstrates a generally solid technical security foundation with strong email security, network security, SSL/TLS, and DNS health scores. However, significant deficiencies exist in compliance with data privacy regulations such as GDPR, and critical gaps are present in information security governance aligned with NIS2 requirements. The absence of a privacy policy, cookie policy, and consent mechanisms exposes the business to regulatory penalties and reputational damage. Moreover, lacking documented security policies, incident response plans, and vulnerability disclosure processes increases operational risk and may delay breach mitigation. Security headers are moderately configured but require improvements to reduce attack surface and prevent data leakage. Overall, the site’s technical controls are adequate but the organization must urgently address compliance and governance shortcomings to safeguard customer trust and meet legal obligations. Failure to act on these high-impact, high-risk issues could result in financial losses and regulatory scrutiny.

The website exhibits significant security and compliance gaps that could expose the business to legal, reputational, and operational risks. While there are no critical vulnerabilities, multiple high-severity issues related to missing security headers, absence of GDPR compliance measures, and lack of foundational information security frameworks are evident. The absence of a Privacy Policy, Cookie Policy, and consent mechanisms increases the risk of regulatory penalties and undermines user trust. Additionally, missing incident response and security policy documentation hampers the organization's ability to effectively manage and respond to security incidents. Although email security, SSL/TLS, DNS health, and network security scores are relatively strong, foundational security controls such as HSTS and DNSSEC require improvement. Immediate remediation is essential to align with industry best practices and relevant regulations like GDPR and NIS2. Addressing these gaps will substantially reduce the risk of data breaches, regulatory fines, and damage to brand reputation.

R

RealPage, Inc.

realpagelumina.com

68

The website's overall security posture reveals significant gaps, particularly in governance and compliance areas. Critical issues such as the lack of email authentication and missing incident response procedures expose the business to heightened risks of phishing attacks and prolonged downtime during security incidents. High-severity findings around GDPR compliance and the absence of a documented security framework indicate potential regulatory and reputational risks. Although network security and DNS health scores are strong, foundational security controls like Content-Security-Policy and Strict-Transport-Security headers are insufficiently configured, increasing vulnerability to web-based attacks. Expiring SSL certificates and mixed content issues further degrade trust and security. Immediate remediation is necessary to safeguard sensitive data, ensure regulatory compliance, and protect brand reputation. The business should prioritize establishing formal security policies and improving critical headers and email authentication measures. Addressing these issues will reduce risk exposure and support long-term resilience against evolving cyber threats.

F

Fannie Mae

fanniemae.com

63

The website demonstrates a mixed security posture with no critical vulnerabilities but several high and medium-risk issues that could impact both security and regulatory compliance. Notably, the absence of key GDPR-related elements such as Privacy and Cookie Policies, and a consent banner, exposes the business to potential legal penalties and loss of user trust. Security headers are inadequately configured, increasing susceptibility to common web attacks like cross-site scripting. The lacking information security framework and incident response procedures indicate immature cybersecurity governance, risking delayed or ineffective handling of security incidents. SSL certificate expiration and mixed content issues threaten secure communications, while missing DNSSEC and email authentication elements could allow domain spoofing or phishing attacks. Positively, network security and DNS health are strong, providing a solid foundation. Overall, immediate focus on compliance and security policy establishment is critical to safeguard business operations and reputation.

D

DotLoop LLC

dotloop.com

74

The website demonstrates a generally strong network and email security posture, with high scores in networkSecurity (100/100) and emailSecurity (95/100). However, significant gaps exist in compliance and governance areas, particularly related to GDPR and NIS2 regulations, where scores are notably low (43/100 and 25/100 respectively). Critical business risks stem from missing cookie policies and consent mechanisms, lack of information security frameworks, and absent incident response and business continuity plans. Security headers are partially implemented but lack essential protections like Content-Security-Policy, increasing exposure to web-based attacks. SSL/TLS configurations are good overall but require timely certificate renewal and improved HSTS settings. DNS health is solid but could be enhanced by enabling DNSSEC. Addressing these deficiencies is crucial to mitigate regulatory non-compliance risks, protect customer data, and ensure operational resilience against security incidents.

The website exhibits a moderate security posture with no critical vulnerabilities but several high and medium-risk issues that could expose the business to regulatory, reputational, and operational risks. Key weaknesses include missing crucial security headers like Content-Security-Policy and inadequate GDPR compliance, notably the absence of a cookie policy and consent mechanism. The most significant gaps lie in the lack of foundational NIS2 security governance elements, including no documented security policies, incident response procedures, or vulnerability disclosure policies. While SSL/TLS and network security are relatively strong, mixed content issues and suboptimal HTTP Strict Transport Security (HSTS) configurations reduce overall protection. DNS security is good but could be enhanced by enabling DNSSEC and configuring CAA records. Immediate remediation is especially critical to meet regulatory requirements, protect sensitive user data, and reduce exposure to web-based attacks. The current state may lead to compliance penalties, customer trust erosion, and increased risk of successful cyberattacks if not addressed promptly.

F

Follow Up Boss

followupboss.com

71

The website demonstrates a generally stable security posture with no critical vulnerabilities detected; however, significant gaps exist in compliance and governance areas, particularly GDPR and NIS2 requirements. While foundational network and email security controls are strong, missing security headers and incomplete security policies expose the business to potential data privacy risks and regulatory penalties. The absence of a cookie policy, consent mechanisms, and incident response procedures presents considerable legal and operational risks, especially as data privacy regulations tighten. Insufficient documentation of security frameworks and contact points undermines stakeholder trust and readiness to respond to incidents. Addressing these issues promptly will enhance regulatory compliance, reduce exposure to data breaches, and improve overall security resilience. The organization should prioritize establishing formal security policies, GDPR compliance measures, and incident response capabilities to protect business continuity and reputation. Investment in these areas will mitigate risks of fines, customer dissatisfaction, and operational disruption.

Z

Zillow, Inc.

zillowhomeloans.com

65

The website demonstrates a concerning security posture with significant gaps in fundamental protections and regulatory compliance. While there are no critical vulnerabilities detected, the presence of 11 high and multiple medium-severity issues indicates elevated risk exposure. Key deficiencies include missing essential security headers, lack of GDPR compliance elements such as privacy and cookie policies, and absence of core NIS2 security governance frameworks and incident response protocols. These lapses increase the risk of data breaches, regulatory penalties, and reputational damage. On a positive note, email security and network security configurations are robust, and SSL/TLS and DNS health are relatively strong but still require improvements. Immediate remediation is needed to address regulatory compliance and secure communication headers to reduce attack surfaces. Implementing structured security policies and response plans will enhance resilience and trust with customers and partners.

M

Moving.com

moving.com

67

The website demonstrates a concerning security posture with no critical vulnerabilities but multiple high and medium-risk issues primarily related to missing security headers, inadequate GDPR compliance, and absent information security governance aligned with NIS2 requirements. The lack of key HTTP security headers such as Strict-Transport-Security, X-Frame-Options, and Content-Security-Policy exposes the site to common web attack vectors like clickjacking, man-in-the-middle, and cross-site scripting. GDPR compliance gaps, including missing privacy and cookie policies and consent mechanisms, pose significant legal and reputational risks. Additionally, the absence of documented security policies, incident response plans, and vulnerability disclosure processes reflects immature security governance, increasing operational risk. SSL/TLS and DNS configurations are relatively strong but can be further improved by enabling HSTS and DNSSEC. Email and network security show solid postures, indicating some effective controls are in place. Immediate remediation is crucial to reduce exposure to cyber threats and ensure regulatory compliance, protecting both business assets and customer trust.

This website has 3 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

The website's overall security posture indicates significant vulnerabilities, particularly in DNS health and domain management, which are critical for maintaining online presence and trust. While SSL/TLS implementation is strong, critical DNS resolution failures and domain registration issues present immediate risks of service disruption and potential domain hijacking. Medium-level issues in security headers, GDPR compliance, NIS2 alignment, and email security (notably missing DKIM records) expose the business to regulatory, reputational, and phishing risks. The absence of DNSSEC and CAA records further weakens DNS integrity and certificate issuance security. Network security shows reasonable maturity but needs attention to avoid exploitation. Addressing these concerns promptly will mitigate downtime risks, regulatory penalties, and phishing threats, thereby protecting brand reputation and customer trust. Overall, the business must prioritize DNS and domain management remediation alongside compliance and email security enhancements to strengthen resilience.

This website has 1 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

The website exhibits significant security deficiencies, with three critical issues indicating severe vulnerabilities that could disrupt business operations and expose sensitive data. The most alarming problems are related to DNS health, including DNS resolution failure, absence of name servers, and domain registration issues, which threaten website availability and domain ownership integrity. Additionally, email security is critically weak due to lack of authentication mechanisms like DKIM, increasing risk of phishing and brand impersonation. Medium-level failures in GDPR and NIS2 compliance highlight regulatory risks that could result in legal penalties. While SSL/TLS configuration is robust, the absence of security headers and DNSSEC further weakens defense against common web attacks. Overall, these gaps could damage customer trust, impair service continuity, and lead to regulatory sanctions. Immediate remediation is required to protect the business’s digital presence and ensure compliance with security standards.

This website has 1 high-priority security issue(s) that should be addressed promptly. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

This website has 2 high-priority security issue(s) that should be addressed promptly. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

Q

Quintiles

quintiles.com

96

This website has 6 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

This website has 3 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

B

BPCE

bpce.fr

96

This website has 6 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

B

BforBank

bforbank.com

93

This website has 6 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

B

Buckaroo

buckaroo.nl

91

This website has 8 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

This website has 7 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

E

e-point S.A.

e-point.pl

96

This website has 6 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

I

Immosoft

immosoft.mc

94

This website has 1 high-priority security issue(s) that should be addressed promptly. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

This website has 2 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

The website's overall security posture is solid with no critical or high-risk issues detected, indicating a stable foundation. Key strengths include excellent email security and network security measures, minimizing risks related to phishing and network breaches. However, medium-level concerns such as missing security headers, GDPR and NIS2 compliance failures, mixed content issues, and lack of DNSSEC could expose the business to data privacy violations, regulatory penalties, and man-in-the-middle attacks. Low-risk findings like missing CAA records also suggest room for improvement in DNS configurations. Addressing these medium-priority issues will enhance trust, regulatory adherence, and reduce potential attack vectors. Immediate focus on compliance and secure content delivery will protect both customer data and brand reputation. Overall, the site is secure but requires targeted improvements to align with evolving cybersecurity and regulatory standards.

P

Panaya

panaya.com

98

The website demonstrates a generally strong security posture, with no critical or high-risk vulnerabilities detected. Core areas such as email security, SSL/TLS configurations, and network security are robust, scoring near perfect. However, medium-severity issues related to security headers, GDPR compliance, NIS2 requirements, and DNS health indicate gaps that could expose the business to regulatory risks and potential exploitation. The absence of DNSSEC implementation reduces domain integrity assurance and increases susceptibility to DNS spoofing attacks. Addressing these medium-level findings will enhance overall security resilience and regulatory compliance, reducing potential business disruption and reputational damage. Proactive remediation aligns with industry best practices and emerging regulatory frameworks. Overall, the site is secure but requires targeted improvements to maintain trust and compliance in the evolving threat landscape.

The website demonstrates a generally strong security posture with no critical or high-severity issues detected, reflecting effective baseline security controls. SSL/TLS and network security configurations are robust, scoring 100/100, which helps ensure secure data transmission and resilience against network attacks. However, several medium-severity issues related to compliance and security best practices remain unresolved, including missing security headers, lack of GDPR and NIS2 compliance validation, and DNS security gaps such as absent DNSSEC. Email security is moderate, with a complex SPF record but lacking DKIM signatures, which can increase the risk of email spoofing and phishing. Low-severity issues like missing CAA records indicate room for improvement in certificate management. Addressing these medium-level findings is critical not only to enhance security but also to maintain regulatory compliance and protect brand reputation. Overall, while the site is secure enough to support business operations currently, targeted improvements will reduce risk exposure and strengthen trust with customers and partners.

This website has 7 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

The website demonstrates a moderately secure posture with strong SSL/TLS implementation, reflecting good encryption practices. However, a critical vulnerability is present due to an exposed MySQL service, which significantly increases the risk of unauthorized data access or manipulation. Several medium-level issues, including missing security headers, absence of DNSSEC, and lack of DKIM email authentication, indicate gaps in defense-in-depth strategies and compliance readiness. The failure to meet GDPR and NIS2 analysis standards suggests potential regulatory non-compliance risks that could lead to legal and financial penalties. Additionally, low DNS configuration standards, such as missing CAA records, expose the domain to certificate issuance risks. Overall, while encryption is well-managed, urgent remediation is necessary to protect sensitive data, enhance email security, and ensure regulatory compliance. Addressing these issues will reduce the attack surface and strengthen trust with customers and stakeholders.

The website's security assessment reveals significant risks that could jeopardize business operations and data integrity. Critical issues with DNS health, including DNS resolution failure and domain registration problems, pose immediate threats to website availability and trust. High and medium severity findings such as an unregistered MX record, missing DKIM email authentication, and failure in security headers increase the risk of email spoofing, phishing, and data leakage. Additionally, the lack of GDPR and NIS2 compliance indicates potential regulatory exposure, which could lead to legal penalties and reputational damage. While SSL/TLS configurations are strong, foundational DNS and network security weaknesses undermine overall security posture. Immediate remediation is necessary to ensure operational continuity and maintain customer trust. Addressing these issues will also help meet compliance requirements and reduce the risk of cyberattacks.

The website's security posture reveals significant vulnerabilities with multiple critical and high-risk exposures, particularly in network services and email authentication. While SSL/TLS implementation is strong, foundational security practices such as email authentication, secure network service configuration, and compliance with regulatory standards like GDPR and NIS2 are lacking. The presence of exposed critical services such as Telnet, SMB, and databases without proper protection poses a high risk of unauthorized access and data breaches. Additionally, missing security headers and DNS security features indicate gaps that could be exploited by attackers. Addressing these issues is urgent to safeguard sensitive information, maintain customer trust, and avoid regulatory penalties. Immediate remediation will also improve the organization's overall security maturity and resilience against cyber threats. The current state leaves the business vulnerable to data loss, service disruption, and compliance violations, emphasizing the need for prompt, prioritized action.

The website exhibits a generally stable security posture with no critical or high-level issues detected, indicating a solid foundation in many core areas such as SSL/TLS and network security. However, several medium-level issues related to security headers, GDPR compliance, NIS2 readiness, and DNS health suggest gaps that could expose the business to regulatory, reputational, and operational risks. The absence of key email security mechanisms like DKIM and limited DMARC reporting increases exposure to phishing and email spoofing threats, which could impact customer trust and brand integrity. Additionally, the lack of DNSSEC implementation and missing CAA records weaken domain name system security, potentially allowing DNS-based attacks. While network security and SSL/TLS configurations are strong, addressing these medium and low issues will enhance overall resilience and regulatory compliance. Immediate attention to regulatory frameworks (GDPR, NIS2) is crucial to avoid legal penalties and ensure business continuity. Proactive improvements in email and DNS security will mitigate phishing risks and strengthen trust with partners and customers.

The website demonstrates a generally strong network and SSL/TLS security posture, scoring 100/100 in these areas, which is positive for protecting data in transit. However, significant gaps exist in email security, notably the absence of email authentication protocols such as DKIM and SPF, with the lack of any email authentication marked as a critical issue. Medium-level issues in security headers, GDPR compliance, NIS2 compliance, and DNS health (including missing DNSSEC) indicate potential vulnerabilities in regulatory adherence and domain integrity. The absence of key security headers and DNSSEC could expose the business to attacks like DNS spoofing and reduce trustworthiness. GDPR and NIS2 failures may lead to regulatory penalties and harm customer trust. Overall, while foundational network protections are solid, the business faces risks from email spoofing, regulatory non-compliance, and DNS vulnerabilities that require immediate attention.

The website's overall security posture shows strengths in SSL/TLS configuration and network security, both scoring 100/100, indicating robust encryption and a well-maintained network environment. However, critical vulnerabilities exist in email security, with no email authentication configured and missing DMARC and DKIM records, exposing the business to phishing, spoofing, and reputational damage. DNS health is moderately weak, highlighted by an unregistered MX record and absence of DNSSEC, increasing risks of DNS spoofing and email delivery issues. The lack of security headers and compliance failures in GDPR and NIS2 frameworks further expose the website to potential regulatory penalties and exploitation via web-based attacks. While some medium and low severity issues exist, addressing the high and critical concerns is paramount to safeguarding the brand and customer trust. Immediate remediation of email authentication and DNS misconfigurations will mitigate the highest risks. Overall, the business must prioritize compliance and email security enhancements to reduce exposure and maintain regulatory adherence.

C

Crédit Foncier

creditfoncier.fr

91

This website has 7 security issue(s) identified for improvement. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

This website has 1 high-priority security issue(s) that should be addressed promptly. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

The website demonstrates a generally solid security foundation with perfect scores in SSL/TLS and network security, indicating strong encryption and network controls. However, critical vulnerabilities exist in email security, notably the complete lack of email authentication mechanisms, exposing the business to risks such as email spoofing and phishing attacks. Medium-level issues with missing security headers, GDPR compliance gaps, and NIS2 directive adherence highlight regulatory and operational risks. DNS health is moderately good but lacks DNSSEC and CAA records, which could leave DNS queries vulnerable to tampering. Overall, while network and transport layers are well protected, deficiencies in email authentication, compliance, and header security could lead to reputational damage, legal penalties, and increased attack surface. Immediate remediation of email authentication and compliance issues should be prioritized to mitigate these risks. Strengthening DNS security and implementing security headers will further enhance the website’s resilience to cyber threats and regulatory scrutiny.

The website's overall security posture shows serious vulnerabilities primarily in its DNS infrastructure and compliance frameworks. While email security and SSL/TLS configurations are robust, critical DNS issues such as resolution failures and domain registration problems pose immediate operational and reputational risks. The failure to implement essential security headers and compliance with GDPR and NIS2 regulations exposes the business to potential data breaches and regulatory penalties. Medium-level concerns in network security and missing DNS security extensions further increase the attack surface. Addressing these issues promptly is vital to ensure business continuity, protect customer data, and maintain regulatory compliance. Without remediation, the organization risks service outages, data compromise, and loss of customer trust. Prioritizing DNS health and compliance will substantially improve the overall security posture. A holistic security strategy integrating technical fixes and compliance measures is recommended.

K

KOTA

kota.co.uk

73

The website demonstrates a generally strong network and TLS security posture, with no critical vulnerabilities identified. However, significant gaps exist in GDPR compliance and NIS2 regulatory adherence, which pose legal and operational risks. High-severity issues such as the absence of a cookie policy, consent banner, security framework, incident response procedures, and security policy documentation undermine trust and regulatory standing. Medium-level risks like missing vulnerability disclosure and business continuity plans further amplify potential exposure to cyber threats and operational disruptions. Security headers and email security configurations are moderately implemented but require enhancements for better protection. Immediate focus on compliance and governance frameworks is essential to mitigate regulatory penalties and reputational damage. Addressing these weaknesses will strengthen overall security resilience and ensure alignment with legal requirements.

J

Jason Brooks

jason-brooks.com

56

This website has 12 high-priority security issue(s) that should be addressed promptly. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

B

BMCI

bmci.ma

69

The website demonstrates a generally strong technical security foundation with robust network security, SSL/TLS configurations, and email security. However, significant gaps exist in regulatory compliance, particularly GDPR and NIS2, which present considerable legal and operational risks. Missing privacy and cookie policies, lack of consent mechanisms, and absent security governance documentation indicate insufficient organizational controls. Security headers are partially implemented but require enhancements to mitigate common web-based attacks. The absence of incident response and business continuity planning exacerbates potential downtime and breach impact. Addressing these deficiencies is critical to maintain customer trust, avoid regulatory penalties, and strengthen overall risk management. Prioritizing compliance and governance reforms will align security posture with legal requirements and industry best practices. Immediate remediation will reduce exposure to data privacy violations and operational disruptions.

The website demonstrates a generally strong foundation in network security, SSL/TLS implementation, and email security, reflected by high module scores in these areas. However, critical weaknesses exist in GDPR compliance and NIS2 regulatory adherence, posing significant legal and operational risks, especially for EU business operations. Missing privacy and cookie policies, lack of cookie consent mechanisms, and inadequate privacy measures expose the business to potential fines and reputational damage. The absence of an information security framework, incident response plans, and documented security policies undermines the organization's ability to manage and respond to security incidents effectively. Additionally, some security headers and DNS configurations are incomplete, which could increase exposure to data leakage and DNS-based attacks. Immediate remediation in privacy compliance and governance documentation is essential to mitigate regulatory risks and enhance trust with customers and partners. Overall, while technical defenses are strong, governance and compliance gaps represent the most pressing concerns for business continuity and legal compliance.

S

Swissquote

swissquote.ch

74

The website demonstrates a generally strong technical security foundation, with excellent SSL/TLS, network security, and DNS health scores. However, significant gaps exist in compliance with GDPR and NIS2 regulations, indicated by missing privacy and cookie policies, absence of consent mechanisms, and lack of documented security and incident response procedures. These deficiencies expose the business to regulatory risks, potential fines, and reputational damage, especially in regions governed by GDPR and NIS2 mandates. While some medium severity issues like missing X-XSS-Protection header and lack of DKIM records impact security, the primary concern is the absence of governance frameworks and policies. Addressing these will not only reduce compliance risk but also improve overall security posture and stakeholder trust. Immediate prioritization of privacy compliance and formal security documentation is critical to align with legal obligations and industry best practices. The organization's proactive network and SSL/TLS configurations provide a solid base to build upon. Overall, the security posture is solid technically but requires urgent policy and compliance enhancements to mitigate business risks effectively.

The website demonstrates a generally strong network security posture and good email security measures, but critical gaps exist in compliance and governance areas, particularly relating to GDPR and NIS2 requirements. The absence of a cookie policy and consent banner exposes the business to regulatory non-compliance risks and potential fines under GDPR. Key documentation and procedures such as incident response, security policies, and business continuity planning are missing, which heightens operational and security risks. SSL certificate expiry is imminent, threatening site availability and user trust. DNS configuration weaknesses, including an unregistered MX record and lack of DNSSEC, increase exposure to email spoofing and DNS attacks. While security headers are mostly in place, missing permissions-policy headers could allow unnecessary resource access. Overall, the security posture requires urgent attention to governance, compliance, and certificate management to mitigate legal, reputational, and operational risks.

D

Die neue Dimension der Geldanlage-Investieren in eine digitale Zukunft

superfund.de

51

The website's security posture is currently weak, with significant deficiencies across multiple critical areas including privacy compliance, email authentication, and security policy frameworks. Critical gaps in GDPR adherence expose the business to regulatory penalties and reputational damage, especially given its EU operations without adequate privacy measures. The absence of key HTTP security headers leaves the site vulnerable to common web-based attacks such as clickjacking, content injection, and cross-site scripting. Email infrastructure lacks essential authentication mechanisms, increasing risks of phishing and email spoofing. Additionally, missing incident response and security documentation undermines the organization’s ability to detect, respond to, and recover from security incidents effectively. While SSL/TLS and DNS configurations are relatively stronger, urgent attention is needed to enable HSTS and extend certificate validity. Overall, this assessment reveals a pressing need to implement foundational security controls and compliance policies to safeguard the business and its customers. Failure to address these issues promptly could result in severe operational, financial, and legal consequences.

D

Die neue Dimension der Geldanlage-Investieren in eine digitale Zukunft

superfund.at

57

The website's security posture is currently weak, with critical and high severity issues impacting key areas such as privacy compliance, security headers, and information security management. Notably, the absence of essential security headers like Strict-Transport-Security and Content-Security-Policy leaves the site vulnerable to man-in-the-middle attacks, clickjacking, and cross-site scripting. GDPR compliance is critically lacking, with no privacy or cookie policies and no consent mechanisms, exposing the business to regulatory fines and reputational damage. Furthermore, the lack of a formal information security framework, incident response procedures, and security policy documentation undermines the organization's ability to manage and respond to cyber threats effectively. While email security, SSL/TLS, DNS health, and network security score moderately well, imminent SSL certificate expiration and missing DNSSEC are concerns. Overall, urgent remediation is required to reduce legal, operational, and cybersecurity risks. Implementing prioritized controls will strengthen defenses, ensure regulatory compliance, and protect customer trust.

E

Egnyte

egnyte.com

76

The website exhibits a generally strong security posture in network security, SSL/TLS configuration, and email security, scoring near or at 100 in these areas. However, significant gaps exist in compliance with GDPR and NIS2 requirements, leading to low scores of 43 and 25 respectively. Critical business risks stem from missing cookie policies and consent mechanisms, absence of an information security framework, and lack of incident response procedures, which expose the organization to regulatory penalties and operational disruptions. Security headers are mostly implemented but lack some key controls that could reduce exposure to information leakage. DNS health is adequate but can be improved by enabling DNSSEC to prevent domain spoofing. Overall, the website is secure from common network and transport layer attacks but vulnerable to regulatory compliance violations and incident management deficiencies, which could impact business reputation and continuity.

B

Bonpoint

bonpoint-vintage.com

65

The website demonstrates a generally good network security posture and strong email and DNS configurations, but significant gaps exist in privacy compliance and foundational security frameworks. Critical GDPR compliance issues, such as missing privacy and cookie policies and lack of consent mechanisms, present considerable legal and reputational risks. The absence of a documented information security framework, incident response, and business continuity planning under NIS2 further exposes the organization to operational disruptions and regulatory penalties. Weaknesses in SSL/TLS configurations, including weak key lengths and certificates nearing expiration, increase vulnerability to interception and compromise. Security headers are partially configured but lack completeness, potentially allowing certain attack vectors. Overall, the current security posture leaves the business exposed to compliance violations, potential data breaches, and operational risks that could harm customer trust and incur financial penalties. Immediate remediation focusing on compliance and foundational security policies will substantially mitigate these risks and improve resilience.

B

Black Bull Group

blackbull-group.com

60

The website's security posture reveals significant gaps that expose the business to potential cyber risks and regulatory non-compliance. While there are no critical vulnerabilities, several high and medium-level issues, particularly in security headers, GDPR compliance, and network security, present serious concerns. Missing essential HTTP security headers increases exposure to web-based attacks such as clickjacking, content injection, and cross-site scripting. The absence of privacy and cookie policies, alongside missing cookie consent mechanisms, risks violating data protection regulations like GDPR, potentially resulting in legal penalties and reputational damage. Additionally, the lack of incident response procedures and vulnerability disclosure policies hampers the organization's ability to effectively manage and recover from security incidents. The exposure of high-risk services like FTP further elevates the threat landscape. Overall, immediate remediation is essential to enhance security posture, protect customer data, and ensure regulatory compliance to safeguard business continuity and trust.

The website exhibits a moderate overall security posture with no critical vulnerabilities detected but several high and medium-risk issues that require immediate attention. GDPR compliance is notably weak, scoring 43/100, primarily due to the absence of a cookie policy and consent banner, exposing the business to regulatory risks and potential fines. The NIS2 compliance score is critically low at 25/100, reflecting significant gaps in information security governance, incident response, and security documentation, which could impair the organization’s ability to manage cyber threats and regulatory obligations. Security headers and email security are average but have room for improvement to mitigate common web and email-based attacks. SSL/TLS and DNS configurations are generally strong, but mixed content and missing DNSSEC reduce overall protection. Network security posture is excellent, indicating robust infrastructure defenses. Immediate remediation will reduce legal liability, enhance trust with customers, and strengthen the organization's resilience against cyber threats.