Security Directory

G

Gruppo Santa Devota

santadevota.it

59

The website exhibits significant security gaps, particularly in privacy compliance, email authentication, and core security policies, posing substantial risks to business reputation and regulatory adherence. Critical issues in GDPR compliance and email authentication indicate exposure to legal penalties and phishing attacks. Missing key security headers and lack of incident response and business continuity plans reflect immature security governance. While network and DNS health are relatively strong, foundational security controls such as HSTS and DNSSEC require enhancement. The low scores in GDPR and NIS2 modules highlight urgent needs for privacy policies and security frameworks. Immediate remediation is necessary to reduce vulnerability exposure and align with regulatory requirements. Overall, the security posture is weak and demands prioritized, strategic improvements to protect customer data and maintain trust.

S

Sky TG24

skytg24.it

66

The website demonstrates a strong foundational security posture in network security and SSL/TLS configurations, scoring 100 and 97 respectively. However, critical gaps exist in privacy compliance and email security, with GDPR adherence scoring only 15/100 and email security at 75/100. Notably, absence of a Privacy Policy, Cookie Consent Banner, and proper email authentication expose the business to regulatory fines and reputational damage. The lack of information security frameworks and incident response procedures under the NIS2 directive also presents significant operational risks. Medium to high severity issues with security headers and DNS configurations further increase exposure to common web-based attacks. Immediate remediation on privacy and incident management controls is essential to maintain trust and comply with EU regulations. Overall, while technical network defenses are solid, governance, compliance, and email security require urgent attention to reduce business risk.

S

Site not installed - OVHcloud

eurassur.mc

67

The website demonstrates significant security and compliance gaps that expose the business to potential data breaches, regulatory penalties, and reputational damage. While no critical vulnerabilities were found, the presence of multiple high-severity issues, especially missing key security headers and lack of GDPR and NIS2 compliance documentation, indicates a weak security posture. The absence of a Privacy Policy, Cookie Policy, and consent mechanisms could lead to legal challenges under data protection laws. Additionally, missing incident response and security policies increase operational risk during security events. SSL/TLS and DNS configurations are moderately strong but require attention to maintain trust and secure communications. Email and network security are well managed, reflecting some positive controls in place. Immediate remediation is essential to reduce business risk and ensure regulatory compliance.

The website demonstrates a generally strong network and email security posture but has significant gaps in critical security and compliance areas. Notably, the absence of a Content-Security-Policy header and weak HTTP security headers increase exposure to common web attacks. Compliance deficiencies related to GDPR, such as missing privacy and cookie policies and consent mechanisms, present legal and reputational risks. The lack of documented information security frameworks, incident response plans, and security policies under NIS2 requirements further heightens operational vulnerabilities. While SSL/TLS and DNS configurations are mostly adequate, some improvements are needed to maintain trust and secure communications. Overall, the current security posture exposes the business to regulatory penalties, data breaches, and service interruptions. Addressing these issues promptly will strengthen compliance, reduce risk, and protect customer trust.

K

Koroyd

koroyd.com

50

The website's overall security posture is currently poor, with critical vulnerabilities that expose the business to significant risks including data breaches and regulatory non-compliance. The absence of HTTPS encryption is a critical flaw, undermining user data confidentiality and trust, while also violating GDPR and NIS2 requirements. Key security headers are missing, increasing the risk of cross-site scripting and data leakage. GDPR compliance is severely lacking, with no cookie policy or consent mechanism, risking legal penalties and reputational damage. The lack of documented security policies, incident response, and business continuity plans highlights operational weaknesses. Email and DNS security are relatively strong, but gaps remain that could be exploited. Immediate remediation is essential to protect customer data, maintain regulatory compliance, and safeguard business continuity. Without urgent corrective actions, the business faces increased risk of cyber incidents and legal consequences.

U

UPS Supply Chain Solutions

ups-scs.com

50

The website's overall security posture is currently poor and exposes the business to significant risks, particularly in data protection and regulatory compliance. The absence of HTTPS encryption is a critical vulnerability affecting confidentiality and trust, simultaneously violating GDPR and NIS2 requirements. Key policies and procedures related to information security, incident response, and privacy are missing, which undermines the organization's ability to manage security events and comply with legal obligations. While network security and DNS health scores are relatively strong, foundational security controls such as security headers and cookie management are insufficient. The lack of GDPR compliance, including missing privacy and cookie policies and consent mechanisms, poses legal and reputational risks. Email security is reasonably well implemented but can be further improved. Immediate remediation is needed to protect sensitive data, ensure regulatory compliance, and maintain customer trust. Without these improvements, the business risks data breaches, regulatory penalties, and damage to its brand reputation.

I

Indosuez Wealth Management

ca-indosuez.fr

43

The website's overall security posture is critically weak and exposes the business to significant risks, particularly regarding data protection and regulatory compliance. The absence of HTTPS encryption is a critical vulnerability affecting GDPR, NIS2, and SSL/TLS compliance, jeopardizing user data confidentiality and trust. Key security headers are missing or poorly configured, increasing exposure to web-based attacks such as clickjacking and cross-site scripting. The lack of a cookie policy and consent mechanisms indicates non-compliance with GDPR, which could lead to legal penalties and reputational damage. Furthermore, the absence of essential NIS2 security policies, such as incident response and security documentation, suggests insufficient organizational security governance. DNS and email security configurations reveal gaps that could enable phishing or spoofing attacks. While network security posture is good, the overall lack of fundamental protections necessitates urgent remediation to safeguard the business and meet regulatory requirements.

J

Just a moment...

3dconnexion.com

50

The website's overall security posture is currently weak, with critical vulnerabilities that expose the business to significant risks including data breaches, regulatory fines, and reputational damage. Most notably, the absence of HTTPS encryption is a severe flaw, undermining all data transmissions and violating GDPR and NIS2 compliance requirements. Key security headers such as Strict-Transport-Security and Content-Security-Policy are missing, increasing the risk of man-in-the-middle attacks and cross-site scripting. GDPR compliance is poor due to missing privacy and cookie policies and the lack of a consent banner, risking legal penalties. The organization also lacks fundamental information security frameworks, policies, and incident response procedures, indicating immature security governance. However, email security and network security show relatively strong postures, which is a positive foundation to build upon. Immediate remediation is critical to prevent exploitation and align with regulatory mandates. Investing in HTTPS encryption and comprehensive security policies will deliver the highest immediate business value by reducing risk and improving customer trust.

S

Stéphane-Alexandre Dani

art-dani.com

42

The website's current security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and reputation damage. The absence of HTTPS encryption is the most severe vulnerability, undermining all data confidentiality and integrity guarantees. Key security headers like Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options are missing, increasing the risk of web-based attacks such as clickjacking, cross-site scripting, and content injection. The lack of GDPR compliance elements including Privacy Policy, Cookie Policy, and consent mechanisms places the company at risk for legal penalties and customer trust erosion. Additionally, the absence of foundational NIS2 security governance documents such as incident response and security policies further weakens organizational readiness against cyber threats. While network security and DNS health show relatively strong posture, critical gaps in SSL/TLS and email security remain. Immediate action is required to remediate these high and critical issues to protect customer data, comply with regulations, and maintain business continuity.

C

Crédit Agricole

credit-agricole.com

52

The website exhibits serious security deficiencies, particularly the complete absence of HTTPS encryption, which critically exposes data in transit and undermines user trust. Compliance with GDPR and NIS2 regulations is severely lacking, with missing cookie policies, consent mechanisms, and essential security governance documentation, posing significant legal and operational risks. While network security and email security demonstrate relatively strong postures, foundational issues around encryption and policy frameworks significantly elevate the organization's exposure to data breaches and regulatory penalties. Security headers and DNS configurations are suboptimal but less urgent relative to the critical gaps. Immediate remediation is necessary to protect customer data, maintain regulatory compliance, and uphold the organization's reputation. Without urgent action, the business remains vulnerable to interception, data leakage, and potential loss of customer confidence. Prioritizing HTTPS implementation alongside privacy and incident response policies will substantially improve the security stance. Overall, the current posture demands urgent attention to align with industry best practices and regulatory mandates.

I

IQVIA

imshealth.com

50

The website's security posture currently exhibits significant vulnerabilities that pose notable risks to business operations and customer trust. Most critically, the absence of HTTPS encryption exposes all data transmissions to interception and manipulation, violating GDPR and NIS2 compliance requirements and potentially leading to regulatory penalties. The lack of fundamental privacy policies and cookie consent mechanisms further threatens legal compliance and customer confidence. Additionally, missing core security governance elements such as incident response, security policies, and vulnerability disclosure indicate a weak security management framework. While network and email security show strengths, critical gaps in web security headers and DNS configurations leave attack surfaces open. Immediate remediation is essential to prevent data breaches, reputational damage, and compliance failures. Overall, the website needs a prioritized security overhaul to align with industry standards and regulatory mandates.

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is the most severe issue, undermining data confidentiality and integrity across all communications. Multiple missing security headers further increase vulnerability to common web attacks such as clickjacking, cross-site scripting, and MIME-type sniffing. The lack of GDPR compliance components such as privacy policies, cookie policies, and consent mechanisms exposes the business to legal penalties and erodes customer trust. Additionally, there is no evidence of adherence to the NIS2 cybersecurity directive, with critical gaps in incident response, security policies, and business continuity planning. Email security is insufficient, lacking proper authentication configurations which increase the risk of phishing and spoofing attacks. Although network security and DNS health are relatively strong, these alone do not mitigate the critical weaknesses present. Immediate remediation is required to protect sensitive customer data, maintain regulatory compliance, and safeguard the company’s brand reputation.

A

APM Monaco

apm.mc

50

The website's overall security posture is currently weak, with critical vulnerabilities severely impacting confidentiality and compliance. The absence of HTTPS encryption is a critical failure affecting GDPR, NIS2, and SSL/TLS compliance, exposing all data in transit to interception and undermining customer trust. Governance issues are apparent, with no documented security or incident response policies and missing GDPR-required cookie policies and consent mechanisms. While network security and DNS health show strengths, critical gaps in email security enforcement and security headers remain. The poor NIS2 and GDPR compliance scores highlight significant regulatory risk, potentially leading to legal penalties and reputational damage. Addressing these issues is urgent to protect customer data, ensure business continuity, and maintain regulatory compliance. The current state exposes the business to data breaches, legal fines, and loss of customer confidence. Immediate remediation efforts on encryption, policies, and user privacy controls are imperative to improve security posture and business resilience.

The website's overall security posture is currently poor, with multiple critical and high-severity vulnerabilities that expose the business to significant risks. The absence of HTTPS encryption is the most critical issue, compromising data confidentiality and user trust, and violating GDPR and NIS2 regulations. Key security headers like Strict-Transport-Security and Content-Security-Policy are missing, increasing susceptibility to common web attacks such as man-in-the-middle and cross-site scripting. GDPR compliance is severely lacking, with no cookie policy or consent mechanisms, risking regulatory fines and reputational damage. The organization also lacks essential information security frameworks, incident response plans, and security documentation, undermining its ability to manage and respond to security incidents effectively. Email security and network security show relatively better posture but still require improvements. Immediate remediation is necessary to protect sensitive data, maintain regulatory compliance, and uphold customer trust. Without addressing these critical gaps, the business faces elevated risks of data breaches, legal penalties, and operational disruptions.

D

Doro AB

doro.com

42

The website's overall security posture is currently weak, with critical deficiencies in fundamental protections such as HTTPS encryption and key security headers. The absence of HTTPS impacts user trust, data confidentiality, and regulatory compliance, exposing the business to significant legal and reputational risks. GDPR compliance is notably poor, lacking essential elements like cookie policies and consent mechanisms, which could result in heavy fines and customer distrust. The NIS2-related security framework and incident response processes are missing, increasing vulnerability to cyber threats and potential operational disruptions. While email security and network infrastructure show moderate to strong performance, critical gaps in web and application-layer security jeopardize the entire environment. Immediate remediation is essential to protect sensitive customer data, maintain compliance, and safeguard business continuity. Failure to address these issues promptly could lead to data breaches, regulatory penalties, and loss of customer confidence. Overall, the current state demands urgent and prioritized security improvements to align with industry standards and legal requirements.

L

London Property Investments

londonpropertyinvestments.com

45

The website's overall security posture is critically weak, with multiple high and critical severity issues primarily related to missing HTTPS encryption and key security headers. The absence of HTTPS encryption exposes all data transmissions to interception and tampering, representing a severe risk to user privacy and business integrity. Compliance with GDPR and NIS2 regulations is insufficient, posing potential legal and regulatory consequences, including fines and reputational damage. Security governance gaps such as missing incident response procedures, security policies, and vulnerability disclosure processes further increase organizational risk. While network security and email security show relatively stronger postures, foundational web security controls and privacy safeguards are lacking. Immediate remediation is required to protect customer data, maintain trust, and ensure regulatory compliance. The company must prioritize establishing a secure HTTPS environment and implementing critical HTTP security headers. Addressing these issues will significantly reduce the risk of cyberattacks and data breaches that could disrupt business operations and harm the brand reputation.

L

La Poste

laposte.fr

42

The website's overall security posture is critically deficient, exposing the business to substantial legal, operational, and reputational risks. Key vulnerabilities include the complete lack of HTTPS encryption, missing essential HTTP security headers, and non-compliance with GDPR regulations, which is especially concerning for EU-based operations. The absence of documented information security policies, incident response procedures, and business continuity planning further exacerbates the risk landscape. While email security and network security show relatively stronger performance, critical gaps remain in website security and regulatory compliance. This exposes the business to data breaches, regulatory penalties, and loss of customer trust. Immediate remediation is vital to protect sensitive data, ensure compliance, and maintain operational resilience. Addressing these issues will also enhance the company’s credibility and customer confidence in digital interactions. Without urgent action, the company risks severe financial and legal consequences alongside potential business disruption.

R

RUDDER

rudder.mc

45

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and service disruptions. The absence of HTTPS encryption is a fundamental flaw affecting confidentiality, data integrity, and customer trust. Critical gaps in security headers and missing privacy and cookie policies risk exploitation and legal penalties, especially under GDPR and NIS2 regulations. Lack of documented security policies, incident response plans, and vulnerability disclosure processes further hampers the organization's ability to effectively detect and respond to cyber threats. Exposure of high-risk services like FTP and SSH increases the attack surface, potentially enabling unauthorized access. Although email security and DNS health are relatively strong, these cannot offset foundational vulnerabilities. Immediate remediation is essential to protect sensitive data, ensure compliance, and maintain customer confidence. Without prompt action, the business faces risks of financial loss, reputational damage, and regulatory sanctions.

This website has 1 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

M

MINDUS

mindus.co

50

The website exhibits a concerning overall security posture with several critical vulnerabilities, primarily the complete lack of HTTPS encryption, which exposes user data to interception and undermines trust. Compliance with GDPR and NIS2 regulations is severely lacking, especially regarding cookie management, data protection policies, and incident response readiness, which poses significant legal and reputational risks. Security header configurations are weak or missing, increasing susceptibility to common web attacks such as cross-site scripting and clickjacking. Although network security and email security measures are relatively strong, foundational elements like HTTPS and security policy documentation are absent. The absence of an information security framework and business continuity planning further endangers operational resilience. Immediate remediation is critical to protect sensitive data, ensure regulatory compliance, and maintain customer confidence. Without urgent improvements, the organization risks data breaches, regulatory penalties, and loss of business continuity.

I

Indigo Books & Music Inc.

indigo.ca

54

The website's overall security posture reveals significant critical vulnerabilities, notably the complete absence of HTTPS encryption, which exposes data in transit to interception and compromises user trust. Compliance-related deficiencies are severe, with extremely low GDPR and NIS2 scores indicating non-compliance risks that could result in substantial regulatory penalties and reputational damage. While network security and email security are relatively strong, foundational security controls such as security headers are only moderately implemented and require improvement. The lack of formal security policies, incident response procedures, and vulnerability disclosure mechanisms further amplifies the organization's risk exposure. Additionally, missing cookie consent mechanisms and privacy policy issues threaten legal compliance with data protection laws. DNS health is good but can be enhanced by enabling DNSSEC to prevent DNS spoofing attacks. Immediate remediation is essential to protect sensitive user data, ensure regulatory compliance, and maintain business continuity.

G

Gucci

gucci.com

53

The website's overall security posture is currently poor, primarily due to critical gaps in fundamental security controls such as the absence of HTTPS encryption and essential security headers. This exposes the business to significant risks including data interception, non-compliance with GDPR and NIS2 regulations, and reputational damage. The lack of a cookie consent banner and GDPR-compliant privacy policies further amplify legal exposure. Additionally, key governance elements like incident response, security policies, and vulnerability disclosure are missing, indicating immature security management. While network security and email configurations are relatively strong, they cannot compensate for the critical deficiencies in encryption and compliance. Immediate remediation is necessary to protect sensitive user data, ensure regulatory compliance, and maintain customer trust. Addressing these issues will also reduce potential financial liabilities stemming from data breaches or regulatory penalties.

O

Oracle Applications & Technology Users Group

oaug.org

40

The website exhibits a severely weak security posture with multiple critical vulnerabilities that expose the business to significant risk including data breaches, regulatory penalties, and service disruptions. The absence of HTTPS encryption across the site is a fundamental flaw, compromising data confidentiality and integrity while violating GDPR and NIS2 requirements. Critical services like MySQL and FTP are exposed, increasing the attack surface and risk of unauthorized access. Key security headers are missing, leaving users vulnerable to clickjacking and cross-site scripting attacks. The lack of GDPR compliance measures such as privacy policies and cookie consent mechanisms exposes the company to legal and reputational risks. Additionally, the absence of an information security framework, incident response plans, and security policies indicates poor organizational cybersecurity maturity. Email security is moderately strong but insufficient to offset the broader systemic issues. Immediate remediation is essential to protect business operations, customer trust, and regulatory compliance.

F

FIPARC

fiparc.fr

46

The website exhibits significant security weaknesses, particularly in encryption, privacy compliance, and security governance, which pose substantial risks to business operations and customer trust. The absence of HTTPS encryption is a critical vulnerability affecting data confidentiality and regulatory compliance, especially for EU customers under GDPR. Privacy policies and cookie consent mechanisms are missing, exposing the business to legal penalties and reputational damage. Security headers are inadequately configured, increasing susceptibility to common web attacks such as cross-site scripting. The lack of a formal information security and incident response framework demonstrates immature security governance, potentially delaying breach detection and response. While network security and email protections score relatively well, critical gaps in NIS2 compliance and data protection remain. Immediate remediation is needed to secure communications, ensure regulatory adherence, and establish foundational security policies. Addressing these issues will protect business continuity, customer data, and brand reputation.

D

Dexlab.io

dexlab.io

43

The website exhibits a severely weak security posture with multiple critical vulnerabilities that expose the business to significant risks, including data breaches, regulatory penalties, and reputational damage. The complete lack of HTTPS encryption is a critical failure impacting user data confidentiality and trust. Missing essential security headers such as Content-Security-Policy and X-Frame-Options further increase exposure to web-based attacks. Non-compliance with GDPR requirements, including absent privacy and cookie policies and consent mechanisms, poses legal and financial risks. The absence of any formal information security framework, incident response, and business continuity planning undermines operational resilience and incident management. While network security and email security show relatively better results, key gaps like missing DKIM records and DNSSEC reduce overall trustworthiness. Immediate remediation is required to protect customer data, meet regulatory obligations, and safeguard business continuity.

B

Bank of America

ml.com

49

The website's overall security posture is currently at high risk, with multiple critical and high-severity issues identified. The absence of HTTPS encryption is a critical vulnerability that exposes all data transmissions to interception, significantly undermining confidentiality and trust. GDPR compliance is severely lacking, with missing cookie policies and consent mechanisms, which may lead to legal and regulatory penalties. The lack of essential security headers increases the risk of common web attacks such as clickjacking and cross-site scripting. Additionally, the absence of fundamental NIS2 security governance elements, including incident response and security policies, indicates a weak organizational security framework. While DNS and network security are relatively strong, the critical gaps in application-layer security and compliance pose significant business risks. Immediate remediation is necessary to protect customer data, maintain regulatory compliance, and preserve brand reputation. Without urgent action, the business faces potential data breaches, regulatory fines, and erosion of customer trust.

A

AppList Media

applistmedia.com

41

The website exhibits a severely deficient security posture with multiple critical vulnerabilities, most notably the complete lack of HTTPS encryption, exposing all data in transit to interception and manipulation. The absence of foundational security headers and policies increases susceptibility to common web attacks such as clickjacking, content sniffing, and cross-site scripting. Compliance with GDPR and NIS2 regulations is substantially lacking, risking legal penalties and reputational damage due to missing privacy policies, cookie consent mechanisms, and security governance documentation. Email security mechanisms like DMARC and DKIM are partially implemented but not enforced, increasing phishing risks. While network security and DNS health appear relatively robust, the critical gaps in secure communication and regulatory adherence overshadow these strengths. Immediate remediation is essential to protect customer data, maintain trust, and ensure regulatory compliance. Failure to act promptly could result in data breaches, regulatory fines, and loss of customer confidence.

S

SwissBorg

swissborg.com

53

The website exhibits a severely weak security posture with critical deficiencies in fundamental areas such as HTTPS encryption, GDPR compliance, and adherence to NIS2 cybersecurity directives. Absence of HTTPS encryption exposes data in transit to interception, posing significant risks to user privacy and trust. The lack of cookie policy and consent mechanisms highlights potential legal non-compliance risks under GDPR, increasing exposure to regulatory penalties. Security governance is notably inadequate, with missing incident response, vulnerability disclosure, and security policy documentation, creating vulnerabilities to cyber threats and operational disruptions. While network and email security appear strong, critical gaps in security headers and DNS configurations further weaken defenses. Immediate remediation is essential to protect customer data, maintain regulatory compliance, and uphold the organization’s reputation. Without swift action, the business faces increased risk of data breaches, legal liabilities, and loss of customer confidence.

T

TC Stratégie Financière (TCSF)

tcsf.mc

47

The website’s overall security posture is critically weak, with multiple fundamental issues exposing the business to significant risks. The absence of HTTPS encryption is a critical vulnerability affecting confidentiality, integrity, and trust, impacting compliance with GDPR and NIS2 regulations. Key security headers are missing or misconfigured, increasing the risk of web-based attacks such as clickjacking and cross-site scripting. Additionally, the lack of privacy and cookie policies, along with no cookie consent mechanism, exposes the business to regulatory fines and reputational damage under data protection laws. The absence of formal information security frameworks, incident response plans, and business continuity procedures further increases operational risk. While email security and network security show relatively better scores, the critical gaps in foundational web and regulatory compliance controls must be urgently addressed. Immediate remediation of HTTPS, security policies, and compliance documentation is essential to reduce legal and security risks. Overall, the business should prioritize establishing a robust security baseline aligned with regulatory mandates to protect customers and organizational assets.

F

Ferrari

ferrari.com

60

The website's overall security posture reveals critical vulnerabilities that pose significant business risks, particularly the absence of HTTPS encryption, which undermines data confidentiality and user trust. Compliance with GDPR and NIS2 regulations is substantially lacking, exposing the business to potential legal penalties and reputational damage. While network security and email security measures are strong, critical gaps in security governance, incident response, and data protection frameworks leave the organization vulnerable to cyber threats and compliance violations. Low-scoring GDPR and NIS2 modules indicate urgent need for policy, procedural, and technical controls improvements. The presence of weak referrer policies and caching sensitive data further increase the risk of information leakage. Without immediate remediation, these issues could lead to data breaches, regulatory fines, and erosion of customer confidence. Prioritizing encryption, compliance measures, and incident management will be essential to strengthening the security posture and safeguarding business interests.

B

Banque Européenne du Crédit Mutuel

becm.fr

49

The website's current security posture presents significant risks that could severely impact business operations and regulatory compliance. Critical issues such as the absence of HTTPS encryption and inadequate privacy measures for an EU business expose the company to data breaches, legal penalties, and loss of customer trust. The failure to implement essential GDPR requirements, including privacy and cookie policies and consent mechanisms, increases the risk of non-compliance fines. Additionally, the lack of an information security framework, security policies, and incident response procedures under the NIS2 directive further exacerbates vulnerability to cyber threats and operational disruptions. While network security and DNS health show relatively strong scores, foundational security controls like content security policies and email authentication need improvement. Overall, the organization must urgently address these critical gaps to safeguard customer data, maintain regulatory compliance, and protect brand reputation. Without prompt remediation, the business is exposed to severe financial, legal, and reputational risks.

B

Banque Palatine

palatine.fr

47

The website's security posture exhibits significant critical vulnerabilities, particularly the absence of HTTPS encryption, which poses severe risks to data confidentiality and regulatory compliance. Critical GDPR compliance gaps, including missing privacy and cookie policies and lack of a cookie consent banner, expose the business to potential legal penalties and reputational damage within the EU market. The lack of foundational security policies and incident response procedures further increases operational risk and undermines stakeholder trust. While network security measures appear strong, key headers like X-Frame-Options are missing, increasing susceptibility to clickjacking attacks. Email security and DNS configurations are moderately sound but can be improved to prevent phishing and DNS spoofing threats. Overall, the current state demands urgent remediation to secure customer data, ensure compliance with regulations such as GDPR and NIS2, and protect the business from cyber threats and legal consequences. Addressing these issues promptly will safeguard the organization’s reputation and maintain customer trust.

E

Eve Media

evemedia.fr

40

The website's security posture is critically weak, exposing the business to significant cybersecurity risks and regulatory non-compliance. Key deficiencies include the complete absence of HTTPS encryption, which jeopardizes data confidentiality and integrity in transit, and missing fundamental security headers that protect against common web attacks. The lack of GDPR compliance, such as no privacy or cookie policies and no consent mechanisms, places the business at risk of severe legal penalties, especially as it operates within the EU. Additionally, there is no established information security framework, incident response plan, or security policy documentation, which undermines the organization's ability to manage and respond to security incidents effectively. Email authentication is also poorly configured, increasing the likelihood of phishing attacks and email spoofing. While the network security posture and DNS health show some strengths, these are overshadowed by critical systemic vulnerabilities. Immediate remediation is essential to protect customer data, maintain trust, and comply with regulatory requirements.

The website's security posture is currently weak and exposes the business to significant risks, particularly due to the absence of HTTPS encryption, which is flagged as a critical vulnerability across multiple modules. Compliance with GDPR and NIS2 regulations is severely lacking, with missing privacy policies, cookie consent mechanisms, and critical security governance documentation, increasing legal and operational risks. While network security measures are strong, foundational issues like missing security headers and insufficient email authentication mechanisms exist. The lack of an incident response plan and business continuity strategy could lead to prolonged downtime or data breaches. DNS security is moderate but can be improved by enabling DNSSEC and configuring CAA records. Overall, urgent remediation is required to protect sensitive customer data, maintain regulatory compliance, and uphold business reputation. Immediate attention to encryption, privacy policies, and security governance will have the highest impact. This situation presents both compliance and reputational risks that could result in fines, customer loss, and operational disruptions if not addressed promptly.

A

Adecco

adecco.com

58

The website's overall security posture is concerning, particularly due to the complete lack of HTTPS encryption, which is critical for protecting data in transit and compliance with GDPR and NIS2 regulations. While network security and email security show strong performance, the absence of key security frameworks, policies, and procedures exposes the business to regulatory penalties and increased cyber risk. GDPR compliance is notably weak, with no cookie consent banner and potentially non-compliant privacy policies, risking legal consequences and reputational damage. The failure to implement incident response and business continuity planning further undermines the organization's resilience to cyber incidents. Low scores in the NIS2 domain highlight significant gaps in governance and operational security controls. Immediate remediation is required to secure customer data, meet regulatory obligations, and maintain trust. Addressing the critical HTTPS and security policy deficiencies will significantly improve the security posture and reduce business risks.

C

Case Scenario

case-scenario.com

42

The website's overall security posture is critically deficient, with multiple severe vulnerabilities posing substantial risks to business operations and customer trust. The absence of HTTPS encryption is a fundamental flaw, exposing all data transmissions to interception and undermining GDPR and NIS2 compliance. Critical security headers like Content-Security-Policy and X-Frame-Options are missing, increasing susceptibility to cross-site scripting and clickjacking attacks. There is a complete lack of documented security policies, incident response, and business continuity planning, which jeopardizes organizational readiness for cyber incidents. GDPR compliance is notably poor with missing privacy and cookie policies, as well as absence of consent mechanisms, risking regulatory penalties. Despite strong network security and good DNS health, these strengths are overshadowed by the critical gaps in encryption and governance. Immediate remediation is essential to protect sensitive data, maintain regulatory compliance, and preserve brand reputation. Without urgent action, the business faces elevated risks of data breaches, legal consequences, and loss of customer confidence.

The website demonstrates a moderate overall security posture with no critical vulnerabilities detected, but several high and medium risk issues pose significant compliance and operational risks. Key deficiencies exist in GDPR compliance, including absence of privacy and cookie policies and lack of consent mechanisms, exposing the business to regulatory penalties and reputational damage. The absence of a documented information security framework, incident response procedures, and security policies under NIS2 guidance further elevates operational risk and may impact business continuity. Security headers are partially implemented but require strengthening to prevent common web-based attacks. Email security is adequate but could be improved to prevent phishing and spoofing. TLS and DNS configurations are generally solid but need timely certificate renewal and enhanced protections like DNSSEC. Network security posture is strong. Addressing these issues promptly will reduce regulatory exposure, enhance customer trust, and improve resilience against cyber threats.

K

Katalysen

katalysen.com

64

The website demonstrates a moderate to weak overall security posture with no critical issues but multiple high and medium severity findings that expose it to significant risks. Key deficiencies include missing essential security headers, lack of GDPR compliance elements such as a cookie consent banner, and inadequate NIS2-related security governance including the absence of security policies and incident response procedures. Email security is insufficiently configured, increasing the risk of spoofing and phishing attacks. Although SSL/TLS and DNS health are relatively strong, critical gaps like expiring certificates and missing DNSSEC reduce overall trustworthiness. The network security posture is solid, indicating a well-managed underlying infrastructure. Immediate improvements in policy documentation, compliance controls, and email authentication will substantially reduce business risks and regulatory exposure. Without remediation, the organization faces potential data breaches, legal penalties, and reputational damage.

N

Norman Alex

normanalex.com

70

The website demonstrates a moderate security posture with no critical issues but several high and medium risks that require urgent attention. Key vulnerabilities include missing essential security headers, lack of GDPR compliance mechanisms such as a cookie consent banner, and significant deficiencies in NIS2 regulatory compliance, including absence of security policies and incident response procedures. While email security, SSL/TLS, DNS health, and network security scores are relatively strong, the overall protection is undermined by weak HTTP security headers and incomplete data protection practices. The absence of a documented information security framework and incident response plan exposes the business to regulatory penalties and increases risk of operational disruption. Immediate remediation of high-impact issues will strengthen defense against common web attacks and improve regulatory compliance. Strengthening security controls will also protect business reputation and customer trust. Overall, the site requires focused improvements in governance, policy documentation, and technical controls to meet industry standards and legal obligations.

C

Cabinet

studiocabinet.com

64

The website demonstrates a moderate overall security posture with no critical issues but several high and medium severity vulnerabilities that present significant business risks. Key weaknesses include missing essential security headers, lack of GDPR compliance elements such as privacy and cookie policies, and absence of fundamental information security frameworks aligned with NIS2 requirements. These gaps expose the business to legal liabilities, data privacy violations, and potential operational disruptions. While email security, DNS health, and network security scores are relatively strong, SSL/TLS configurations need improvement to prevent data interception. The lack of incident response and business continuity plans further increases organizational risk in the event of a breach. Immediate remediation on privacy compliance and security governance will protect brand reputation and reduce regulatory penalties. Overall, the website requires focused improvements in security policies, headers, and privacy practices to meet industry standards and regulatory demands.

M

MTN CI

mtn.ci

53

The website exhibits significant security weaknesses, particularly in foundational areas such as security headers, GDPR compliance, and NIS2 regulatory adherence. While no critical vulnerabilities were found, numerous high-severity issues indicate a substantial risk to both data protection and regulatory compliance, exposing the business to potential legal and reputational damage. The lack of essential security headers and policies increases susceptibility to web-based attacks, while missing privacy and cookie policies risk non-compliance with data protection laws. Email security measures are partially implemented but require improvements to prevent spoofing. SSL/TLS configurations are suboptimal, with weak keys and imminent certificate expiry, threatening secure communications. DNS and network security are relatively strong but cannot compensate for the other systemic weaknesses. Immediate remediation is necessary to safeguard customer data, maintain trust, and align with regulatory requirements.

The website's overall security posture is currently weak, with significant deficiencies in foundational security controls and GDPR compliance, exposing the business to regulatory, reputational, and cyber risks. Critical and high-severity issues dominate, particularly missing key security headers, inadequate privacy policies, and lack of documented information security frameworks and incident response plans. GDPR compliance gaps, including absence of cookie policies and consent mechanisms, place the organization at risk of legal penalties and loss of customer trust, especially as it operates in the EU. Furthermore, weaknesses in SSL/TLS configurations and missing NIS2 directive implementations indicate vulnerabilities to data interception and operational disruptions. While email security, DNS health, and network security show relatively strong scores, they do not compensate for core infrastructure and compliance shortcomings. Immediate remediation is essential to safeguard sensitive data, maintain regulatory adherence, and uphold brand integrity. Prioritizing these gaps will reduce the likelihood of breaches, fines, and business interruptions.

V

VINCI Construction

vinci-construction.com

78

The website demonstrates a generally strong security posture in areas such as network security, email security, SSL/TLS configuration, and security headers, with no critical vulnerabilities detected. However, significant gaps exist in regulatory compliance and governance, particularly regarding GDPR and NIS2 frameworks. The absence of a cookie policy and consent mechanism exposes the business to legal and reputational risks under privacy regulations. Additionally, missing security and incident response policies, as well as inadequate vulnerability disclosure and business continuity planning, increase operational risks and could impair effective response to security incidents. While technical controls like SSL/TLS and DNS health are solid, governance and compliance weaknesses represent the highest business impact threats. Addressing these gaps is essential to mitigate regulatory penalties, ensure customer trust, and maintain operational resilience. Prioritizing compliance documentation and incident management processes will strengthen the overall security posture and support business continuity.

T

Temmes Management Services

temmes.com

69

The website demonstrates a moderate security posture with no critical issues identified, but it has several high and medium priority vulnerabilities that could expose the business to significant risks. Major gaps exist in security headers, GDPR compliance, and adherence to NIS2 cybersecurity requirements, indicating weaknesses in both technical controls and governance. Missing key headers like Content-Security-Policy and X-Frame-Options increase the risk of cross-site scripting and clickjacking attacks. GDPR deficiencies, including lack of a cookie consent banner and incomplete privacy policies, may result in regulatory penalties and reputational damage. The absence of documented security policies, incident response procedures, and vulnerability disclosure mechanisms under NIS2 requirements exposes the organization to operational and compliance risks. SSL/TLS configurations need timely renewal and enabling HSTS for improved transport security. Although network security and email security scores are relatively strong, improvements in DNS security and email authentication mechanisms are advisable. Overall, addressing these issues will improve the website's defense posture, compliance standing, and trustworthiness with customers and regulators.

R

Roshan

roshan.af

67

The website demonstrates a moderate security posture with no critical vulnerabilities detected; however, multiple high and medium severity issues significantly increase its risk profile. Key deficiencies include missing essential security headers, absence of GDPR compliance mechanisms such as privacy and cookie policies, and lack of comprehensive information security governance aligned with NIS2 directives. These gaps expose the business to legal, reputational, and operational risks, including potential data breaches and regulatory penalties. While email security and underlying SSL/TLS configurations are relatively strong, foundational controls like HSTS and DNSSEC are not fully implemented. The presence of an exposed SSH service further amplifies attack surfaces if not properly managed. Immediate attention to governance policies, regulatory compliance, and core web security headers is critical to safeguard customer trust and ensure business continuity. Overall, the assessment underscores a need for a holistic security strategy integrating technical controls and policy frameworks.

The website's security posture is currently weak with multiple critical and high-severity issues that expose the business to significant risks. The absence of HTTPS encryption is a critical vulnerability affecting data confidentiality and compliance with GDPR and NIS2 regulations. Missing key security headers such as Strict-Transport-Security and Content-Security-Policy leave the site vulnerable to man-in-the-middle attacks and content injection. GDPR compliance is poor, lacking basic cookie policies and consent mechanisms, which can lead to legal penalties and reputational damage. The lack of a formal information security framework, incident response procedures, and security policies indicates immature security governance. While network security and DNS health show some strengths, critical gaps in email security and vulnerability management remain. Overall, immediate remediation is required to protect customer data, ensure regulatory compliance, and maintain stakeholder trust. Failure to act promptly could result in data breaches, legal consequences, and loss of business credibility.

S

Skanska

skanska.com

76

The website's overall security posture is strong in technical controls such as email security, SSL/TLS, and network security, indicating well-implemented foundational cybersecurity measures. However, significant gaps exist in regulatory compliance and governance, particularly around GDPR and NIS2 requirements, placing the business at risk of legal penalties and reputational damage. The absence of a privacy policy, cookie policy, and consent mechanisms exposes the company to non-compliance with data protection regulations. Additionally, missing information security frameworks, security policies, and incident response procedures highlight a lack of formalized security governance, increasing vulnerability to cyber incidents and reducing incident management effectiveness. Medium severity issues, such as missing security headers and lack of DNSSEC, suggest opportunities for improving technical defenses. Overall, while technical controls are solid, the company must urgently address compliance and governance deficiencies to reduce legal and operational risks. Proactive remediation will enhance customer trust and support long-term business resilience.

This website has 1 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

M

MTN Liberia

lonestarcell.com

68

The website's overall security posture shows no critical vulnerabilities but has multiple high and medium-risk issues that could expose the business to significant legal, operational, and reputational risks. Key deficiencies exist in security headers, GDPR compliance, and adherence to NIS2 cybersecurity frameworks, indicating gaps in data protection, policy documentation, and incident response readiness. Notably, the absence of a privacy policy and cookie consent mechanism risks non-compliance with data privacy regulations, potentially resulting in fines and loss of customer trust. DNS misconfigurations such as unregistered MX records and lack of DNSSEC further increase exposure to email spoofing and DNS attacks. While email and network security appear strong, mixed content issues and incomplete SSL/TLS configurations could allow man-in-the-middle attacks. Addressing these vulnerabilities is critical to safeguarding customer data, ensuring regulatory compliance, and maintaining business continuity. Immediate remediation is advised to reduce legal liabilities and strengthen the organization's cybersecurity resilience.

А

Аутсорсинговый контакт-центр eCall

ecall.ua

39

The website ecall.ua exhibits a critically weak security posture, primarily due to the absence of HTTPS encryption and several essential security headers, exposing the site to data interception, clickjacking, and content injection risks. Additionally, the lack of GDPR compliance and insufficient security policies significantly heighten legal, reputational, and operational risks for the business.