Security Directory

C

Consensus Sales, LLC

goconsensus.com

73

The website demonstrates a moderate overall security posture with no critical issues but several high and medium severity vulnerabilities that require urgent attention. Key gaps exist in security headers, GDPR compliance, and especially in adherence to NIS2 requirements, indicating insufficient information security governance and incident response preparedness. Missing Content-Security-Policy and Permissions-Policy headers expose the site to client-side attacks, while the absence of a cookie consent banner and incomplete privacy documentation risk regulatory non-compliance and potential fines. SSL/TLS and network security are strong areas, but upcoming certificate expiry and missing DNSSEC present risks to data integrity and trust. Email security shows room for improvement with missing DKIM signatures, which could affect email authenticity. Addressing these issues will strengthen both the technical defenses and regulatory compliance, reducing the risk of data breaches, reputational damage, and legal penalties.

W

WorkSpan, Inc.

workspan.com

70

The website demonstrates a moderate security posture with no critical vulnerabilities detected, but multiple high and medium severity issues significantly undermine its overall security and regulatory compliance. Key weaknesses include missing critical HTTP security headers, lack of GDPR-compliant cookie policies, and an absence of foundational NIS2 security governance such as incident response and security documentation. While email security, SSL/TLS, DNS health, and network security show strong performance, gaps in security headers and compliance frameworks expose the business to risks including clickjacking, cross-site scripting, data privacy violations, and regulatory penalties. The absence of a formal information security framework and incident response procedures increases exposure to operational disruption and reputational damage. Immediate remediation is essential to strengthen defenses and meet legal obligations. Addressing these issues will reduce the risk of data breaches, improve customer trust, and ensure regulatory compliance, safeguarding business continuity and brand reputation.

O

OneTrust, LLC

cookiebanners.com

65

The website demonstrates a moderate overall security posture with no critical issues detected, but several high and medium risks require urgent attention. Key weaknesses lie in compliance areas, particularly GDPR and NIS2 regulatory frameworks, with missing privacy policies, cookie consent mechanisms, and essential security documentation. Email security configurations are incomplete, exposing the organization to phishing and spoofing risks. SSL/TLS implementations have vulnerabilities that could compromise data confidentiality and integrity. While network security is strong, missing security headers and weak configurations reduce protection against certain web-based attacks. Immediate remediation will not only improve security but also ensure regulatory compliance, reducing potential legal and reputational risks. Addressing these issues will strengthen customer trust and safeguard business continuity. Proactive security governance and incident response planning are currently insufficient and should be prioritized.

O

Ooshman

ooshman.au

59

The website demonstrates significant security gaps, particularly in foundational security headers, privacy compliance, and information security governance, resulting in a poor overall security posture. While network security and email security score relatively well, critical vulnerabilities such as missing Strict-Transport-Security and Content-Security-Policy headers expose the site to data interception and cross-site scripting attacks. The absence of GDPR compliance elements like privacy and cookie policies presents legal and reputational risks. Additionally, missing NIS2-related documentation and incident response procedures indicate a lack of preparedness for cyber incidents, increasing operational risk. Weak SSL key lengths and impending certificate expiration further undermine secure communications. Addressing these high and medium priority issues is essential to protect customer data, maintain regulatory compliance, and safeguard business continuity. Immediate remediation will reduce potential breach impact, enhance customer trust, and align with industry standards.

J

Jelly Health Pty Ltd

jellyhealth.com.au

66

The website demonstrates significant security weaknesses, particularly in its security headers, GDPR compliance, and adherence to NIS2 cybersecurity requirements. While no critical issues were detected, there are numerous high and medium severity findings that expose the business to data breaches, regulatory non-compliance, and operational risks. Key concerns include missing essential HTTP security headers, absence of a cookie policy and consent mechanisms, and a lack of documented security policies and incident response procedures. Additionally, the exposure of high-risk services such as FTP increases the attack surface. Although email security and SSL/TLS configurations are relatively strong, the impending SSL certificate expiry and lack of HSTS enforcement pose risks. Immediate remediation is needed to protect customer data, maintain regulatory compliance, and safeguard business continuity. Overall, the current security posture is inadequate for a business seeking to minimize cyber risk and ensure trustworthiness with customers and regulators.

The website demonstrates a concerning security posture with no critical vulnerabilities but multiple high and medium risks that could expose the business to significant threats. Key security headers are missing, exposing the site to common web attacks such as clickjacking, content injection, and cross-site scripting. Compliance gaps around GDPR and NIS2 regulations pose legal and reputational risks, including the absence of privacy policies, cookie consent mechanisms, incident response plans, and security documentation. The presence of an exposed FTP service introduces a high-risk attack vector that could lead to unauthorized access or data breaches. Although email security and DNS health are relatively stronger, SSL/TLS configurations need attention, especially with an expiring certificate and lack of HSTS enforcement. Overall, the site requires immediate remediation to secure user data, meet regulatory requirements, and prevent potential operational disruptions or fines. Addressing these issues will improve customer trust, reduce liability, and enhance the organization's cyber resilience.

U

Uber Freight

uberfreight.com

65

The website demonstrates a moderate security posture with no critical vulnerabilities but multiple high and medium-level issues that expose the business to significant risks. Key deficiencies exist in HTTP security headers, which leave the site susceptible to common web attacks like clickjacking, XSS, and data interception. GDPR compliance is notably weak, lacking core privacy elements such as a privacy policy, cookie policy, and consent mechanisms, which can result in regulatory penalties and reputational damage. The absence of a documented information security framework, incident response, and business continuity planning highlights operational risks in managing security incidents. While email security and network security show strong maturity, the gaps in SSL/TLS configurations and DNS settings further reduce overall resilience. Immediate remediation is required to protect user data, ensure regulatory compliance, and maintain customer trust. Proactive security governance and policy documentation are essential to meet NIS2 directives and strengthen organizational security posture.

B

BPAY Pty Ltd

bpay.com.au

63

The website demonstrates a moderate overall security posture with no critical issues detected, but several high and medium-risk vulnerabilities that pose significant risks to business operations and compliance. Key deficiencies exist in security headers, GDPR compliance, and adherence to NIS2 cybersecurity requirements, exposing the organization to regulatory penalties and potential data breaches. The absence of privacy and cookie policies, as well as missing consent mechanisms, undermines trust and legal compliance with data protection laws. Weak SSL/TLS configurations and mixed content issues threaten secure data transmission and user confidentiality. Network security and email security are strong points, reflecting good foundational controls in those areas. However, the lack of incident response procedures and security documentation hampers the organization's ability to effectively manage and respond to cyber incidents. Immediate remediation efforts should focus on closing compliance gaps, strengthening encryption standards, and improving security policy frameworks to safeguard business continuity and reputation.

D

DiscoverOrg

discoverorg.com

64

The website exhibits a concerning security posture with no critical issues but multiple high and medium-risk findings, indicating significant gaps in foundational security controls. Key deficiencies include missing essential HTTP security headers, weak SSL/TLS configurations, and inadequate GDPR compliance measures, exposing the business to data breaches and regulatory penalties. The absence of a formal information security framework, incident response, and business continuity plans further increases operational risk and vulnerability to cyber incidents. While email and network security are strong, critical areas like web security headers, SSL/TLS, and compliance require urgent attention to protect sensitive user data and maintain customer trust. DNS security is relatively robust but can be improved with additional configurations. Addressing these issues will reduce the risk of exploitation, improve regulatory compliance, and strengthen overall resilience. Prioritizing governance, technical controls, and privacy policies will provide the best risk reduction and business value.

A

Aramex

aramex.net

96

The website demonstrates a generally strong security posture with no critical or high-severity issues detected. Core protections such as email security, SSL/TLS implementation, and network security are fully compliant and scored at 100%. However, medium-severity gaps exist primarily around security headers, GDPR compliance, NIS2 regulation adherence, and DNS security configurations, notably the absence of DNSSEC. These weaknesses expose the site to potential risks like data privacy non-compliance, increased susceptibility to DNS spoofing attacks, and suboptimal mitigation of common web-based threats. Addressing these areas will enhance regulatory compliance, strengthen defenses against DNS-based and web application attacks, and reduce potential legal and reputational risks. The low-severity issues, such as missing CAA records, while less urgent, should be resolved to maintain comprehensive security hygiene. Overall, the site is well-protected but requires targeted improvements to ensure robust, future-proof security and regulatory alignment.

A

Australia Post

australiapostcollectables.com.au

70

The website demonstrates a generally solid technical security foundation with strong network security, SSL/TLS configurations, and DNS health. However, critical gaps exist in compliance with GDPR and NIS2 regulations, particularly around privacy policies, consent mechanisms, and documented security frameworks. The absence of privacy and cookie policies, along with missing consent banners, exposes the business to regulatory and reputational risks. Lack of incident response procedures and security policy documentation further elevates operational risks in case of security events. Security headers are moderately implemented but can be strengthened to reduce attack surface. Email security is good but could be improved with DKIM implementation to prevent spoofing. Overall, the site is secure from a technical standpoint but requires urgent compliance and governance enhancements to mitigate legal and operational risks.

A

Australia Post

digitalid.com

76

The website demonstrates a generally strong technical security posture in areas such as email security, SSL/TLS configuration, DNS health, and network security, reflecting effective implementation of foundational controls. However, significant gaps exist in compliance and governance domains, notably regarding GDPR and NIS2 requirements, which pose substantial legal, reputational, and operational risks. The absence of a privacy policy, cookie policy, and consent mechanisms undermines user trust and exposes the business to potential regulatory penalties. Furthermore, critical deficiencies in information security frameworks, incident response, and security policy documentation indicate a lack of formalized cybersecurity governance and preparedness. While security header implementations are moderate, enhancements are needed to reduce exposure to web-based threats. Addressing these compliance and governance gaps will be essential to align with industry best practices, regulatory mandates, and customer expectations. Prioritizing these improvements will strengthen both risk management and stakeholder confidence.

A

Australia Post

postbillpay.com.au

68

The website demonstrates a solid foundation in network, email, and SSL/TLS security, indicating good baseline protections. However, significant gaps exist in security headers, GDPR compliance, and adherence to NIS2 cybersecurity frameworks, which together expose the business to legal, reputational, and operational risks. Missing critical headers like Content-Security-Policy and X-Frame-Options leave the site vulnerable to cross-site scripting and clickjacking attacks. The absence of privacy and cookie policies, along with no cookie consent mechanism, poses compliance risks under data protection laws such as GDPR, potentially leading to fines and loss of customer trust. Lack of documented security policies, incident response procedures, and business continuity planning increases the risk of inadequate response to cyber incidents, threatening business operations. DNSSEC is not enabled, which could allow DNS spoofing attacks. Addressing these issues will significantly strengthen security posture, reduce compliance risks, and protect the organization from both cyber threats and regulatory penalties. Immediate focus on privacy policies, security headers, and incident response frameworks is recommended. Overall, the current posture requires urgent remediation to align with industry standards and legal requirements.

A

Aramex

aramex.com

96

The website demonstrates a strong overall security posture with no critical or high severity issues, and perfect scores in email security, SSL/TLS configuration, and network security. However, medium-level concerns exist related to security headers, GDPR compliance, NIS2 directives, and DNS health, particularly the absence of DNSSEC. These medium issues could expose the business to regulatory risks, data privacy challenges, and potential domain spoofing vulnerabilities. Low-level issues, such as missing CAA records, slightly reduce DNS security but have less immediate impact. Addressing these gaps will enhance compliance, reduce attack surface, and improve trustworthiness with customers and partners. Prioritizing remediation in the context of evolving regulatory landscapes will safeguard business continuity and reputation. Overall, the website is secure but would benefit from targeted improvements in governance and DNS-related controls.

A

Australia Post

auspost.com.au

70

The website demonstrates a generally solid technical security foundation with strong email security, network security, SSL/TLS, and DNS health scores. However, significant deficiencies exist in compliance with data privacy regulations such as GDPR, and critical gaps are present in information security governance aligned with NIS2 requirements. The absence of a privacy policy, cookie policy, and consent mechanisms exposes the business to regulatory penalties and reputational damage. Moreover, lacking documented security policies, incident response plans, and vulnerability disclosure processes increases operational risk and may delay breach mitigation. Security headers are moderately configured but require improvements to reduce attack surface and prevent data leakage. Overall, the site’s technical controls are adequate but the organization must urgently address compliance and governance shortcomings to safeguard customer trust and meet legal obligations. Failure to act on these high-impact, high-risk issues could result in financial losses and regulatory scrutiny.

R

RealPage

realpagecares.com

64

The website's overall security posture reveals significant gaps, particularly in governance and compliance areas such as GDPR and NIS2 frameworks, exposing the business to regulatory and reputational risks. Critical email security misconfigurations pose a high risk of phishing and spoofing attacks, potentially undermining customer trust. Missing key security headers like Content-Security-Policy and X-Frame-Options increase vulnerability to cross-site scripting and clickjacking attacks, threatening data integrity. Although network security and DNS health are relatively strong, foundational SSL/TLS and header configurations require improvement to safeguard data in transit. The absence of documented incident response and business continuity plans limits the organization's ability to effectively respond to cyber incidents, increasing potential downtime and financial loss. Lack of a cookie policy and consent mechanisms places the company at risk of non-compliance with privacy laws, which could result in fines and legal challenges. Immediate attention to these areas will reduce attack surfaces, ensure compliance, and strengthen overall resilience. Prioritizing governance frameworks and critical technical controls will deliver the greatest business impact.

G

G5

getg5.com

74

The website's overall security posture reveals significant gaps, particularly in compliance with regulatory frameworks such as GDPR and NIS2, which pose legal and reputational risks. While there are no critical vulnerabilities, several high-severity issues—such as missing security policies, weak SSL key length, and absence of cookie consent—indicate inadequate protection against data breaches and cyber incidents. The security headers and privacy configurations are suboptimal, increasing the likelihood of clickjacking attacks and non-compliance with data privacy laws. Network security and email security are strong points, demonstrating robust perimeter defenses. However, deficiencies in incident response, business continuity planning, and security documentation expose the business to prolonged downtime and regulatory penalties in case of an incident. Immediate attention is needed to address these weaknesses to safeguard customer data, maintain trust, and ensure compliance. Improving these areas will enhance the website’s resilience against cyber threats and regulatory scrutiny.

The website’s overall security posture reveals significant gaps in critical areas, particularly compliance with GDPR and NIS2 regulations, as well as foundational security controls. While there are no critical vulnerabilities, the presence of 11 high-severity issues highlights urgent risks that could lead to legal penalties, data breaches, or service disruptions. Missing key HTTP security headers and weak SSL/TLS configurations expose the site to common web-based attacks such as clickjacking and mixed content exploitation. Compliance gaps, including lack of cookie policies and incident response planning, increase regulatory and operational risks. DNS health issues like unregistered MX records pose risks to email reliability and can affect business communication. Positively, network security controls are strong, and email security is fairly robust, but improvements are needed to prevent spoofing and phishing. Immediate remediation will reduce risks, improve customer trust, and align with regulatory requirements. Without prompt action, the business risks reputational damage, regulatory fines, and potential data compromises.

B

Briscoe Group

briscoegroup.co.nz

55

The website's security posture is currently poor, with significant vulnerabilities across multiple domains including network security, compliance, and security headers. Critical risks arise from numerous exposed critical services such as SMB, MSSQL, MySQL, and Telnet, which pose immediate threats of unauthorized access and data breaches. Additionally, the absence of key security headers and a Content Security Policy increases susceptibility to web-based attacks like clickjacking and cross-site scripting. GDPR compliance is notably lacking, with no cookie policy or consent mechanisms, risking legal penalties and reputational damage. The lack of incident response and information security frameworks further exacerbates business risk by limiting preparedness for cyber events. While email security and DNS health scores are relatively strong, SSL/TLS configurations require urgent improvement to protect data in transit. Overall, the organization faces high exposure to cyber threats and compliance violations that must be urgently addressed to safeguard assets and maintain customer trust.

B

Briscoes AU

briscoes.com.au

54

The website's security posture is currently weak, with numerous critical and high-risk vulnerabilities exposing the business to significant threats including data breaches, regulatory fines, and operational disruptions. Critical services such as Telnet, SMB, MSSQL, MySQL, PostgreSQL, Redis, and MongoDB are openly exposed, posing immediate risk of compromise. Security headers are inadequately configured, leaving the site vulnerable to clickjacking, cross-site scripting, and data leakage attacks. GDPR compliance is poor, with no cookie policy or consent mechanisms in place, increasing legal and reputational risks. The absence of a formal information security framework, incident response plan, and security policies under NIS2 requirements indicates a lack of preparedness for cyber incidents. SSL/TLS configurations are suboptimal, including weak keys and impending certificate expiration, undermining data encryption and trust. Although email security and DNS health show relatively better scores, critical network security gaps must be addressed urgently to protect business assets and maintain customer trust.

N

Nelson Recruiting

nelsonrecruiting.com

58

The website's overall security posture is currently weak, with critical gaps in network security and compliance frameworks, exposing the business to significant operational and reputational risks. Critical services like MySQL and PostgreSQL are publicly accessible, creating immediate vulnerabilities to data breaches. The absence of key security headers and missing incident response and security policies further increase the risk of exploitation and regulatory non-compliance. GDPR compliance is insufficient, lacking essential cookie policies and consent mechanisms, potentially leading to legal penalties. Although email security and TLS configurations show moderate strength, critical certificates and security policies require urgent updating. The NIS2 and network security scores are alarmingly low, indicating inadequate protection against cyber threats and lack of preparedness for incidents. Immediate remediation across network exposure, compliance documentation, and security headers is essential to safeguard the business and maintain customer trust. Without prompt action, the organization faces heightened risks of cyberattacks, data loss, and regulatory fines.

P

Profisee

profisee.com

67

The website demonstrates a moderate overall security posture with no critical issues but multiple high and medium risk findings that could expose the business to significant operational, reputational, and regulatory risks. Key weaknesses exist in security headers, GDPR compliance, and adherence to NIS2 cybersecurity framework requirements, reflecting gaps in privacy protection, incident preparedness, and information security governance. SSL/TLS configurations show vulnerabilities including weak key lengths and impending certificate expiration, which threaten secure communications. While email security and network security measures score well, foundational security controls such as Content Security Policy and proper cookie management are missing. Failure to implement GDPR-required cookie consent and policies exposes the business to potential regulatory penalties and loss of customer trust. The absence of incident response and business continuity plans significantly heightens risk from cyber incidents. Immediate remediation will reduce attack surface, improve compliance, and strengthen customer confidence. Overall, addressing these gaps is essential to align with industry standards and regulatory obligations, protecting both the business and its customers.

A

Acentra Health

acentra.com

65

The website's overall security posture reveals significant gaps in compliance and foundational security controls, particularly concerning regulatory requirements and cryptographic protections. While no critical vulnerabilities were found, multiple high and medium severity issues pose material risks to data privacy, legal compliance, and customer trust. Key weaknesses include missing security headers, lack of GDPR-compliant cookie policies and consent mechanisms, absence of formal information security and incident response frameworks, and weak SSL/TLS configurations. Conversely, network security and DNS health show relatively strong scores, indicating some effective controls are in place. The deficient NIS2 compliance score highlights the urgent need for documented security policies and incident handling procedures. Immediate remediation will reduce exposure to data breaches, regulatory penalties, and reputational damage. Investment in security governance and cryptographic standards is needed to align with industry best practices and legal mandates.

C

CNECT

cnectgpo.com

65

The website demonstrates a moderate security posture with no critical issues but several high and medium-risk vulnerabilities across key domains. Significant gaps exist in security headers, GDPR compliance, and adherence to NIS2 cybersecurity standards, exposing the business to regulatory, reputational, and operational risks. Missing essential headers like Strict-Transport-Security and Content-Security-Policy weaken defense against common web attacks. GDPR-related deficiencies, including lack of a cookie policy and consent mechanisms, risk non-compliance penalties. The absence of documented security policies, incident response, and business continuity plans under NIS2 further increases exposure to cyber threats and operational disruptions. SSL/TLS configurations are suboptimal with weak key length and upcoming certificate expiry, potentially compromising secure communications. Encouragingly, network security and email security show relatively strong scores, indicating some foundational controls are in place. Immediate remediation focused on regulatory compliance and critical security controls will substantially reduce risk and improve trustworthiness.

B

Bricz

bricz.com

64

The website demonstrates significant security and compliance gaps, particularly in foundational security headers and regulatory adherence, which expose the business to increased risk of data breaches, regulatory penalties, and reputational damage. Although no critical vulnerabilities were found, multiple high and medium risk issues related to missing security headers, incomplete GDPR compliance, and absence of essential NIS2 security frameworks indicate inadequate protection and governance. Email security and network security show relatively strong posture, but weaknesses in SSL/TLS management and DNS configuration could impact trust and data integrity. Immediate attention is needed to establish security policies, incident response capabilities, and enforce data protection measures to align with industry standards and regulations. The low scores in security headers, GDPR, and NIS2 compliance highlight urgent areas that require remediation to safeguard customer data, maintain regulatory compliance, and ensure business continuity. Overall, the website’s security posture is currently insufficient for high-risk operational environments and requires prioritized remediation to reduce exposure and improve stakeholder confidence.

The website exhibits significant security and compliance gaps that could expose the business to legal, reputational, and operational risks. While there are no critical vulnerabilities, multiple high-severity issues related to missing security headers, absence of GDPR compliance measures, and lack of foundational information security frameworks are evident. The absence of a Privacy Policy, Cookie Policy, and consent mechanisms increases the risk of regulatory penalties and undermines user trust. Additionally, missing incident response and security policy documentation hampers the organization's ability to effectively manage and respond to security incidents. Although email security, SSL/TLS, DNS health, and network security scores are relatively strong, foundational security controls such as HSTS and DNSSEC require improvement. Immediate remediation is essential to align with industry best practices and relevant regulations like GDPR and NIS2. Addressing these gaps will substantially reduce the risk of data breaches, regulatory fines, and damage to brand reputation.

S

ShowingTime+

showingtime.com

67

The website demonstrates a moderate overall security posture with strong network security and solid SSL/TLS and email security implementations. However, significant gaps exist in compliance and governance areas, particularly concerning GDPR and NIS2 regulatory requirements, which present considerable legal and reputational risks. The absence of fundamental privacy policies, cookie consent mechanisms, and incident response procedures exposes the business to potential regulatory penalties and customer trust erosion. Missing critical security headers like X-Frame-Options increases susceptibility to web-based attacks such as clickjacking. While core infrastructure like DNS and SSL is generally well-managed, some improvements are needed to maintain robust protection. Immediate focus on establishing comprehensive privacy and security policies, alongside addressing critical security headers, will substantially improve risk posture. Without remediation, these vulnerabilities could lead to data breaches, compliance violations, and operational disruptions impacting business continuity and customer confidence.

S

Seismic

seismic.com

75

The website demonstrates a generally solid security foundation with no critical vulnerabilities detected, and strong performance in email security, SSL/TLS, DNS health, and network security. However, significant gaps exist in governance and compliance areas, notably GDPR and NIS2 regulations, with multiple high-severity issues such as missing cookie policies, lack of incident response procedures, and absence of security framework documentation. These deficiencies expose the business to regulatory risks, potential legal penalties, and reputational damage. Security headers are not fully optimized, leaving the site vulnerable to clickjacking and some cross-site scripting risks. While SSL/TLS configurations are largely robust, upcoming certificate expiry and incomplete HSTS settings require attention to maintain trust and secure communications. Overall, the organization should prioritize establishing comprehensive security policies and compliance measures to mitigate operational and regulatory risks effectively.

R

RealPage, Inc.

realpagelumina.com

68

The website's overall security posture reveals significant gaps, particularly in governance and compliance areas. Critical issues such as the lack of email authentication and missing incident response procedures expose the business to heightened risks of phishing attacks and prolonged downtime during security incidents. High-severity findings around GDPR compliance and the absence of a documented security framework indicate potential regulatory and reputational risks. Although network security and DNS health scores are strong, foundational security controls like Content-Security-Policy and Strict-Transport-Security headers are insufficiently configured, increasing vulnerability to web-based attacks. Expiring SSL certificates and mixed content issues further degrade trust and security. Immediate remediation is necessary to safeguard sensitive data, ensure regulatory compliance, and protect brand reputation. The business should prioritize establishing formal security policies and improving critical headers and email authentication measures. Addressing these issues will reduce risk exposure and support long-term resilience against evolving cyber threats.

F

Freddie Mac

freddiemac.com

74

The website demonstrates a generally solid technical security foundation with no critical vulnerabilities detected and strong scores in email security, network security, SSL/TLS, and DNS health. However, significant gaps exist in regulatory compliance and governance, particularly regarding GDPR and NIS2 mandates, which present substantial legal and operational risks. The absence of essential policies such as cookie consent, incident response, and security frameworks exposes the organization to potential regulatory penalties and undermines customer trust. Missing key security headers and mixed content issues indicate areas where the website’s resilience against common web attacks can be improved. While foundational network and protocol configurations are strong, the low scores in compliance reflect a need for urgent attention to documentation, privacy, and incident management. Overall, the security posture is functional but incomplete, with business-critical exposure due to compliance shortcomings. Addressing these gaps will enhance legal compliance, customer confidence, and incident readiness, thereby reducing potential financial and reputational damage.

F

Fannie Mae

fanniemae.com

63

The website demonstrates a mixed security posture with no critical vulnerabilities but several high and medium-risk issues that could impact both security and regulatory compliance. Notably, the absence of key GDPR-related elements such as Privacy and Cookie Policies, and a consent banner, exposes the business to potential legal penalties and loss of user trust. Security headers are inadequately configured, increasing susceptibility to common web attacks like cross-site scripting. The lacking information security framework and incident response procedures indicate immature cybersecurity governance, risking delayed or ineffective handling of security incidents. SSL certificate expiration and mixed content issues threaten secure communications, while missing DNSSEC and email authentication elements could allow domain spoofing or phishing attacks. Positively, network security and DNS health are strong, providing a solid foundation. Overall, immediate focus on compliance and security policy establishment is critical to safeguard business operations and reputation.

B

Blend

blend.com

72

The website demonstrates a generally stable security posture with no critical vulnerabilities detected; however, significant gaps exist in compliance, documentation, and some security configurations. High-severity issues center on GDPR non-compliance, including the absence of a cookie policy and consent mechanisms, which expose the business to regulatory and reputational risks. Additionally, the lack of an established information security framework, incident response procedures, and security policy documentation undermines the organization's ability to effectively manage cybersecurity risks and respond to incidents, potentially affecting business continuity. SSL certificate expiration and mixed content warnings further threaten data integrity and user trust. While network security and email security scores are strong, deficiencies in security headers and DNS configurations expose the website to avoidable attack vectors. Prioritizing compliance and foundational security processes will significantly enhance the organization's risk posture and regulatory standing.

S

ShowingTime Plus, LLC

marketviewbroker.com

58

The website's overall security posture is weak, with critical and high-severity issues predominantly related to foundational security controls. Missing essential HTTP security headers and lack of email authentication expose the business to web-based attacks, phishing, and data interception risks. Non-compliance with GDPR requirements, including absence of privacy and cookie policies and consent mechanisms, risks regulatory penalties and reputational damage. The absence of documented information security frameworks, incident response plans, and security policies reflects immature governance, increasing operational and compliance risks. While network infrastructure and SSL/TLS configurations are relatively strong, critical gaps in DNS security and email authentication reduce trust and increase vulnerability to spoofing and phishing. Immediate remediation is necessary to protect customer data, ensure legal compliance, and maintain stakeholder confidence. Addressing these issues will reduce risk exposure, improve incident readiness, and support business continuity.

B

Briscoes

briscoes.co.nz

54

The website's security posture is currently weak, exposing the business to significant cyber risks and potential regulatory non-compliance. Numerous critical and high-severity issues exist, especially in network security where multiple critical services such as Telnet, SMB, MSSQL, and databases are openly exposed, significantly increasing the risk of unauthorized access and data breaches. Key security controls including essential HTTP security headers and GDPR compliance measures like cookie policies and consent banners are missing, elevating legal and reputational risks. The absence of formal information security frameworks, incident response plans, and security policies further undermines the organization's resilience to cyber incidents. While email security and DNS health show relatively better scores, weaknesses remain in SSL/TLS configurations that could allow interception or downgrade attacks. Immediate remediation is required to protect sensitive data, maintain customer trust, and comply with regulations such as GDPR and NIS2. Failure to address these gaps could result in financial loss, legal penalties, and damage to brand reputation. Strengthening foundational security controls and network defenses should be prioritized to reduce the attack surface and improve overall risk posture.

The website demonstrates a generally sound technical security posture with strong network security, SSL/TLS configurations, and email security. However, there are significant compliance and governance gaps, primarily related to GDPR and NIS2 regulatory requirements, which pose high legal and operational risks. Key concerns include the absence of privacy and cookie policies, lack of consent mechanisms, and missing incident response and information security framework documentation. These deficiencies could lead to regulatory penalties, reputational damage, and loss of customer trust. Security headers are implemented but need strengthening to mitigate web-based attacks effectively. DNS and email security are adequate but have room for improvement to reduce attack surface. Addressing governance and compliance issues should be prioritized alongside enhancing security headers to ensure a balanced, robust security posture that supports business continuity and regulatory adherence.

The website exhibits a moderate security posture with no critical vulnerabilities but several high and medium-risk issues that could expose the business to regulatory, reputational, and operational risks. Key weaknesses include missing crucial security headers like Content-Security-Policy and inadequate GDPR compliance, notably the absence of a cookie policy and consent mechanism. The most significant gaps lie in the lack of foundational NIS2 security governance elements, including no documented security policies, incident response procedures, or vulnerability disclosure policies. While SSL/TLS and network security are relatively strong, mixed content issues and suboptimal HTTP Strict Transport Security (HSTS) configurations reduce overall protection. DNS security is good but could be enhanced by enabling DNSSEC and configuring CAA records. Immediate remediation is especially critical to meet regulatory requirements, protect sensitive user data, and reduce exposure to web-based attacks. The current state may lead to compliance penalties, customer trust erosion, and increased risk of successful cyberattacks if not addressed promptly.

C

CNHI

cnhi.com

62

The website demonstrates a concerning security posture with no critical issues but multiple high and medium risks that could expose the business to data breaches, regulatory penalties, and reputational damage. Key deficiencies include missing essential security headers, poor GDPR compliance, lack of documented security policies, and weak SSL/TLS configurations. While network security and email security appear relatively strong, significant gaps in incident response, vulnerability disclosure, and security governance are evident. The absence of cookie policies and consent banners increases legal exposure under GDPR. Additionally, weak encryption and missing HTTP Strict Transport Security reduce protection against common web attacks. Immediate remediation is necessary to safeguard customer data, ensure regulatory compliance, and maintain stakeholder trust. Addressing these issues will strengthen the overall security posture and reduce business risk significantly.

The website demonstrates a concerning overall security posture with significant gaps in foundational web security headers and regulatory compliance, particularly related to GDPR and NIS2 directives. Although no critical vulnerabilities were identified, the presence of 11 high-severity issues—especially missing key security headers and lack of privacy policies—exposes the business to risks including data breaches, legal non-compliance, and reputational damage. The absence of incident response and security policy documentation further increases organizational risk by limiting preparedness for potential cyber incidents. Email security, SSL/TLS, DNS health, and network security show relatively strong scores, indicating good controls in these areas. However, the lack of strict transport security (HSTS) and DNSSEC weakens the overall defense posture. Immediate remediation of compliance gaps and security header misconfigurations is essential to reduce legal liabilities and improve customer trust. The business should prioritize establishing clear security governance and incident response capabilities to align with industry and regulatory standards.

C

Contentful

contentfulstatus.com

68

The website exhibits significant security gaps, particularly in compliance, email security, and incident management frameworks, which pose substantial risks to business operations and regulatory adherence. Critical and high severity issues, such as the absence of email authentication and missing key security headers, expose the organization to phishing attacks, data breaches, and clickjacking vulnerabilities. GDPR compliance is notably weak, with no cookie policy or consent mechanism, risking regulatory fines and eroding customer trust. The lack of documented information security and incident response policies under NIS2 directives indicates unpreparedness for cyber incidents, threatening operational resilience. Although network security and SSL/TLS configurations show strengths, weaknesses in DNS security and HTTP security headers reduce overall protection. Addressing these issues promptly will reduce exposure to cyber threats, improve regulatory compliance, and enhance customer confidence. Prioritizing governance and technical controls will support sustainable security posture improvements. Incremental remediation aligned with business priorities is essential to mitigate risks effectively.

The website demonstrates a moderate overall security posture with no critical vulnerabilities detected but several high and medium severity issues that pose significant risk. Key deficiencies include missing critical security headers such as Content-Security-Policy and weak configurations of transport security headers, increasing exposure to client-side attacks. Compliance gaps with GDPR and NIS2 regulations are evident, notably the absence of cookie policies, consent mechanisms, incident response procedures, and security policy documentation, which could lead to regulatory penalties and reputational damage. The SSL/TLS and DNS configurations are generally solid but require improvements to fully protect data in transit and DNS integrity. Email and network security modules score well, indicating good controls in those areas. However, the lack of a formal information security framework and vulnerability disclosure processes introduces organizational risk. Addressing these issues will strengthen security posture, regulatory compliance, and customer trust.

The website exhibits a generally solid network and SSL/TLS security posture, scoring 100/100 in these areas, which is a strong foundation for secure communications. However, significant gaps exist in email authentication, with a critical issue of no email authentication configured and missing DKIM records, increasing risks of phishing and email spoofing. Medium-level issues in security headers, GDPR compliance, NIS2 compliance, and DNS health (notably the lack of DNSSEC) indicate potential vulnerabilities in data protection, regulatory adherence, and domain security. Low-level issues such as missing CAA records, while less urgent, still impact overall DNS security robustness. The failure in GDPR and NIS2 analyses also poses legal and regulatory risks that could result in penalties or damage to brand reputation. Immediate remediation in email security and DNS protection will greatly enhance the website’s trustworthiness and compliance posture. Overall, while the infrastructure is strong, the organization should prioritize closing these critical and medium gaps to reduce exposure to cyber threats and regulatory non-compliance.

Z

Zillow Group

zillowgroup.com

69

The website demonstrates a moderate overall security posture with no critical issues found, but several high and medium severity gaps that pose significant risks. Key vulnerabilities include missing essential security headers, lack of GDPR compliance measures such as cookie policy and consent mechanisms, and absence of comprehensive security governance aligned with NIS2 requirements. While network security and email security are strong, deficiencies in incident response, security policy documentation, and vulnerability disclosure processes expose the business to operational and regulatory risks. The presence of mixed content and weak HSTS configurations could lead to data interception and man-in-the-middle attacks. Non-compliance with GDPR and NIS2 frameworks may result in regulatory penalties and damage to brand reputation. Immediate remediation will reduce exposure to cyber threats and enhance customer trust. Overall, addressing these gaps is critical to aligning security practices with business continuity and regulatory expectations.

M

Move, Inc.

move.com

63

The website demonstrates a moderate to weak overall security posture with no critical vulnerabilities but numerous high and medium risk issues, particularly in security headers, GDPR compliance, and NIS2 regulatory alignment. Key gaps include missing essential HTTP security headers and absence of privacy and cookie policies, which increase exposure to data breaches and regulatory penalties. The lack of incident response procedures, security policy documentation, and security framework indicate immature security governance, potentially impacting business resilience. Email security, SSL/TLS configuration, DNS health, and network security show relatively strong controls, mitigating some risks. However, missing GDPR elements and security headers threaten customer trust and compliance standing, which could lead to legal consequences and brand damage. Immediate remediation in these areas will strengthen defense-in-depth and regulatory compliance. Overall, the site needs focused improvements in baseline security controls and policy implementations to reduce risk and ensure data protection.

D

Dow Jones

djreprints.com

68

The website exhibits a concerning security posture with no critical issues but multiple high and medium severity vulnerabilities, primarily related to missing security headers, GDPR compliance gaps, and lack of foundational NIS2 security documentation. The absence of key HTTP security headers such as Strict-Transport-Security, X-Frame-Options, and Content-Security-Policy exposes the site to common web-based attacks like clickjacking, content injection, and downgrade attacks. GDPR compliance deficiencies, including missing cookie consent and incomplete privacy policies, present legal and reputational risks. Furthermore, the lack of an information security framework, incident response procedures, and security policy documentation indicates immature security governance. While email security, SSL/TLS, DNS health, and network security show relatively strong scores, the overall low NIS2 compliance score signals significant gaps in regulatory adherence and operational readiness. Immediate focus on governance, policy implementation, and security header configuration will mitigate business risks and enhance trust. Addressing these issues is critical to safeguarding customer data, ensuring regulatory compliance, and maintaining brand reputation.

The website's security assessment reveals significant vulnerabilities, notably in DNS health and email security, which critically impact availability and trustworthiness. DNS resolution failures, missing name servers, and domain registration issues pose immediate risks of website inaccessibility and domain hijacking. The absence of email authentication mechanisms like DKIM and SPF exposes the business to email spoofing and phishing attacks, undermining customer trust. Medium-level deficiencies in security headers, GDPR, and NIS2 compliance indicate gaps in regulatory adherence and protection against common web threats. Although SSL/TLS implementations and network security scores are strong, the overall posture is compromised by foundational DNS and email security failures. Addressing these issues swiftly is essential to protect business continuity, customer data, and regulatory compliance. The current state suggests urgent remediation to prevent operational disruptions and reputational damage. A structured security improvement plan focusing on critical DNS and email configurations will greatly enhance the website's resilience.

C

Cadia

cadia.com.au

96

The website demonstrates a strong overall security posture with no critical or high-level issues detected. Key areas like email security, SSL/TLS configuration, and network security are fully optimized, reflecting robust defenses against common attack vectors. However, medium-level concerns around security headers, GDPR compliance, NIS2 alignment, and DNSSEC implementation indicate gaps that could expose the business to regulatory risks and certain types of cyber threats. Low-level issues such as missing CAA DNS records suggest opportunities for improving certificate management. Addressing these medium and low-level findings will enhance compliance, reduce attack surface, and strengthen trust with customers and regulators. Prioritizing improvements in security headers and DNSSEC will yield significant security benefits. Overall, the website is well-protected but needs targeted remediation to meet evolving security and compliance standards fully.

This website has 3 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

This website has 3 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

J

JCB USA LLC

jcbusa.com

96

The website demonstrates a strong overall security posture with no critical or high-level issues detected, reflecting robust SSL/TLS implementation, excellent email security, and solid network security measures. However, medium-level deficiencies in security headers, GDPR compliance, NIS2 alignment, and DNS configuration present moderate risks that could affect regulatory compliance, data protection, and trustworthiness. The absence of DNSSEC and missing CAA records slightly weaken domain security, potentially exposing the site to DNS spoofing or unauthorized certificate issuance. Addressing these gaps will enhance data integrity, regulatory adherence, and overall resilience against common web threats. Proactive remediation of these medium and low-level issues is recommended to maintain customer trust and avoid potential compliance penalties. Continuous monitoring and periodic reassessments should be implemented to sustain and improve security posture over time.

This website has 1 high-priority security issue(s) that should be addressed promptly. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.