Security Directory

S

Sophia Business Angels

sophiabusinessangels.com

40

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is a fundamental vulnerability impacting user data confidentiality and trust. Key security headers are missing, increasing exposure to common web attacks such as clickjacking, cross-site scripting (XSS), and content injection. The site also lacks essential GDPR compliance elements like privacy policies and cookie consent, risking substantial legal penalties. Organizational security governance under NIS2 directives is severely lacking with no incident response, security policies, or information security framework in place. While email security and DNS health show moderate strengths, they are insufficient to mitigate the broader critical deficiencies. Immediate remediation is required to protect customer data, meet regulatory requirements, and maintain business continuity. Without urgent improvements, the business faces heightened risk of cyber incidents and regulatory sanctions.

M

Merkle

merkleinc.com

49

The website exhibits a poor overall security posture with critical vulnerabilities that expose it to significant risks. The absence of HTTPS encryption is the most alarming issue, affecting GDPR compliance, NIS2 regulations, and user data confidentiality. Key security headers are missing, increasing susceptibility to common web attacks such as cross-site scripting and data leakage. The lack of essential GDPR components, including a cookie consent banner and compliant privacy policy, poses legal and reputational risks. Organizational security maturity is low, with no documented security policies, incident response plans, or vulnerability disclosure processes, indicating weak governance. Email security is moderate but requires improvements to prevent phishing and spoofing attacks. DNS security is relatively strong, while network security demonstrates a good posture. Immediate remediation is needed to protect sensitive data, comply with regulations, and maintain customer trust.

D

Dubai Tell Limited, Geneva Tell SA, Algiers Tell Markets SPA

tell.group

43

The website's security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and operational disruptions. The absence of HTTPS encryption is a critical vulnerability that compromises all data transmissions, severely impacting user trust and violating GDPR and NIS2 requirements. Missing essential security headers further increase susceptibility to common web attacks such as clickjacking, XSS, and content injection. Lack of privacy and cookie policies, as well as the absence of consent mechanisms, place the business at high risk of legal penalties under data protection regulations. Critical services like MySQL and FTP are publicly exposed, providing easy attack vectors for threat actors. Additionally, there is a notable deficit in security governance, including lack of incident response, security policies, and information security frameworks, which undermines the organization's ability to manage and mitigate risks effectively. While email and DNS security show some strengths, these are overshadowed by critical gaps in network and application security. Immediate action is required to address these issues to protect business assets, customer data, and maintain regulatory compliance.

R

Riviera Marine S.A.M.

rivieramarine.mc

47

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and operational disruptions. The absence of HTTPS encryption is a critical vulnerability, undermining data confidentiality and trust, and violating GDPR and NIS2 requirements. Missing essential security headers such as Strict-Transport-Security and Content-Security-Policy further increase exposure to common web attacks like clickjacking and cross-site scripting. The lack of a cookie consent banner and incomplete GDPR compliance could result in legal penalties and reputational damage. Additionally, no formal security frameworks, incident response processes, or business continuity plans are in place, leaving the organization ill-prepared for security incidents. The exposure of high-risk services like FTP introduces unnecessary attack vectors. While email security and DNS health show relatively better scores, critical gaps remain. Immediate remediation is crucial to protect customer data, maintain regulatory compliance, and safeguard business continuity.

The website's security posture is currently poor, with critical vulnerabilities that expose the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is a critical flaw impacting secure communications, user trust, and search engine ranking. Key security headers are missing, increasing the risk of common web attacks such as clickjacking, cross-site scripting, and content injection. GDPR compliance is severely lacking, with no privacy or cookie policies and no consent mechanisms, exposing the business to potential legal penalties. The lack of documented information security frameworks, incident response plans, and vulnerability disclosure policies indicates immature security governance. DNS configuration issues further weaken the infrastructure's resilience to attacks. However, email security and network security are relatively strong areas. Immediate remediation is essential to protect customer data, ensure regulatory compliance, and maintain operational continuity.

B

Balt Group

balt.fr

50

The website's overall security posture is critically weak, primarily due to the complete lack of HTTPS encryption, exposing all data in transit to interception and manipulation risks. Compliance with GDPR and NIS2 regulations is severely deficient, risking significant legal penalties and reputational damage. Key security headers are mostly missing, increasing vulnerability to clickjacking, cross-site scripting, and content injection attacks. Absence of essential policies such as incident response and security frameworks further heightens operational risks. Although DNS and email security show moderate strength, they cannot compensate for fundamental flaws in transport security and regulatory compliance. Network security posture is strong, indicating underlying infrastructure may be well-managed, but website-level controls are inadequate. Immediate remediation is necessary to protect customer data, maintain trust, and ensure regulatory adherence. Without urgent action, the business faces data breaches, compliance fines, and loss of customer confidence.

M

MARK

meyerbergman.com

53

The website's overall security posture is critically weak, primarily due to the absence of HTTPS encryption, which exposes all data transmissions to interception and undermines trust and regulatory compliance. Key security headers are partially missing, reducing protection against common web attacks. GDPR compliance is severely lacking, with no cookie policy or consent mechanism, and insufficient privacy documentation, risking legal penalties and reputational damage. The NIS2-related controls are almost entirely absent, indicating a lack of fundamental security governance, incident response, and business continuity planning. While email and network security are strong, the critical gaps in encryption and governance overshadow these strengths. DNS security is moderate but could be improved to further harden the domain against tampering. Immediate remediation is necessary to protect customer data, comply with regulations, and maintain business continuity and trust.

The website's overall security posture exhibits significant vulnerabilities, most notably the absence of HTTPS encryption, which presents a critical risk to data confidentiality and user trust. Medium-level issues such as missing security headers, lack of GDPR and NIS2 compliance, absence of DKIM for email authentication, and disabled DNSSEC further expose the organization to data breaches, regulatory penalties, and phishing attacks. While network security shows a strong posture, foundational web security controls are lacking, which could undermine customer confidence and business reputation. Immediate remediation is needed to secure data in transit and align with legal requirements. Addressing these issues will reduce exposure to cyber threats, improve compliance posture, and enhance customer trust and operational resilience. The business should prioritize remediation efforts to avoid potential financial losses and reputational damage stemming from these vulnerabilities. Overall, the current state reflects an urgent need to elevate security controls to industry standards and regulatory expectations.

D

Doro AB

doro.com

42

The website's overall security posture is currently weak, with critical deficiencies in fundamental protections such as HTTPS encryption and key security headers. The absence of HTTPS impacts user trust, data confidentiality, and regulatory compliance, exposing the business to significant legal and reputational risks. GDPR compliance is notably poor, lacking essential elements like cookie policies and consent mechanisms, which could result in heavy fines and customer distrust. The NIS2-related security framework and incident response processes are missing, increasing vulnerability to cyber threats and potential operational disruptions. While email security and network infrastructure show moderate to strong performance, critical gaps in web and application-layer security jeopardize the entire environment. Immediate remediation is essential to protect sensitive customer data, maintain compliance, and safeguard business continuity. Failure to address these issues promptly could lead to data breaches, regulatory penalties, and loss of customer confidence. Overall, the current state demands urgent and prioritized security improvements to align with industry standards and legal requirements.

P

ProTech Monte-Carlo

protech.mc

42

The website's overall security posture is critically weak, with major deficiencies in foundational security controls such as HTTPS encryption and essential security headers. Lack of HTTPS exposes user data to interception and undermines trust, while missing security headers increase vulnerability to common web attacks like clickjacking and XSS. Additionally, the absence of GDPR compliance elements such as Privacy and Cookie Policies and consent mechanisms risks regulatory penalties and damages customer trust. The site also lacks critical NIS2 framework components including incident response, security policies, and business continuity plans, which could impair the organization's ability to respond to and recover from cyber incidents. While email security and network security show relatively strong scores, the critical gaps in encryption and policy documentation represent immediate threats to business continuity and reputation. Overall, urgent remediation is needed to secure customer data, ensure regulatory compliance, and protect the business from reputational and financial harm. Failure to act promptly may result in data breaches, legal consequences, and loss of customer confidence.

R

RG Capital | Allworth Financial

rgcapital.net

66

The website's security posture presents significant risks, primarily due to the absence of HTTPS encryption, which exposes all data transmissions to interception and manipulation. While network security is strong, several medium-level issues such as missing security headers, lack of GDPR and NIS2 compliance, absence of DNSSEC, and incomplete email authentication (no DKIM) indicate gaps in regulatory adherence and protection against common attack vectors. The failure to implement GDPR and NIS2 requirements could lead to legal and financial penalties, impacting business reputation and operations. DNS configuration weaknesses further increase susceptibility to domain spoofing and DNS attacks. Although some areas like network security and CAA records show positive scores, these do not compensate for the critical encryption flaw. Immediate remediation is essential to safeguard customer data, ensure compliance, and maintain trust. A structured approach focusing on encryption, compliance, and authentication will mitigate the most significant risks effectively.

N

Nyetimber Limited

nyetimber.com

45

The website exhibits a critically weak security posture with multiple severe vulnerabilities that expose it to significant risks including data breaches, compliance violations, and service interruptions. The absence of HTTPS encryption, flagged as critical across SSL/TLS, GDPR, and NIS2 compliance areas, is the most alarming issue, leaving all data transmissions vulnerable to interception and manipulation. Key security headers critical for protecting against common web attacks are missing, increasing the risk of clickjacking, content injection, and cross-site scripting attacks. GDPR compliance is poor, notably lacking a cookie consent mechanism and potentially non-compliant privacy policies, which could result in regulatory penalties and damage to customer trust. NIS2 directives are largely unmet, with no documented security policies, incident response plans, or information security frameworks, exposing the business to operational risks and regulatory enforcement. Email security is moderately better but still incomplete, with missing DKIM records and weak DMARC enforcement that could facilitate phishing attacks. DNS security is fairly strong, but the absence of DNSSEC and CAA records leaves some attack vectors open. Network security within the infrastructure is solid, providing a good foundation to build upon. Immediate attention is required to address critical encryption and compliance gaps to protect the business, customers, and reputation.

The website security assessment reveals a critical vulnerability due to the lack of HTTPS encryption, exposing all data in transit to interception and manipulation. While the overall network security posture is strong, there are multiple medium-level issues including missing security headers, absence of DNSSEC, and failure to implement GDPR and NIS2 compliance measures. The absence of DKIM records increases the risk of email spoofing and phishing attacks, potentially damaging brand reputation. Low-level issues like missing CAA records further reduce DNS security hardening. These combined gaps indicate insufficient protection against common web threats and regulatory compliance risks, which could lead to data breaches, legal penalties, and loss of customer trust. Immediate action to secure communications and meet compliance requirements is essential to safeguard business continuity and credibility. Strengthening email authentication and DNS configurations will also reduce attack surface and improve resilience.

P

Phoenix Hotel Management Company

phoenixhmc.com

38

The website's overall security posture is critically weak, exposing the business to significant risks from data breaches, regulatory penalties, and operational disruptions. Key foundational controls such as HTTPS encryption, security headers, and incident response mechanisms are missing, leaving data vulnerable in transit and at rest. Compliance with GDPR and NIS2 regulations is severely lacking, increasing legal and financial exposure. Sensitive services like MySQL and PostgreSQL are openly accessible, creating high-risk attack vectors. Although email security and DNS health are relatively stronger, critical gaps in network and application security overshadow these strengths. Immediate remediation is essential to protect customer data, maintain trust, and ensure regulatory compliance. Without urgent action, the business faces potential data loss, reputational damage, and costly fines. Strengthening security controls will also support business continuity and resilience against cyber threats.

M

Musictime

musictime.cz

40

The website's overall security posture is critically weak, exposing the business to significant legal, operational, and reputational risks. The absence of HTTPS encryption is a severe vulnerability, compromising data confidentiality and trust, especially for EU customers subject to GDPR. Key security headers are missing, increasing susceptibility to web-based attacks such as cross-site scripting and clickjacking. GDPR compliance is lacking, including no privacy or cookie policies and no consent mechanisms, risking regulatory penalties. The absence of an information security framework, incident response plans, and vulnerability disclosure processes indicates immature security governance. Email authentication is incomplete, raising the likelihood of phishing and spoofing attacks. Additionally, exposing high-risk services like FTP further amplifies the attack surface. Immediate remediation is essential to safeguard customer data, ensure regulatory compliance, and protect business continuity.

V

Visit Monaco

visitmonaco.com

38

The website's security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is a fundamental vulnerability affecting confidentiality and trust. Key security headers are missing, increasing the risk of common web attacks like clickjacking and content injection. GDPR compliance gaps, such as missing privacy policies and cookie consent mechanisms, expose the organization to legal penalties. Additionally, the lack of an information security framework and incident response procedures undermines the ability to handle security incidents effectively. While network security and DNS health are relatively strong, critical email security measures like DMARC and DKIM are insufficiently implemented, risking phishing attacks. Immediate remedial action is essential to protect customer data, ensure regulatory compliance, and maintain business continuity.

V

Venturi

venturi.fr

35

The website exhibits a severely deficient security posture, exposing the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. Critical issues such as the absence of HTTPS encryption and email authentication mechanisms leave communications vulnerable to interception and spoofing. Missing essential security headers and lack of incident response procedures further increase susceptibility to attacks like clickjacking, cross-site scripting, and prolonged downtime. Non-compliance with GDPR, including the absence of a cookie policy and consent mechanisms, exposes the business to legal penalties, especially given its EU operations. Although network security and DNS health show relatively strong scores, they cannot compensate for fundamental weaknesses in data protection and web security. Immediate remediation is necessary to protect customer data, maintain trust, and comply with regulatory requirements. Without prompt action, the business risks operational disruption, financial loss, and erosion of customer confidence.

R

RAX Group

pharmed-sam.net

44

The website's overall security posture is currently inadequate, with critical vulnerabilities that expose the business to significant risks. The absence of HTTPS encryption is a critical flaw, undermining data confidentiality and user trust while violating GDPR and NIS2 compliance requirements. Key security headers are missing, increasing exposure to common web attacks such as clickjacking, content injection, and cross-site scripting. GDPR compliance is weak, lacking a privacy policy and cookie consent mechanisms, which may result in regulatory penalties and reputational damage. The lack of documented security policies, incident response, and business continuity plans highlights insufficient organizational security maturity. While DNS and network security are relatively strong, critical gaps in email security and vulnerability management remain. Immediate remediation is essential to protect customer data, maintain regulatory compliance, and preserve brand reputation. Investment in security governance and technical controls is urgently required to mitigate these risks effectively.

V

Vale

vale.com

50

The website's overall security posture is critically weak, primarily due to the absence of HTTPS encryption, which exposes all data transmissions to interception and undermines user trust. Significant gaps exist in compliance with GDPR and NIS2 regulations, including missing privacy and cookie policies, lack of consent mechanisms, and absence of essential security documentation such as incident response and information security frameworks. Security headers are inadequately configured, increasing vulnerability to common web attacks like cross-site scripting. While network security and email security show strong scores, foundational web security controls are missing, presenting substantial legal, reputational, and operational risks. Immediate remediation is essential to protect user data, comply with regulations, and sustain business continuity. Without urgent action, the business risks regulatory penalties, data breaches, and loss of customer confidence. Addressing these issues will significantly enhance the organization's security resilience and trustworthiness.

C

Commune de Comblain-au-pont

comblainaupont.be

44

The website's overall security posture is critically deficient, with multiple severe vulnerabilities exposing the business to legal, reputational, and operational risks. The absence of HTTPS encryption is a critical failure affecting data confidentiality and regulatory compliance, particularly under GDPR and NIS2 frameworks. Key security headers are missing, increasing the risk of cross-site scripting (XSS) and content injection attacks. The company currently lacks fundamental privacy policies, cookie consent mechanisms, and GDPR compliance, which could result in significant fines and loss of customer trust. Additionally, there is no formal information security framework, incident response plan, or business continuity planning, leaving the organization ill-prepared for cyber incidents. Email security and DNS configurations are relatively better but still require enhancements. Immediate remediation is essential to protect sensitive data, maintain regulatory compliance, and safeguard business continuity.

The website’s security posture reveals significant vulnerabilities that pose substantial risks to business operations and customer trust. The most critical concern is the absence of HTTPS encryption, exposing all data transmissions to interception and tampering, which can lead to data breaches and regulatory penalties. Medium-level issues such as missing security headers, lack of GDPR and NIS2 compliance, and inadequate email security measures further increase exposure to cyber threats and legal non-compliance. While network security and DNS health scores are relatively strong, DNSSEC and CAA records gaps could allow DNS spoofing or certificate mis-issuance attacks. Immediate remediation is necessary to protect sensitive data, maintain regulatory compliance, and uphold the company’s reputation. Addressing these issues will significantly reduce the risk of cyber incidents and enhance customer confidence in the website’s security. Overall, the website is at moderate to high risk until critical and medium vulnerabilities are resolved.

E

Energy Intelligence Group, Inc.

energyintel.com

54

The website's overall security posture is currently poor, with multiple critical and high-severity issues that pose significant risks to both data protection and regulatory compliance. The absence of HTTPS encryption is the most critical vulnerability, exposing user data to interception and undermining trust. Compliance with GDPR and NIS2 regulations is severely lacking, including missing cookie policies, consent mechanisms, and essential security governance documentation. While email security and network security appear strong, fundamental web security headers and DNS configurations require improvement. The failure to implement proper incident response and business continuity plans further increases operational risk. Immediate remediation is essential to protect sensitive customer information, maintain regulatory compliance, and safeguard the organization's reputation. Without urgent action, the business risks data breaches, legal penalties, and loss of customer confidence.

S

Société Générale des Travaux du Maroc (SGTM)

sgtm-maroc.com

39

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and service disruptions. The absence of HTTPS encryption across the site is a glaring critical vulnerability, undermining data confidentiality and trust. Key security headers are missing, increasing susceptibility to clickjacking, cross-site scripting, and content injection attacks. GDPR compliance is severely lacking, with no privacy or cookie policies and no consent mechanisms, risking heavy fines and reputational damage. Critical network services like MySQL and FTP are exposed without adequate protection, opening doors to unauthorized access and data exfiltration. The organization lacks foundational security policies, incident response plans, and vulnerability management, indicating poor security governance. DNS security is suboptimal, missing DNSSEC, which could allow domain spoofing or hijacking. While email security appears well-managed, other layers require urgent remediation to protect business continuity and customer trust.

I

IN Air Travel Experience

in-atx.com

45

The website's security posture is currently inadequate, with critical vulnerabilities primarily related to the absence of HTTPS encryption severely exposing user data and communications to interception. Significant GDPR compliance gaps, such as missing privacy and cookie policies and consent mechanisms, present legal and reputational risks. The lack of fundamental security headers increases the risk of common attacks like clickjacking and XSS, undermining user trust. Furthermore, the absence of an information security framework, incident response procedures, and vulnerability disclosure policies indicates immature security governance, which could lead to prolonged incident resolution and increased business disruption. While network security and email security scores are relatively strong, critical TLS and encryption failures overshadow these positives. Immediate remediation is needed to protect customer data, comply with regulations, and maintain business continuity. Overall, the organization faces substantial operational, legal, and reputational risks without swift action.

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and reputational damage. Key issues such as absence of HTTPS encryption and critical security headers severely undermine data confidentiality and integrity. The lack of GDPR compliance mechanisms, including missing cookie policies and consent banners, heightens the risk of legal penalties. Furthermore, the absence of documented security policies, incident response procedures, and vulnerability disclosure processes indicates immature security governance. Although email security and network security show moderate to good scores, these strengths are overshadowed by fundamental weaknesses in encryption and compliance. Immediate remediation is essential to protect customer data, maintain trust, and comply with regulatory frameworks such as GDPR and NIS2. Without urgent action, the business is vulnerable to cyberattacks and financial liabilities.

The website's overall security posture reveals significant vulnerabilities that could expose the business to substantial risks. The most critical issue is the lack of HTTPS encryption, which jeopardizes all data transmitted between users and the site, risking data interception and loss of trust. Medium-level issues such as missing security headers, absence of DKIM records for email, and failure to comply with GDPR and NIS2 regulations further increase the risk of data breaches, phishing, and regulatory penalties. DNS health concerns like missing DNSSEC and CAA records also reduce domain integrity and increase susceptibility to DNS hijacking. While network security is strong, the absence of foundational web security controls undermines the overall defense strategy. Immediate remediation is essential to protect customer data, ensure compliance, and maintain business reputation. Addressing these gaps will enhance user trust, reduce legal exposure, and strengthen the organization's cybersecurity posture.

M

Maison Goyard

goyard.com

52

The website's overall security posture reveals significant critical vulnerabilities, notably the complete lack of HTTPS encryption, which poses immediate risks to data confidentiality and user trust. Compliance with GDPR is severely lacking, with no cookie policy or consent mechanisms, exposing the business to regulatory penalties and reputational damage. The absence of fundamental information security frameworks and incident response procedures further increases operational risk and potential downtime from security incidents. While network security and DNS health show relatively strong scores, critical gaps in TLS/SSL and email security configurations undermine these strengths. Security headers are partially implemented but missing key policies that help mitigate common web-based attacks. Immediate remediation is necessary to safeguard customer data, comply with regulations, and protect business continuity. Addressing these issues will also enhance customer confidence and reduce legal and financial exposure.

L

Lloyds Bank plc

lloydsbank.com

48

The website's security posture is currently inadequate, with critical vulnerabilities that pose significant risks to business operations and compliance. The absence of HTTPS encryption is a major flaw, undermining data confidentiality and trust. GDPR compliance is severely lacking, with no privacy or cookie policies, and no consent mechanisms, exposing the business to regulatory penalties. The lack of key security headers like Content-Security-Policy increases the risk of cross-site scripting attacks. Additionally, the organization has not implemented fundamental NIS2 cybersecurity requirements, including incident response and security policy frameworks, which jeopardizes operational resilience. While network security and email security show some strengths, critical gaps remain that could lead to data breaches or service disruptions. Immediate action is necessary to safeguard customer data, maintain regulatory compliance, and protect the brand reputation. Overall, the security maturity is low, especially in encryption and governance controls, requiring urgent remediation.

P

Philips

philips.com

52

The website's overall security posture is concerning, with critical vulnerabilities related to the absence of HTTPS encryption, exposing all data transmissions to interception and manipulation. Compliance with GDPR and NIS2 regulations is severely lacking, including missing privacy and cookie policies, no cookie consent banner, and inadequate information security governance. While email and network security are strong, foundational security controls such as security headers and DNS health need improvement. The absence of incident response and business continuity plans further increases operational risk. Failure to comply with GDPR can result in significant legal penalties and reputational damage, while NIS2 non-compliance may affect business continuity and regulatory standing. Immediate remediation is essential to protect customer data, maintain trust, and avoid regulatory fines. The website is currently vulnerable to data breaches, regulatory penalties, and potential service disruptions due to these gaps.

O

One Partners

onepartners.com.br

42

The website's overall security posture is critically weak, exposing the business to significant cyber risks and regulatory non-compliance. The absence of HTTPS encryption is a critical vulnerability impacting data confidentiality and user trust, with cascading effects on GDPR and NIS2 compliance. Multiple missing security headers increase susceptibility to common web attacks such as clickjacking, MIME sniffing, and cross-site scripting. The exposure of critical services like MySQL and FTP without adequate protections further elevates the risk of data breaches and unauthorized access. Additionally, the lack of essential documentation and policies—including privacy, cookie, security, and incident response—exposes the organization to legal and operational risks. Although email security and DNS health scores are relatively strong, they do not compensate for the critical infrastructure and governance gaps. Immediate remediation is necessary to protect sensitive data, maintain customer confidence, and ensure regulatory compliance. Failure to act could result in financial losses, reputational damage, and potential regulatory penalties.

N

nuskin.com

nuskin.com

48

The website's overall security posture is critically weak, particularly due to the complete absence of HTTPS encryption, which exposes all data transmissions to interception and manipulation. Major compliance gaps exist, especially regarding GDPR and NIS2 requirements, including missing privacy and cookie policies, lack of consent mechanisms, and insufficient security governance documentation. Security headers are inadequately implemented, leaving the site vulnerable to common web-based attacks such as cross-site scripting. Although network security and email configurations are relatively strong, critical foundational controls like encryption and incident response frameworks are lacking. This combination of issues presents significant legal, operational, and reputational risks for the business. Immediate remediation is necessary to protect customer data, meet regulatory obligations, and maintain stakeholder trust. Without addressing these critical vulnerabilities, the business is exposed to data breaches, regulatory penalties, and loss of customer confidence.

G

GS Monaco

gsmonaco.com

42

The website exhibits a severely deficient security posture, with multiple critical vulnerabilities that expose the business to significant risks including data breaches, regulatory non-compliance, and service disruptions. Most notably, the absence of HTTPS encryption critically undermines data confidentiality and integrity, violating GDPR and NIS2 requirements and risking customer trust and legal penalties. The lack of key security headers such as Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options leaves the site vulnerable to man-in-the-middle attacks, clickjacking, and cross-site scripting. Additionally, missing privacy policies and cookie consent measures expose the business to compliance violations and reputational damage. Network services like FTP and SSH are exposed without adequate protections, increasing the attack surface. Overall, the current state indicates a lack of foundational cybersecurity governance and incident preparedness. Immediate remediation is essential to protect sensitive data, ensure regulatory compliance, and maintain business continuity. Without urgent action, the company risks financial loss, legal sanctions, and erosion of customer confidence.

M

Manens S.p.A.

manens-tifs.it

48

The website's overall security posture is critically weak, primarily due to the absence of HTTPS encryption, which exposes all data transmissions to interception and manipulation. Key security headers that mitigate various web attacks are largely missing, increasing the risk of cross-site scripting, clickjacking, and content sniffing attacks. Compliance with GDPR and NIS2 regulations is significantly lacking, posing legal and reputational risks, particularly due to missing cookie consent mechanisms, insufficient privacy policies, and lack of incident response and security documentation. Although email security and network security are relatively strong, critical deficiencies in web security and regulatory compliance overshadow these strengths. The absence of an information security framework and business continuity planning further jeopardizes operational resilience. Immediate remediation is essential not only to protect sensitive data and privacy but also to maintain customer trust and avoid substantial regulatory penalties. Without prompt and focused improvements, the business faces heightened exposure to cyber threats and compliance violations.

I

Indigo Books & Music Inc.

indigo.ca

54

The website's overall security posture reveals significant critical vulnerabilities, notably the complete absence of HTTPS encryption, which exposes data in transit to interception and compromises user trust. Compliance-related deficiencies are severe, with extremely low GDPR and NIS2 scores indicating non-compliance risks that could result in substantial regulatory penalties and reputational damage. While network security and email security are relatively strong, foundational security controls such as security headers are only moderately implemented and require improvement. The lack of formal security policies, incident response procedures, and vulnerability disclosure mechanisms further amplifies the organization's risk exposure. Additionally, missing cookie consent mechanisms and privacy policy issues threaten legal compliance with data protection laws. DNS health is good but can be enhanced by enabling DNSSEC to prevent DNS spoofing attacks. Immediate remediation is essential to protect sensitive user data, ensure regulatory compliance, and maintain business continuity.

D

Dimco

dimco.mc

49

The website's overall security posture is critically weak, primarily due to the complete absence of HTTPS encryption, exposing all data transmissions to interception and manipulation. The lack of essential security headers such as Strict-Transport-Security and Content-Security-Policy further increases vulnerability to common web-based attacks like man-in-the-middle and cross-site scripting. Additionally, the site fails to comply with GDPR requirements by not providing a privacy policy, cookie policy, or consent mechanisms, risking significant regulatory penalties and reputational damage. From a NIS2 directive perspective, there is a notable absence of documented security policies, incident response procedures, and security contact information, indicating poor organizational readiness for cyber incidents. Although email and network security settings are strong, these strengths are overshadowed by foundational security and compliance gaps. DNS configurations are somewhat healthy but can be improved with DNSSEC and CAA records to enhance domain authenticity and prevent certificate misuse. Immediate remediation is crucial to mitigate data breach risks, regulatory fines, and loss of customer trust, which can severely impact business continuity and growth.

T

TB Events

tbevents.nl

38

The website exhibits a severely deficient security posture with multiple critical vulnerabilities that expose it to significant risks, including data breaches, regulatory non-compliance, and reputational damage. The absence of HTTPS encryption is the most critical flaw, leaving all data transmissions unprotected and violating EU GDPR and NIS2 regulations. Key security headers are missing, increasing the risk of clickjacking, cross-site scripting, and content injection attacks. The lack of privacy policies and cookie consent mechanisms further exposes the business to legal and compliance penalties under GDPR. Critical gaps in information security frameworks, incident response, and business continuity planning indicate immature security governance. Email security mechanisms like DMARC and DKIM are partially implemented but need enforcement and reporting improvements. DNS security is moderate but can be enhanced by enabling DNSSEC and configuring CAA records. Overall, urgent remediation of encryption, privacy compliance, and security policy documentation is essential to safeguard business operations and customer trust.

S

Solamito Properties

solamito-properties.mc

44

The website's overall security posture is critically deficient, with multiple high and critical severity issues across key areas such as encryption, privacy compliance, and security policies. The absence of HTTPS encryption exposes all data transmissions to interception and manipulation, representing the most urgent risk to both users and business integrity. Critical gaps in GDPR compliance, including missing privacy and cookie policies as well as lack of cookie consent mechanisms, put the organization at risk of regulatory sanctions and reputational damage. Security headers essential for protecting against common web attacks are largely missing, increasing vulnerability to clickjacking, XSS, and other exploits. Furthermore, foundational governance elements like incident response procedures, security policies, and vulnerability disclosure frameworks are absent, indicating a lack of mature security management. DNS and email security posture are relatively strong, but these do not compensate for the critical failures in encryption and compliance. Immediate remediation is required to safeguard customer data, maintain trust, and meet legal obligations. Without prompt action, the organization faces significant operational, financial, and reputational risks.

T

Tur Assist

turassist.com

47

The website's overall security posture is critically weak, with multiple severe vulnerabilities primarily due to the absence of HTTPS encryption and inadequate security headers. The lack of HTTPS not only exposes sensitive data in transit but also results in non-compliance with GDPR and NIS2 regulations, posing significant legal and reputational risks. Key security headers such as Content-Security-Policy and X-Frame-Options are missing, increasing susceptibility to cross-site scripting and clickjacking attacks. Additionally, the absence of a privacy policy, cookie policy, and consent mechanisms indicates poor GDPR adherence, further risking regulatory penalties. The organization lacks foundational information security documentation, incident response procedures, and business continuity planning, undermining its ability to effectively manage and recover from security incidents. While email and network security appear strong, these do not compensate for the critical gaps in web and data protection. Immediate remediation is essential to protect customer data, maintain trust, and ensure compliance with legal frameworks. Overall, the current security posture exposes the business to high risk of data breaches, regulatory fines, and operational disruptions.

2

2PM Monaco

2pmmonaco.com

45

The website's security posture is critically weak, with multiple severe vulnerabilities that expose the business to significant risks including data breaches, regulatory penalties, and reputational damage. The absence of HTTPS encryption is the most critical flaw, undermining data confidentiality and integrity. Key security headers are largely missing, increasing susceptibility to common web attacks such as clickjacking, XSS, and content injection. Compliance with GDPR and NIS2 regulations is severely inadequate, notably lacking privacy policies, cookie consent mechanisms, and documented security and incident response procedures. While email and network security show strengths, the overall security framework is fragmented and insufficient for protecting sensitive data or maintaining customer trust. Immediate remediation is essential to mitigate potential legal liabilities and safeguard business continuity. Addressing these issues will not only enhance security but also improve customer confidence and regulatory compliance. Without urgent action, the organization remains exposed to high-impact cyber threats and operational disruptions.

C

Christofle

christofle.com

53

The website's overall security posture is currently weak, with critical deficiencies severely impacting confidentiality and compliance. The absence of HTTPS encryption is a critical vulnerability affecting user data security, regulatory compliance (GDPR, NIS2), and trustworthiness, exposing the business to legal and reputational risks. Governance around security policies, incident response, and vulnerability management is largely missing, indicating immature cybersecurity processes. GDPR compliance is particularly poor, lacking cookie consent mechanisms and compliant privacy disclosures, which risks regulatory penalties. While email security and network security show reasonably strong implementations, foundational web security headers are incomplete, increasing exposure to content injection and data leakage attacks. DNS security is moderate but could be improved with DNSSEC and CAA records. Immediate remediation of critical issues is required to protect customer data, ensure regulatory compliance, and maintain business continuity.

L

Lorenza Von Stein Luxury Real Estate

lorenzavonstein.com

42

The website's security posture is currently weak and exposes significant risks to both business operations and customer trust. Critical vulnerabilities include the absence of HTTPS encryption, lack of essential email authentication, and missing critical security headers, which collectively leave the site highly susceptible to data interception, phishing, and content injection attacks. Additionally, the absence of GDPR compliance elements such as privacy and cookie policies, along with no cookie consent mechanism, exposes the business to regulatory penalties and reputational damage. The lack of documented information security policies, incident response, and business continuity plans indicates unpreparedness for managing security incidents effectively. While network security and DNS health show relatively better scores, the overall security framework is insufficient for protecting sensitive customer data and ensuring legal compliance. Immediate remediation is necessary to safeguard business continuity, customer trust, and comply with legal requirements. Without urgent action, the business faces increased risks of data breaches, regulatory fines, and operational disruptions.

A

Athos Partners

athospartners.com

45

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory fines, and reputational damage. The absence of HTTPS encryption is a critical vulnerability affecting secure data transmission and compliance with GDPR and NIS2 regulations. Key security headers are missing, increasing susceptibility to clickjacking, cross-site scripting, and other web-based attacks. The lack of a cookie policy and consent mechanisms further exposes the organization to GDPR non-compliance and potential legal penalties. Additionally, the absence of documented security policies, incident response plans, and vulnerability disclosure processes indicates immature security governance. While email security and network security are relatively strong, foundational web security controls and regulatory compliance require urgent attention. Immediate remediation will protect customer data, ensure legal compliance, and enhance trust with stakeholders.

O

Oceanco

builtbyoceanco.com

50

The website's overall security posture presents significant risks, primarily due to the complete lack of HTTPS encryption, which is flagged as a critical issue across multiple security domains (GDPR, NIS2, SSL/TLS). This exposes the website and its users to data interception and undermines user trust. Additionally, there are severe compliance gaps with GDPR and NIS2 regulations, including missing privacy and cookie policies, lack of cookie consent mechanisms, and absence of essential security governance documents such as incident response and security policies. While network security and security headers are relatively strong, critical foundational elements like encryption and governance are missing, which could lead to regulatory penalties, reputational damage, and increased vulnerability to cyberattacks. The absence of a vulnerability disclosure policy and business continuity planning further exacerbates risks. On a positive note, email security and DNS health receive moderate scores but still require improvements to fully mitigate risks. Immediate remediation is imperative to protect the business, comply with regulations, and maintain customer trust.

J

JCC Consulting

jcc.com

45

The website's overall security posture is critically weak, primarily due to the complete absence of HTTPS encryption, exposing all data transmissions to interception and manipulation. Compliance with GDPR and NIS2 regulations is severely lacking, with missing cookie policies, consent mechanisms, and critical security governance documentation like incident response and security policies. Security headers are insufficiently implemented, increasing the risk of web-based attacks such as XSS and content injection. Email security practices show moderate maturity but require improvements to prevent domain spoofing and phishing. DNS security is relatively strong, but enabling DNSSEC and configuring CAA records would further protect domain integrity. Network security is well maintained, indicating some foundational controls are in place. Immediate remediation is necessary to protect customer data, maintain regulatory compliance, and safeguard the business reputation. Failure to act promptly could lead to data breaches, legal penalties, and loss of customer trust.

F

Federal Hotel

federal-hotel.com

40

The website exhibits a significantly weak security posture with multiple critical vulnerabilities, primarily due to the absence of HTTPS encryption, which exposes all data transmissions to interception and manipulation. Key security headers are missing, increasing susceptibility to common web-based attacks such as clickjacking, MIME sniffing, and cross-site scripting. GDPR compliance is severely lacking, with no privacy or cookie policies, no consent mechanisms, and insufficient contact information, risking regulatory penalties and loss of customer trust. The absence of an information security framework, security policies, and incident response procedures further highlights immature security governance, exposing the business to operational risks and regulatory non-compliance under frameworks like NIS2. Email authentication is inadequately configured, increasing the risk of phishing and email spoofing attacks. While network security and DNS health show some positive aspects, these strengths are overshadowed by critical gaps in encryption and governance. Immediate remediation is required to protect customer data, maintain trust, and comply with legal requirements, thereby safeguarding the business’s reputation and operational continuity.

M

Monte Carlo Capital

montecarlocap.com

42

The website's security posture is currently at high risk due to critical vulnerabilities, most notably the absence of HTTPS encryption, which compromises data confidentiality and integrity. Multiple missing security headers expose the site to common web attacks such as clickjacking, cross-site scripting, and MIME-type sniffing. The lack of GDPR compliance elements, including privacy and cookie policies and consent mechanisms, poses significant legal and reputational risks, especially in regulated markets. Deficiencies in NIS2-related controls, such as missing incident response procedures and security policies, indicate inadequate preparedness for cyber incidents. While network security and email security show relatively better scores, critical gaps in SSL/TLS and DNS configurations undermine overall security. Immediate remediation is necessary to protect user data, maintain trust, and avoid regulatory penalties. The current state may deter customers and partners concerned about data protection and compliance.

A

Albanu

albanu.mc

41

The website's security posture is currently poor with multiple critical and high-risk vulnerabilities identified, exposing the business to significant cyber threats and regulatory non-compliance. The absence of HTTPS encryption is a fundamental and critical weakness, undermining data confidentiality and integrity. Key security headers are missing or misconfigured, increasing susceptibility to web-based attacks such as clickjacking, cross-site scripting, and content injection. The lack of GDPR compliance elements, including privacy and cookie policies and consent mechanisms, presents legal and reputational risks, especially for customer data protection. Network security is compromised by exposure of high-risk services like FTP and SSH, which can be exploited for unauthorized access. Additionally, the absence of essential security governance documents and incident response procedures indicates immature security management practices. Immediate remediation is necessary to protect customer trust, comply with regulations, and safeguard business operations. Prioritizing these issues will reduce the risk of data breaches and potential financial and legal consequences.

O

Oracle Applications & Technology Users Group

oaug.org

40

The website exhibits a severely weak security posture with multiple critical vulnerabilities that expose the business to significant risk including data breaches, regulatory penalties, and service disruptions. The absence of HTTPS encryption across the site is a fundamental flaw, compromising data confidentiality and integrity while violating GDPR and NIS2 requirements. Critical services like MySQL and FTP are exposed, increasing the attack surface and risk of unauthorized access. Key security headers are missing, leaving users vulnerable to clickjacking and cross-site scripting attacks. The lack of GDPR compliance measures such as privacy policies and cookie consent mechanisms exposes the company to legal and reputational risks. Additionally, the absence of an information security framework, incident response plans, and security policies indicates poor organizational cybersecurity maturity. Email security is moderately strong but insufficient to offset the broader systemic issues. Immediate remediation is essential to protect business operations, customer trust, and regulatory compliance.

C

Centurion Bulk

centurionbulk.com

34

The website's overall security posture is critically weak, exposing the business to significant risks including data breaches, regulatory non-compliance, and service disruptions. The absence of HTTPS encryption is a critical vulnerability that undermines all data confidentiality and integrity, putting customer data and business communications at risk. Missing essential security headers such as Strict-Transport-Security and Content-Security-Policy increase susceptibility to common web attacks like man-in-the-middle, clickjacking, and cross-site scripting. Non-compliance with GDPR is evident due to missing privacy policies, cookie consent mechanisms, and third-party privacy disclosures, which can result in heavy fines and reputational damage. Several NIS2 directive requirements are unmet, including lack of incident response, security policies, and business continuity planning, exposing the company to operational risks and regulatory penalties. Network security is compromised by exposing critical services like FTP and MySQL publicly, heightening the risk of unauthorized access. Email security is moderately implemented but lacks enforcement and reporting mechanisms, potentially increasing phishing and spoofing risks. Overall, urgent remediation is needed to protect sensitive data, comply with regulations, and maintain customer trust.

M

Meridian4G

meridian4g.com

54

The website's overall security posture is significantly compromised, primarily due to the absence of HTTPS encryption, which is a critical vulnerability exposing user data to interception and undermining trust. Compliance with GDPR and NIS2 regulations is severely lacking, risking legal penalties and damage to brand reputation. While email security and network security modules score well, major gaps exist in policy documentation, incident response planning, and user privacy protections. The presence of exposed services like SSH and missing security headers further increase the attack surface. DNS security is moderate but can be improved to prevent DNS spoofing attacks. Immediate remediation is essential to safeguard customer data, ensure regulatory compliance, and maintain business continuity. Addressing these critical issues will also boost customer confidence and reduce the risk of costly breaches.