Government Website Security 2026: 45% of State and Local .gov Sites Meet the Federal HSTS Bar, vs 91% of Federal
Government website security, measured: as of 11 November 2026, we scanned the homepage of every state, county and city domain on CISA’s .gov list (14,172 domains) plus 1,320 federal domains. Of 9,196 working state and local websites, 86% redirect to HTTPS, but only 45% meet a one-year HSTS policy or preload, against 91% of federal sites.
Key findings
- Of 14,172 state, county and city .gov domains on CISA’s list, 12,311 resolve in DNS and 9,196 returned a working homepage to a single scripted request.
- 86% of those state and local websites redirect plain HTTP to HTTPS, against 90% of 796 federal websites.
- Only 45% meet the federal-style HSTS bar (a Strict-Transport-Security max-age of at least one year, or a browser-preloaded domain), against 91% of federal websites.
- 18% of state and local hosts that completed a TLS handshake still accepted TLS 1.0 or 1.1, which RFC 8996 says MUST NOT be used; for federal hosts the figure is 5%.
- 37% send a Content-Security-Policy header, 55% send X-Content-Type-Options: nosniff and 38% send a Referrer-Policy; only 11% pass all six of our HTTPS and header checks.
- Washington has the highest average web hygiene score (79.1 of 100) among 49 states with at least 15 scanned sites, and Michigan the lowest (60.2).
- 44% of state and local homepages carry a CDN or edge provider’s headers, most often Cloudflare (3,081 sites), and 1,244 of the 1,980 hosts that still accept TLS 1.0 or 1.1 sit behind Cloudflare, whose documented default is TLS 1.0.
Free to cite and republish with a link to this page. Results are aggregates; we do not publish results for individual websites.
State web hygiene scores
Each working homepage gets a score out of 100 from seven passive checks, and a state’s score is the plain average across all of its state agency, county and city .gov homepages. Washington, Massachusetts and Connecticut lead; Michigan, Kentucky and Delaware trail. States with fewer than 15 working sites are shown but not ranked.
Darker tiles score higher. Hover a tile for the score, rank and number of websites. Dashed tiles had fewer than 15 working .gov homepages in the scan.
- 20 points: HTTPS with a valid certificate
- 20 points: HTTP redirects to HTTPS
- 15 points: HSTS max-age of at least one year, or domain preloaded
- 15 points: TLS 1.0 and 1.1 refused
- 10 points: Content-Security-Policy header
- 10 points: X-Content-Type-Options: nosniff
- 10 points: Referrer-Policy header
A site with every check passing scores 100. State and local average: 67.6. Federal average on the same formula: 80.8.
Every state, sortable
Click a column header to sort. Percentages are shares of each state’s working state, county and city .gov homepages, except the TLS 1.0/1.1 column, which is a share of hosts that completed a TLS handshake.
| Rank | State | Sites | Score | Valid HTTPS | HTTP to HTTPS | HSTS 1 yr or preload | Accepts TLS 1.0/1.1 | CSP | nosniff | Referrer-Policy | CDN seen |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Washington | 134 | 79.1 | 99% | 93% | 40% | 10% | 64% | 80% | 68% | 38% |
| 2 | Massachusetts | 255 | 77.0 | 96% | 89% | 25% | 9% | 72% | 83% | 74% | 29% |
| 3 | Connecticut | 116 | 76.9 | 94% | 94% | 37% | 11% | 62% | 80% | 67% | 46% |
| 4 | Colorado | 139 | 76.4 | 98% | 89% | 59% | 13% | 50% | 65% | 55% | 49% |
| 5 | Arizona | 112 | 75.3 | 89% | 90% | 55% | 9% | 57% | 73% | 56% | 66% |
| 6 | Texas | 470 | 75.1 | 92% | 86% | 45% | 11% | 61% | 75% | 65% | 35% |
| 7 | Oregon | 128 | 74.6 | 95% | 88% | 58% | 12% | 55% | 73% | 45% | 36% |
| 8 | California | 323 | 74.4 | 93% | 84% | 45% | 14% | 60% | 75% | 63% | 42% |
| 9 | Maryland | 87 | 73.3 | 97% | 92% | 43% | 13% | 46% | 70% | 54% | 45% |
| 10 | Virginia | 149 | 72.7 | 91% | 86% | 32% | 10% | 60% | 78% | 63% | 40% |
| 11 | Rhode Island | 40 | 72.2 | 98% | 78% | 48% | 17% | 48% | 68% | 55% | 35% |
| 12 | Wyoming | 47 | 72.1 | 85% | 89% | 55% | 10% | 53% | 70% | 51% | 45% |
| 13 | Florida | 338 | 71.8 | 92% | 88% | 51% | 18% | 51% | 65% | 49% | 51% |
| 14 | North Carolina | 241 | 71.3 | 97% | 85% | 51% | 17% | 44% | 66% | 39% | 48% |
| 15 | New Hampshire | 140 | 70.9 | 95% | 84% | 39% | 10% | 53% | 57% | 51% | 38% |
| 16 | Maine | 101 | 70.1 | 95% | 87% | 43% | 10% | 45% | 63% | 41% | 43% |
| 17 | Georgia | 235 | 70.1 | 96% | 85% | 43% | 10% | 40% | 58% | 45% | 34% |
| 18 | North Dakota | 45 | 70.0 | 93% | 93% | 51% | 10% | 24% | 71% | 31% | 20% |
| 19 | Idaho | 46 | 69.1 | 98% | 85% | 59% | 22% | 35% | 52% | 37% | 65% |
| 20 | South Carolina | 83 | 69.0 | 99% | 86% | 49% | 18% | 29% | 53% | 42% | 47% |
| 21 | Iowa | 145 | 69.0 | 93% | 91% | 48% | 22% | 48% | 59% | 24% | 46% |
| 22 | Nevada | 32 | 68.9 | 94% | 91% | 53% | 12% | 25% | 56% | 38% | 59% |
| 23 | Kansas | 153 | 68.6 | 93% | 80% | 41% | 21% | 42% | 67% | 51% | 48% |
| 24 | Vermont | 70 | 68.3 | 96% | 94% | 53% | 24% | 30% | 56% | 24% | 41% |
| 25 | Nebraska | 81 | 68.1 | 98% | 75% | 70% | 7% | 26% | 43% | 26% | 42% |
| 26 | Oklahoma | 138 | 67.8 | 98% | 75% | 49% | 15% | 35% | 60% | 38% | 40% |
| 27 | Utah | 209 | 67.3 | 98% | 90% | 46% | 22% | 29% | 51% | 37% | 59% |
| 28 | Alaska | 22 | 66.8 | 91% | 86% | 36% | 19% | 41% | 68% | 41% | 59% |
| 29 | Illinois | 265 | 66.7 | 97% | 80% | 55% | 17% | 29% | 47% | 32% | 40% |
| 30 | New Mexico | 69 | 66.4 | 97% | 71% | 41% | 14% | 38% | 59% | 42% | 42% |
| 31 | Minnesota | 453 | 66.4 | 96% | 89% | 35% | 16% | 30% | 54% | 37% | 38% |
| 32 | Tennessee | 219 | 66.4 | 96% | 85% | 42% | 12% | 33% | 49% | 30% | 37% |
| 33 | South Dakota | 48 | 66.4 | 98% | 83% | 42% | 32% | 46% | 50% | 46% | 44% |
| 34 | Missouri | 215 | 66.1 | 95% | 80% | 51% | 16% | 32% | 47% | 33% | 39% |
| 35 | Montana | 87 | 65.7 | 93% | 86% | 46% | 22% | 24% | 54% | 34% | 33% |
| 36 | Louisiana | 72 | 65.7 | 96% | 82% | 56% | 25% | 28% | 49% | 33% | 58% |
| 37 | Ohio | 391 | 65.3 | 96% | 87% | 40% | 23% | 30% | 52% | 31% | 43% |
| 38 | New Jersey | 206 | 64.8 | 95% | 89% | 34% | 12% | 33% | 42% | 32% | 50% |
| 39 | New York | 993 | 63.3 | 97% | 88% | 28% | 15% | 26% | 45% | 27% | 51% |
| 40 | Indiana | 94 | 63.1 | 90% | 87% | 48% | 24% | 22% | 51% | 22% | 36% |
| 41 | Alabama | 165 | 63.1 | 90% | 81% | 45% | 14% | 25% | 47% | 30% | 40% |
| 42 | West Virginia | 94 | 63.0 | 91% | 85% | 55% | 20% | 17% | 43% | 19% | 36% |
| 43 | Arkansas | 232 | 62.2 | 96% | 78% | 44% | 22% | 23% | 46% | 28% | 45% |
| 44 | Pennsylvania | 259 | 62.2 | 92% | 79% | 45% | 12% | 24% | 41% | 27% | 30% |
| 45 | Wisconsin | 586 | 62.1 | 95% | 85% | 67% | 33% | 19% | 33% | 17% | 50% |
| 46 | Mississippi | 71 | 61.9 | 93% | 70% | 51% | 12% | 24% | 48% | 24% | 31% |
| 47 | Delaware | 16 | 61.9 | 94% | 88% | 25% | 24% | 44% | 44% | 38% | 25% |
| 48 | Kentucky | 137 | 61.6 | 94% | 78% | 50% | 17% | 19% | 44% | 22% | 40% |
| 49 | Michigan | 411 | 60.2 | 97% | 91% | 46% | 40% | 21% | 30% | 23% | 54% |
| n/a | District of Columbia | 7 | 56.4 | 100% | 86% | 14% | 12% | 14% | 29% | 0% | 71% |
| n/a | Hawaii | 10 | 55.5 | 90% | 80% | 40% | 42% | 30% | 30% | 20% | 80% |
Federal vs state vs local
Federal executive agencies have been under Binding Operational Directive 18-01 since 16 October 2017, which requires HTTPS-only service with HSTS, and OMB memo M-22-09 (26 January 2022) told agencies to preload their .gov domains. No equivalent mandate covers state, county or city sites, and the measurements follow that line. Valid HTTPS is common at every level, from 88% of state-agency sites to 97% of federal ones; HSTS is where federal sites pull away, by 46 percentage points on the one-year HSTS check. Automatic preloading of new .gov domains is quietly closing part of the gap: 1,672 working state and local sites send no HSTS header at all but are protected anyway because their domain is on the browser preload list, which is why counties (54%) beat state agencies (49%) on this check.
Share of working homepages passing each check, by the domain type CISA records. Federal includes executive, legislative and judicial domains.
| Type | Domains listed | Resolve | Working sites | Valid HTTPS | HTTP to HTTPS | HSTS sent | HSTS 1 yr or preload | Preloaded | TLS 1.3 | Accepts TLS 1.0/1.1 | CSP | nosniff | Referrer-Policy | Score |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Federal | 1,320 | 1,125 | 796 | 97% | 90% | 91% | 91% | 63% | 79% | 5% | 42% | 81% | 36% | 80.8 |
| State | 1,488 | 1,245 | 730 | 88% | 89% | 49% | 49% | 18% | 81% | 13% | 27% | 55% | 18% | 64.6 |
| County | 3,065 | 2,592 | 1,770 | 94% | 82% | 33% | 54% | 38% | 78% | 18% | 39% | 56% | 40% | 68.9 |
| City | 9,619 | 8,474 | 6,696 | 96% | 86% | 31% | 42% | 25% | 75% | 18% | 37% | 54% | 40% | 67.6 |
| 50 state portals | 50 | 50 | 35 | 91% | 91% | 71% | 57% | 3% | 70% | 17% | 20% | 66% | 26% | 67.4 |
Timeline: the rules behind the gap
| Date | Event | Applies to |
|---|---|---|
| May 2017 | .gov registry begins automatically preloading new federal executive branch domains | New federal executive domains |
| 16 Oct 2017 | CISA (then DHS) issues BOD 18-01: HTTPS-only with HSTS, SSLv2, SSLv3, 3DES and RC4 disabled, within 120 days | Federal executive agencies |
| Aug 2018 | Other newly registered .gov domains may opt in to preloading | New state, local and other .gov domains |
| 1 Sep 2020 | All newly registered .gov domains are preloaded automatically | Every new .gov domain |
| Mar 2021 | RFC 8996: TLS 1.0 and TLS 1.1 MUST NOT be used | Internet standard |
| 21 Jun 2021 | .gov program announces its intent to preload the whole .gov top-level domain (not yet done) | All .gov domains, eventually |
| 26 Jan 2022 | OMB M-22-09 tells agencies to work with CISA to preload their .gov domains | Federal agencies |
| 21 Oct 2026 | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619 | Any site running PHP |
| 11 November 2026 | This scan: 14,172 state and local and 1,320 federal .gov domains | Refreshed with each update of this page |
The 50 state portals (one primary .gov portal domain per state, such as ca.gov or texas.gov) score 67.4 on average, above the 64.6 average for all 730 working state-government websites. 35 of the 50 returned a working homepage to our request.
Header adoption matrix
HTTPS is nearly universal; the browser-side protections that sit on top of it are not. The matrix shows each header’s adoption rate for each government level and for sites with and without a CDN in front. A Content-Security-Policy is counted when the header is present at all; the “CSP with script rules” column counts only policies with a default-src or script-src directive, which is what limits injected scripts. Many policies we saw contain only upgrade-insecure-requests or frame-ancestors.
Cell value = percent of working homepages sending the header (or passing the check). “Framing” counts X-Frame-Options or a CSP frame-ancestors directive.
Legacy TLS lives mostly at the CDN edge
18% of state and local hosts accepted a handshake capped at TLS 1.1, even though RFC 8996 (March 2021) says TLS 1.0 and 1.1 MUST NOT be used and NIST SP 800-52 Rev. 2 requires government servers to support TLS 1.2. The rate splits sharply by what sits in front of the site. Behind Cloudflare, 41% of hosts accepted the old protocols; with no CDN header seen, 5% did. Cloudflare’s own documentation says “TLS 1.0 is the version that Cloudflare sets by default”, so many of these are an unchanged dashboard setting, not an old server. That is the cheapest fix in this report: a single minimum TLS version setting at the edge.
| CDN or edge provider (from response headers) | State and local sites | Share of working sites | Accepts TLS 1.0/1.1 | HSTS 1 yr or preload |
|---|---|---|---|---|
| Cloudflare | 3,081 | 33.5% | 41% | 47% |
| Azure Front Door / CDN | 267 | 2.9% | 2% | 42% |
| Fastly | 231 | 2.5% | 1% | 77% |
| Akamai | 158 | 1.7% | 4% | 97% |
| Amazon CloudFront | 126 | 1.4% | 6% | 67% |
| Vercel / Netlify / GitHub Pages | 69 | 0.8% | 1% | 100% |
| Imperva | 49 | 0.5% | 2% | 31% |
| Sucuri | 43 | 0.5% | 2% | 21% |
Providers are identified only from response headers (for example cf-ray for Cloudflare, x-amz-cf-id for CloudFront, akamai-grn for Akamai). Sites behind a provider that adds no identifying header are counted as “no CDN seen”.
Certificates and software banners
Certificates
Of 11,339 state and local hosts that completed a TLS handshake, 500 presented a certificate that failed standard validation (expired, wrong hostname or incomplete chain), 75 had already expired, 705 (6.2%) expire within 30 days of the scan and 27 within 7 days. Certificates that renew automatically often sit inside a 30-day window for a short time, so the 7-day count is the stronger warning sign.
PHP version banners after 21 October
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to fix two critical, unauthenticated remote code execution flaws (CVE-2026-109618 and CVE-2026-109619). 435 of 9,196 state and local homepages announce an exact PHP version in their X-Powered-By header, and 119 of those announce a version older than the 21 October releases. A banner can be stale or patched by a Linux distribution, so this measures version disclosure, not exposure.
What this means for MSPs and government IT teams
Most of the gap between local and federal sites is configuration, not new spending. In order of effort: set the CDN or load balancer minimum TLS version to 1.2 (1,270 of the 1,980 legacy-TLS hosts we found sit behind a CDN, 1,244 of them behind Cloudflare); add Strict-Transport-Security with max-age=31536000 once every subdomain serves HTTPS, then submit the domain at hstspreload.org; add X-Content-Type-Options: nosniff and a Referrer-Policy, two static headers that rarely break anything; and only then build a real Content-Security-Policy, which needs testing against each site’s scripts. Remove version numbers from X-Powered-By and Server headers. If you support municipal clients, the same checks on their mail domains are in our DMARC adoption statistics, and patch priority for the platforms behind these sites belongs with the CISA Known Exploited Vulnerabilities analysis.
How we compare with earlier studies
The most-cited figure on this topic is from August 2018, when ITIF’s Benchmarking State Government Websites found that only 44 percent of 400 state government websites passed its HTTPS test, which graded certificate and TLS configuration. Our test is different (valid certificate and a working HTTPS homepage), so the two numbers are not directly comparable, but on today’s data 88% of 730 working state-government websites pass our HTTPS check. For registration trends across top-level domains, see our domain name statistics.
Frequently asked questions
How secure are government websites?
On basic transport security, most are fine: 95% of 9,196 state and local .gov homepages we scanned on 11 November 2026 serve HTTPS with a valid certificate and 86% redirect HTTP to HTTPS. The gaps are in hardening: 45% meet a one-year HSTS policy or preload, 37% send a Content-Security-Policy, and 18% still accept TLS 1.0 or 1.1. Federal sites, which fall under BOD 18-01, score 80.8 of 100 on our index against 67.6 for state and local sites.
Are .gov websites secure?
A .gov domain proves the site belongs to a verified US government body, and since 1 September 2020 every newly registered .gov domain is HSTS preloaded. Older domains are not automatically covered: 27% of state and local .gov websites in our scan are on Chromium’s preload list, against 63% of federal ones.
Which state has the most secure government websites?
In our November 2026 scan, Washington (79.1), Massachusetts (77.0) and Connecticut (76.9) had the highest average web hygiene scores across their state, county and city .gov homepages. The score is a 100-point index of seven passive checks; the table above has every state.
How can I check a government website’s security online?
Look for https:// and the .gov ending, then check the response headers. From a terminal, ‘curl -sI https://example.gov/’ shows Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy, and the preload status of a domain is public at hstspreload.org. These are the same checks used for the 9,196 sites in this study.
Who is responsible for the security of a government website?
The government body that registered the .gov domain. CISA runs the .gov registry and lists a security contact for each domain, but it does not operate state or local websites. Federal agencies are bound by BOD 18-01; state, county and city governments are not, and their one-year HSTS rate (45%) trails the federal rate (91%).
Do state and local government websites still use TLS 1.0?
Some accept it. 18% of 11,339 state and local hosts that completed a modern handshake also completed a handshake capped at TLS 1.1. Of those, 1,244 of 1,980 sit behind Cloudflare, whose documentation says TLS 1.0 is the version it sets by default.
Free to cite and republish with a link to this page. The CSV holds the aggregates by government type, state and CDN provider shown above. It contains no per-website results.
Methodology
Population. CISA’s dotgov-data file current-full.csv (CC0 1.0, last updated 10 November 2026), domain types City, County and State or territory for the state and local groups, and Federal, Federal – Executive, Federal – Legislative and Federal – Judicial for the benchmark. States are the two-letter state field in the file; territories are kept in the totals but not ranked. Each registered domain counts once; we tested the apex domain, or www when only www resolved.
What our code did per domain. One DNS lookup each for A and AAAA records; one GET of /robots.txt (a site whose robots.txt disallowed “/” for all agents was not fetched further: 108 state and local sites); one GET of http://domain/ with redirects followed hop by hop; one GET of https://domain/ only when the HTTP chain did not end on HTTPS; one TLS handshake with default settings (protocol version, certificate validity and expiry); and one TLS handshake capped at TLS 1.1 with no other probing. Nothing else was requested: no other paths, ports, forms or logins. User-Agent: UptimeReportResearch/1.0 (+https://theuptimereport.com/about/). Requests were capped at 6 per second across all hosts and run one at a time per host with at least 0.6 seconds between them; DNS used 5 concurrent lookups. Scan date: 11 November 2026.
Definitions. Working site: the final response had status below 400 (2,080 state and local homepages, including 274 state-agency ones, answered our request with an error status, most often a 403 from a bot-protection layer, and are excluded from header rates and scores; their TLS results are still counted). Valid HTTPS: a TLS handshake that passed standard certificate and hostname validation. HTTP to HTTPS: the HTTP chain ended on an https:// URL. HSTS one year: a Strict-Transport-Security max-age of at least 31,536,000 seconds on the final HTTPS response (the “strong HSTS” threshold in CISA’s pshtt scanner), or a domain on Chromium’s HSTS preload list in force-https mode. Legacy TLS accepted: the TLS 1.1-capped handshake completed with TLS 1.0 or 1.1. CDN: identified from response header names and values only.
Limitations. One request per check is a snapshot; headers can vary by page, and some sites block scripted traffic. Domains used only for email or redirects count as listed but not as working sites. A CDN accepting TLS 1.0 at its edge does not mean the origin server does. State scores mix state, county and city sites in the proportions each state has registered on .gov, and many local governments use .us, .org or .com domains that this list does not cover.
Not advice. This is a measurement of public responses, not a security assessment of any organization. We do not publish results for individual sites.
Cite as:The Uptime Report. "Government Website Security 2026: 45% of State and Local .gov Sites Meet the Federal HSTS Bar, vs 91% of Federal." November 2026. https://theuptimereport.com/government-website-security-study-2026/
References
- CISA, dotgov-data repository (current-full.csv), CC0 1.0. Accessed November 2026.
- Chromium, HSTS preload list (transport_security_state_static.json). Accessed November 2026.
- CISA, Binding Operational Directive 18-01: Enhance Email and Web Security. Accessed November 2026.
- OMB, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles. Accessed November 2026.
- CISA, pshtt scanner documentation (Strong HSTS definition). Accessed November 2026.
- get.gov, Security best practices for .gov domains. Accessed November 2026.
- get.gov, An intent to preload (June 2021). Accessed November 2026.
- IETF, RFC 8996: Deprecating TLS 1.0 and TLS 1.1. Accessed November 2026.
- NIST, SP 800-52 Rev. 2. Accessed November 2026.
- Cloudflare, TLS protocols documentation. Accessed November 2026.
- PHP, 21 October 2026 security release announcements. Accessed November 2026.
- ITIF, Benchmarking State Government Websites (August 2018). Accessed November 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- AT&T Data Breach Settlement Payout Date
AT&T payout status, tiers, incident history - Microsoft Data Breach History
Microsoft incidents by type, 2020 to 2026 - IC3 Report 2025
IC3 losses, crime types, states per capita - AI Incidents Statistics 2026
AI incidents by year, harm type, company - Cyber Attacks 2026
Every 2026 cyber attack, primary-sourced - WordPress Vulnerabilities
WordPress plugin, theme and core CVEs - Hypervisor Vulnerabilities
Hypervisor CVEs vs exploitation - DMARC Adoption Statistics 2026
DMARC enforcement, 15,000 domains - RMM Vulnerabilities and Remote Access Flaws
RMM and remote access flaws in KEV - Identity Theft Statistics 2026
ID theft per 100K by state and type - Scam Statistics 2026
FTC fraud losses by channel and age - VPN Vulnerabilities by Vendor
VPN gateway KEV and CVEs by vendor - MFA Statistics 2026
MFA methods across 2,571 services - Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend - ConnectWise ScreenConnect Vulnerabilities
ScreenConnect CVEs dated, with version lookup - SonicWall Vulnerabilities 2026
SonicWall CVEs by product line and KEV year - Dental Practice Data Breaches 2026
Every 2026 dental breach on the HHS portal - Apple Zero Days 2026 List
Every Apple-flagged CVE, with KEV dates - Android Zero Days 2026
Android flags by layer, OEM patch lag - Auto Dealership Data Breach 2026 Tracker
Dealer and vendor breaches by state filing - Law Firm Data Breaches 2026
Every law firm AG notice, sized and dated - Accounting Firm Data Breach 2026
CPA breach notices against the tax calendar - Bank DMARC Adoption 2026
DMARC at 4,118 US banks, by size - MSP Email Security
MSP DMARC and SPF, 1,430 domains - Credit Union Cybersecurity Statistics 2026
55% of credit unions skip DMARC - Citrix NetScaler Vulnerabilities 2026
48 NetScaler CVEs, 6 exploited, build checker - Fortinet Vulnerabilities 2026
Every 2026 Fortinet CVE, by product - Okta Vulnerabilities
Okta CVEs and incidents, two ledgers - Veeam Vulnerabilities
Veeam CVEs, fixed builds, KEV flags - Atlassian Confluence Vulnerabilities
Confluence CVEs, KEV and LTS fixes - SolarWinds Vulnerabilities
338 SolarWinds CVEs, 11 exploited in KEV - SAP NetWeaver Vulnerabilities
Every SAP NetWeaver CVE, by Patch Day - N-able Vulnerabilities
N-able CVEs, fixed builds and KEV flags
Infrastructure and uptime
- Data Centers Using Nuclear Power
Every US nuclear deal, by NRC stage - Claude Outage History
934 Claude incidents by model and hour - AMD vs Nvidia Market Share Over Time
AMD vs Nvidia share: Steam and SEC filings - iPhone Market Share by Country 2026
iPhone share in every country - Android Market Share by Version 2026
Android versions and patch status - OpenAI Outage History
1,051 OpenAI incidents, causes coded - Data Center Construction Spending 2026
Data center build spending, Census monthly - Microsoft End of Support 2026
Every 2026 Microsoft support cutoff - Fiber Internet Availability by State 2026
Fiber by state, build pace, top providers - 5G Coverage Map 2026
5G by state and carrier, FCC data - Cell Phone Outage History
FCC outages, DIRS cell sites, 911 fines - Mac Market Share 2026
Mac desktop share by country and version - Browser Market Share 2026
Browser share since 2009, by platform - Microsoft 365 Market Share 2026
Who runs email: Microsoft vs Google - CrowdStrike Outage
July 19, 2024 outage, minute by minute - Data Center Electricity Prices 2026
Power prices vs data center load, by state - Average Internet Bill 2026
Home internet prices by speed and state - Search Engine Market Share 2026
Search share since 2009, by country - ChatGPT Market Share 2026
AI chatbot referral share, every tracker - Google Cloud Outage History
Google Cloud incidents by product, 2013 on - Azure Outage History
Every Azure PIR, coded by root cause - Data Center Water Usage 2026
Water by site, company and drought - AI Energy Consumption 2026
Big Tech electricity vs US demand - SSD Prices 2026
NAND price cycle from makers’ filings - RAM Prices 2026
DRAM prices from producers’ filings - Domain Name Statistics 2026
Domains by TLD, renewals, registrars - Linux Market Share 2026
Linux desktop share, every headline traced - GitHub Outages
GitHub incidents by month since 2020 - Cloudflare Outage History
Every Cloudflare outage post-mortem - Starlink Statistics 2026
Satellites, subscribers, coverage, outages - Internet Access Statistics 2026
Home internet gaps by state and group - SQL Server End of Life
SQL Server support countdown + CVEs - Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version - SQL Server 2016 ESU Cost
ESU cost calculator, every formula - Slack Outage History
1,459 Slack entries, SLA history, ledger - Google Workspace vs Microsoft 365 in US Schools
Google vs Microsoft in 10,591 districts - Block GPTBot
AI crawler blocks across top 10k sites - security.txt Adoption 2026
Who publishes a valid security.txt - Government Email Security 2026
.gov DMARC: local 40% vs federal 88% - vSphere 8 End of Support
vSphere 8 dates, exploited flaws by version - Office 2019 End of Life
Office 2019 EOL: who still gets patches - Zoom Outage History
Every Zoom incident since 2015 - Office 2021 End of Life
177 flaws fixed a month after support ended - Exchange Server 2019 End of Life
Exchange 2019 EOL, ESU builds and CVEs - FortiOS 7.0 End of Life
FortiOS 7.0 dates, builds and unfixed flaws
Regulation and disclosure
- Are Ransomware Payments Illegal? Law by Jurisdiction
Who may pay a ransom, by jurisdiction - HIPAA Security Rule Changes 2026
Security Rule status: current vs proposed - FTC Safeguards Rule Breach Notification
500-consumer, 30-day FTC breach duty - Data Center Moratorium by State 2026
Moratoria and bans in every state - State Privacy Laws 2026
23 state privacy laws, compared - State AI Laws 2026
131 state AI laws, dates and penalties - FedRAMP Statistics 2026
FedRAMP authorizations, GSA data - Item 1C Cybersecurity Disclosures
What 600 10-Ks say in Item 1C - CMMC Certification Statistics 2026
CMMC demand vs assessor capacity - Data Brokers List 2026
728 brokers across three state registries - SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement - CMMC Level 2 Assessment Cost
CMMC Level 2 cost estimator, DoD figures - Safe Harbor Cybersecurity Laws by State
10 states, 11 laws, framework grid
Workforce and pay
- Intel Layoff Tracker
Every Intel WARN notice, by site and date - Amazon Layoffs by State
Amazon WARN notices, state by state - Oracle Layoffs by State
Oracle WARN notices and restructuring cost - Cloud Architect vs Cloud Engineer Salary
Architect vs engineer pay, H-1B filings - Entry Level DevOps Engineer Salary
Entry level DevOps pay, H-1B filings - Microsoft Layoff History Timeline
Every round dated, 2009 to 2026 - Google Layoffs by Year
Notices, headcount, severance by year - AI Engineer vs ML Engineer Salary
AI vs ML engineer pay, from H-1B filings - Data Engineer Salary by Experience
Data engineer pay by DOL wage level - Most Popular Programming Languages 2026
Language ranks by country, GitHub data - Computer Science Graduates Per Year
CS degrees per year, IPEDS 2011 to 2024 - Data Scientist Salary 2026
Data scientist pay ladder and metros, BLS - Web Developer Salary 2026
Web dev vs software pay by state, BLS - AI at Work Statistics 2026
Worker AI use: ever, weekly, daily, by job - Network Engineer Salary 2026
Network engineer vs admin pay, BLS - IT Manager Salary 2026
IT manager pay by industry, BLS OEWS - Software Engineer Salary 2026
Developer pay by metro, BLS OEWS - H-1B Statistics 2026
H-1B lottery, employers, and wages - AI Layoffs 2026
AI-blamed job cuts, sourced to filings - Help Desk Salary 2026
Help desk hourly pay, BLS OEWS - Cybersecurity Salary 2026
Security pay percentiles, BLS OEWS - Women in Tech Statistics 2026
Women’s share of tech jobs since 2011 - IT Unemployment Rate 2026
Tech vs national jobless rate, monthly - Tech Job Postings 2026
Tech postings vs 2020, by role and country - Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections - Salesforce Layoffs by State
Salesforce WARN notices, state by state - Dell Layoffs by Year
Headcount, severance, notices by year - IBM Layoffs by Year
IBM workforce charges against headcount - Meta Layoffs by Year
Meta rounds, sites and headcount by year - IT Director vs IT Manager Salary
IT director vs manager pay, H-1B filings - Penetration Tester Salary Entry Level
Entry level pen test pay, H-1B filings - Site Reliability Engineer vs DevOps Salary
SRE vs DevOps pay, H-1B filings - Solutions Architect vs Software Engineer Salary
Architect vs engineer pay, Level I to IV - Data Engineer vs Data Analyst Salary
Data engineer vs analyst pay, H-1B ledger - Network Engineer vs System Administrator Salary
Network engineer vs sysadmin pay by state - Security Analyst vs Security Engineer Salary
Analyst vs engineer pay, step by step - Cloud Engineer vs DevOps Engineer Salary
Cloud vs DevOps pay by metro, H-1B - Cisco Layoffs by Year
Cisco cuts by year: charges vs staff - Database Administrator vs Data Engineer Salary
DBA vs data engineer pay, reconciled - Penetration Tester vs Security Engineer Salary
Pen tester vs engineer pay: near tie - Help Desk vs Desktop Support Salary
Help desk vs desktop pay, one BLS code
MSP market and spending
- AI Capex 2026
Big Tech capex vs cash flow, SEC data - Cybersecurity Budget 2027
Federal and CISA cyber budgets, benchmarks - Microsoft 365 Price Increase 2026
Every M365 price change, vs inflation - Computer Prices 2026
Computer price indexes and HS 8471 imports - MSP Market Size 2026
Managed services market, built from Census - Small Business AI Adoption 2026
AI use by firm size, sector, state, Census - Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas - How Much Do MSPs Charge Per User?
Published MSP prices, 1,310 websites - VMware Price Increase Broadcom Timeline
Broadcom VMware changes and revenue, dated - Adobe Price Increase History
Every Adobe price change, vs inflation - Atlassian Price Increase History, 2019 to 2026
Every Atlassian price hike, dated - Zoom Price Increase 2026
Every Zoom price change since 2013
Leave a Reply