We ran our free Surface Check on 281 companies, and one result stood out: 90% of them have no MTA-STS policy, which means inbound email to their domain can still be delivered over an unencrypted connection. That is the single clearest theme in the data. The public basics are mostly in good shape, but a small set of quiet, easy-to-fix gaps repeats across almost the whole sample.
Before the numbers, a word on what this is and what it is not. As of August 2026, these figures come only from the 281 companies that have run our free Surface Check. This is not a representative study of every startup, and there are no domains or identities behind the numbers: they are anonymous aggregates of grades and findings. Read it as a snapshot of the teams who chose to look at their own external surface, not a survey of the whole market.
How the grades broke down
Every check ends in a single letter grade, from A to F, based on what a domain exposes to the public internet. Across the 281 companies, the spread was:
- A, 33%. The important public protections are in place, with little left for an opportunist to grab onto.
- B, 36%. Solid, with a short list of easy wins left. This was the most common grade.
- C, 22%. Several protections missing or misconfigured. Nothing exotic, just gaps that make a team an easier target than it needs to be.
- D, 7%. The basics are largely absent.
- F, 1%. Very little in place on the public surface.
The encouraging read is that most of the companies we checked are in reasonable shape on the outside. The less comfortable read is that the distance between a B and an A is usually a short list of missing headers and email settings, and almost everyone has at least one of them. A grade is a snapshot of the external surface only. It is not a verdict on the whole product, and, as we cover below, a strong grade can still sit over real internal gaps.
The gaps we saw most often
Here are the findings that came up most across the 281 checks, most common first, with why each one matters and the straightforward fix.
Email that can travel unencrypted (90%). Nine in ten domains publish no MTA-STS policy, so a message to your domain can be delivered without TLS if an attacker interferes with the connection. Email authentication was mostly healthy elsewhere: only 3% had no SPF record and 6% had no DMARC record at all, though 15% run DMARC in monitor-only mode, which watches but does not stop spoofed mail. The fix is to publish an MTA-STS policy and move DMARC to an enforcing setting once you have checked your legitimate senders. You can confirm your records with our free SPF checker and DMARC checker.
No way to report a problem (65%). Nearly two thirds of the domains publish no security.txt file, so a researcher who spots something has no obvious, trusted way to tell you. The fix is a short file at /.well-known/security.txt listing a contact address. It costs nothing and removes an awkward guessing game at exactly the wrong moment.
Missing browser security headers. This is where the long tail lives. A Referrer-Policy is absent on 62%, a Content-Security-Policy on 55%, and X-Content-Type-Options: nosniff on 46%. On 38% the site can be loaded inside a hostile frame, which is the basis of clickjacking, and 20% send no HSTS, so a first visit can be quietly downgraded to plain HTTP. These headers tell the browser how to protect your users, and most are a few lines of configuration. Our free security headers checker lists exactly which ones you are missing and what to set them to.
Software versions on display (21%). One in five domains advertise their software and version number in HTTP response headers. On its own this is low risk, but it hands an attacker a shortcut: they can match your version straight to a list of known issues. Turning off version banners is usually a single configuration change.
Cookies without the Secure flag (14%). Around one in seven set cookies without the Secure flag, so those cookies can be sent over an unencrypted connection. Setting the flag is a one-line change in most frameworks and closes an easy interception route.
What this means for you
The pattern across all 281 checks is consistent: the external basics are cheap to fix and quick to verify, yet the same few gaps keep slipping through. If you do nothing else, publish an MTA-STS policy, add the missing security headers, and put up a security.txt. That handful of changes would move a large share of these companies up a grade.
It is worth being just as clear about the limits. A passive external check cannot see inside your application, so a good grade is a good sign, not a clean bill of health. It will not catch a secret left in your code or config, or the internal access-control and data-handling issues that a list of surface findings will never reach. As we have written before, a list of vulnerabilities is not security: the value is in working through the findings and fixing them, not in collecting them.
Check your own surface
You can see where you sit against these numbers in about thirty seconds. Run a free Surface Check to get your own grade and a plain list of what to fix, then use the SPF, DMARC, and security headers checkers to confirm each change as you make it.
If you want a review that goes beyond the surface, into the access control, data handling, and configuration an external check cannot reach, our application security assessment is built for startups and fast-moving teams. We find and fix, prepare the remediation, and hand it to your team to deploy. And if a paid review turns up nothing beyond what the free Surface Check already showed you, you do not pay for it. You can get in touch through our website.