269 tracked UK hospital websites · scan of
UK Hospitals: External Cyber Posture
147 of 257 UK hospital websites do not enforce a policy against email being forged in their name. External assessment of 269 tracked websites, 13 October 2026.
Research
What whole sectors look like from the outside
We scan entire sectors the way anyone on the internet could see them — externally, and without logging into anything — then publish what we found, how we found it, and what it does not prove. Each study describes one scan run on one day.
132 UK family-office websites · scan of
How UK Family Offices Look to an External Scan
81 of 128 UK family offices cannot stop email being forged in their name. External scan of 132 websites, 28 September 2026.
193 UK wealth and investment management websites · scan of
How UK Wealth and Investment Managers Look to an External Scan
193 firm websites across the UK's wealth managers and investment managers, scanned from the outside on one day. Staff passwords are on criminal lists for 35 of the 184 reported firms; 53 cannot refuse email forged in their name.
152 UK bank and building society websites · scan of
How UK Banks and Building Societies Look to an External Scan
152 websites across the UK's banks and building societies, scanned from the outside on one day. Staff passwords are on criminal lists for 22 of the 148 reported organisations; none runs software on the known-exploited list.
379 UK council websites across four nations · scan of
How UK councils look to an external security and privacy scan
379 council websites across England, Wales, Scotland and Northern Ireland, scanned from the outside on one day. Staff password records are circulating for 122 of them; not one showed a ransomware listing, breach record or browser-safety warning.
43 UK airport-operator websites and 51 of their suppliers · scan of
How UK aviation looks to an external cyber security scan
43 UK airport-operator websites covering 54 airports, and 51 organisations those airports depend on, scanned from the outside on one day. Ten exposed staff credential records sit with the operators; 1,161 sit with the suppliers.
380 UK charitable organisations · scan of
How UK charities look to an external cyber security scan
Nearly half of best-known charities, and six in ten of the largest by income, have staff email addresses in infostealer credential collections across every period on record. None of the 380 organisations showed any sign of having been compromised.