DigitalXForce Research
DigitalXForce Research publishes original, citable studies built from public data and the DigitalXForce assessment models. The first study, the DigitalXForce Security Posture Benchmark 2026, scores the published security answers of 2,112 companies in the CSA STAR Registry. Every figure is free to reuse under CC BY 4.0 with credit and a link.
Last updated 22 October 2026.
Security Posture Benchmark 2026
The benchmark scored the published security answers of 2,112 companies in the CSA STAR Registry, retrieved on 26 August 2026, on the DigitalXForce twelve-domain assessment model. It shows where companies most often say a control is not in place, from encryption and key management to endpoint management and business continuity. The report is by Margareta Petrovic, Chief AI Officer at DigitalXForce. Read the full benchmark.
Four questions the benchmark answers in detail
- What percentage of cloud providers report encryption and key management controls as not in place? 52.0% of companies report at least one encryption and key management gap, the highest of the 17 Cloud Controls Matrix domains.
- Do larger cloud providers report fewer security gaps than smaller ones? 29.5% of companies with more than 5,000 employees report an encryption and key management gap, against 55.6% of companies with 1 to 10 employees.
- Can a headline security score tell you whether a cloud provider is secure? The median company reports 98.9% of its applicable controls in place, so a headline score separates almost no one.
- Which security areas do cloud providers most often report as not in place? All 17 Cloud Controls Matrix domains ranked by the share of companies reporting at least one control not in place.
Download the data
- domains.csv Cloud Controls Matrix domains, one row per domain.
- dxf-domains.csv DigitalXForce domains, one row per domain.
- segments.csv Segments by region, company size and industry.
- summary.json The headline figures in JSON.
The data and figures are published under CC BY 4.0: anyone may reuse them, including commercially, with credit to DigitalXForce and a link to the benchmark page.
How to cite and reuse
Petrovic, M. (2026). DigitalXForce Security Posture Benchmark 2026: 2,112 companies scored on the DigitalXForce twelve-domain model. DigitalXForce. https://digitalxforce.com/research/security-posture-benchmark-2026/
DigitalXForce checks controls with Continuous Control Assurance (CCA), which uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and Continuous Control Monitoring (CCM) is the capability within it that monitors conditions, evidence and signals associated with controls.
