Do larger cloud providers report fewer security gaps than smaller ones?
By Margareta Petrovic, Chief AI Officer, DigitalXForce. Published 22 October 2026. Last updated 22 October 2026.
Yes, and the difference is large. Among the 1,917 companies in the CSA STAR Registry that state a size band, 29.5% of those with more than 5,000 employees report at least one encryption and key management control as not in place, against 55.6% of those with 1 to 10 employees. The figures come from the DigitalXForce Security Posture Benchmark 2026, which scored the published security answers of 2,112 companies retrieved on 26 August 2026.
Data: CSA STAR Registry, retrieved 26 August 2026. Population: 2,112 companies. License: CC BY 4.0.
What the size bands show
The benchmark groups companies into six size bands. The table shows how many companies sit in each band, the median share of applicable controls reported in place, the 10th percentile share, and the share reporting an encryption and key management gap.
| Company size | Companies | Median in place | 10th percentile in place | Reporting an encryption gap |
|---|---|---|---|---|
| 1 to 10 employees | 295 | 98.1% | 73.9% | 55.6% |
| 11 to 50 employees | 422 | 98.8% | 87.4% | 52.4% |
| 51 to 200 employees | 392 | 98.8% | 92.7% | 54.6% |
| 201 to 1,000 employees | 421 | 99.2% | 95.2% | 53.2% |
| 1,001 to 5,000 employees | 221 | 99.2% | 96.2% | 49.8% |
| More than 5,000 employees | 166 | 99.6% | 96.3% | 29.5% |
The medians barely move, from 98.1% to 99.6%. The tail is where size shows: the 10th percentile company with 1 to 10 employees reports 73.9% of its controls in place, against 96.3% for the 10th percentile company with more than 5,000 employees. A headline score hides this, which the benchmark explains in its answer on why a headline security score separates almost no one.
What industry and region add
Industry changes the encryption gap share almost as much as size does. Among the 968 Software and SaaS companies, 57.0% report an encryption gap, and among the 174 Cloud Infrastructure and Hosting companies, 27.6% do. Education reports 60.0% across 70 companies, and Telecom reports 34.7% across 49 companies.
Headquarters region shows a spread as well. In Asia-Pacific, 36.3% of 306 companies report an encryption gap, against 55.7% of 955 companies in North America and 53.8% of 679 companies in Europe. Segments with few companies, such as the 49 in Telecom, move a lot with each answer, so the smaller shares carry less weight.
What the size pattern does not say
A larger company is not shown to be more secure. The benchmark does not test any company's environment, and it does not rate or rank companies. A no answer records what a company reports, and the benchmark cannot say why a smaller company reports more of them. The registry is also self-selected, so the companies that publish tend to care about security posture.
What a buyer should do
- Do not assume a small provider is weaker or a large provider is stronger. Use the size band as a prompt for questions, never as a verdict.
- Read the no answers of any provider that handles your regulated data, whatever its size, and ask for the reasoning behind each one.
- Ask for independent evidence, such as a STAR Level 2 certification or attestation, a SOC 2 Type 2 report or an ISO/IEC 27001 certificate, since that tells you someone outside the provider checked the answers.
For a longer guide to this kind of review, read the DigitalXForce guide on assessing the security of your cloud service providers. A team that wants to track the same questions across all of its suppliers can use the third-party risk management module with the External Risk View.
DigitalXForce checks controls with Continuous Control Assurance (CCA), which uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and Continuous Control Monitoring (CCM) is the capability within it that monitors conditions, evidence and signals associated with controls.
More questions the benchmark answers
The benchmark answers four questions in detail. Each one reads the same data and links back to the full report.
Questions about this finding
Which companies report the fewest encryption gaps?
By size, companies with more than 5,000 employees, at 29.5%. By industry, Cloud Infrastructure and Hosting companies, at 27.6%. Both figures come from answers retrieved on 26 August 2026.
Why are there 1,917 companies here and 2,112 elsewhere?
The size bands cover 1,917 companies. The other 195 have no size band in the data, and they are included in every other figure of the benchmark.
Can I reuse these figures?
Yes. The data and figures are published under CC BY 4.0, so anyone may reuse them, including commercially, with credit to DigitalXForce and a link to the benchmark page.
How to cite
Petrovic, M. (2026). DigitalXForce Security Posture Benchmark 2026: 2,112 companies scored on the DigitalXForce twelve-domain model. DigitalXForce. https://digitalxforce.com/research/security-posture-benchmark-2026/
The data and figures are licensed under CC BY 4.0.
