Can a headline security score tell you whether a cloud provider is secure?
By Margareta Petrovic, Chief AI Officer, DigitalXForce. Published 22 October 2026. Last updated 22 October 2026.
No. Across the 2,112 companies in the CSA STAR Registry, the median company reports 98.9% of its applicable security controls in place, and 26.7% of companies report every control in place, so a headline score separates almost no one. The figures come from the DigitalXForce Security Posture Benchmark 2026, which read the registry on 26 August 2026.
Data: CSA STAR Registry, retrieved 26 August 2026. Population: 2,112 companies. License: CC BY 4.0.
How the score is calculated
The benchmark score is the number of yes answers divided by the number of yes and no answers. Not applicable answers are left out, because the questionnaire uses them for controls outside a company's scope. Each company answers the CAIQ, the Consensus Assessments Initiative Questionnaire, which turns the Cloud Controls Matrix into yes, no and not applicable questions.
With that calculation, the typical company lands very close to 100%. 98.9% is the median, and 26.7% of companies sit at exactly 100% because they answer yes to every applicable control.
Why a score near 100% tells a buyer little
When the middle of a population sits at 98.9%, a provider at 99% and a provider at 97% look almost identical on the headline, although their no answers can be very different. The score treats one missing control the same way whether it concerns an unimportant detail or the question of who holds the encryption keys.
The registry data shows the difference clearly. The 10th percentile score in the Cryptography, Encryption and Key Management domain is 78.3%, while the median in that domain is 95.7%. The domain breakdown shows more than the headline does, because a no answer inside one domain says something specific that an overall score hides.
Where the signal sits instead
The benchmark points a buyer to the areas where companies report controls as not in place. Encryption and key management leads, with 52.0% of companies reporting at least one gap, followed by Universal Endpoint Management at 36.7% and Business Continuity and Operational Resilience at 33.6%. Each area can be followed with a direct question to the provider.
What a headline score cannot replace
The benchmark scores the control answers that companies publish. It does not test any company's environment, it does not rate or rank companies, and it does not replace an independent audit report. A company with several no answers may be more careful than one with none.
What a buyer should do
- Read the no answers before the yes answers, because the no answers are where a provider has told you something specific.
- Ask for independent evidence, such as a STAR Level 2 certification or attestation, a SOC 2 Type 2 report or an ISO/IEC 27001 certificate, since that tells you someone outside the provider checked the answers.
- Monitor between reviews, because evidence collected continuously shows a change when it happens.
The DigitalXForce guide on modern third-party risk management and the guide on assessing the security of your cloud service providers both start from the published answers. Teams can then bring each supplier into the third-party risk management module with the External Risk View.
DigitalXForce checks controls with Continuous Control Assurance (CCA), which uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and Continuous Control Monitoring (CCM) is the capability within it that monitors conditions, evidence and signals associated with controls.
More questions the benchmark answers
The benchmark answers four questions in detail. Each one reads the same data and links back to the full report.
Questions about this finding
What share of cloud providers report every control in place?
26.7% of the 2,112 companies in the benchmark report every applicable control in place. The other 73.3% report at least one control not in place.
What is the median security score in the CSA STAR Registry?
The median company reports 98.9% of its applicable controls in place, measured on answers retrieved on 26 August 2026.
Can I reuse these figures?
Yes. The data and figures are published under CC BY 4.0, so anyone may reuse them, including commercially, with credit to DigitalXForce and a link to the benchmark page.
How to cite
Petrovic, M. (2026). DigitalXForce Security Posture Benchmark 2026: 2,112 companies scored on the DigitalXForce twelve-domain model. DigitalXForce. https://digitalxforce.com/research/security-posture-benchmark-2026/
The data and figures are licensed under CC BY 4.0.
