Which security areas do cloud providers most often report as not in place?
By Margareta Petrovic, Chief AI Officer, DigitalXForce. Published 22 October 2026. Last updated 22 October 2026.
Encryption and key management leads: 52.0% of the 2,112 companies in the CSA STAR Registry report at least one control in that area as not in place. Universal Endpoint Management follows at 36.7%, and Business Continuity and Operational Resilience at 33.6%. The figures come from the DigitalXForce Security Posture Benchmark 2026, which scored the published answers of those companies retrieved on 26 August 2026.
Data: CSA STAR Registry, retrieved 26 August 2026. Population: 2,112 companies. License: CC BY 4.0.
The 17 domains ranked
The Cloud Controls Matrix groups its controls into 17 domains. The benchmark counts a company in a domain when at least one of its answers there is a no. Each share below is a share of the companies that answered at least one question in that domain.
| Domain | Companies answering | Reporting at least one no |
|---|---|---|
| Cryptography, Encryption and Key Management | 2,098 | 52.0% |
| Universal Endpoint Management | 2,067 | 36.7% |
| Business Continuity and Operational Resilience | 2,110 | 33.6% |
| Identity and Access Management | 2,109 | 25.0% |
| Datacenter Security | 2,041 | 24.4% |
| Supply Chain Management and Transparency | 2,101 | 22.9% |
| Change Control and Configuration Management | 2,110 | 20.9% |
| Data Security and Privacy | 2,107 | 20.6% |
| Application and Interface Security | 2,085 | 19.6% |
| Interoperability and Portability | 2,078 | 19.2% |
| Threat and Vulnerability Management | 2,109 | 18.4% |
| Logging and Monitoring | 2,109 | 15.7% |
| Governance, Risk and Compliance | 2,108 | 15.5% |
| Audit and Assurance | 2,106 | 14.5% |
| Security Incident Management and Forensics | 2,109 | 11.9% |
| Human Resources | 2,097 | 10.3% |
| Infrastructure and Virtualization Security | 2,103 | 10.2% |
What the ranking shows
Encryption and key management is the only domain where the median company reports something not in place. Its median score is 95.7%, and every other domain has a median of 100.0%. The gap between first and second place is 15.3 percentage points.
The tail tells a second story. The 10th percentile company scores 75.0% in Audit and Assurance, and 78.3% in Cryptography, Encryption and Key Management. Supply Chain Management and Transparency, and Interoperability and Portability, both have a 10th percentile of 80.0%. A domain can have a low share of companies reporting a no and still hold a hard result for the few that do.
DigitalXForce's own twelve-domain model reads the same data a second way. Under that model, 54.9% of companies report at least one Data Protection and Encryption control not in place, 42.3% report one in Configuration and Asset Management, and 40.0% report one in System and Information Integrity.
Which no answers are design choices
Not every no is a weakness. Some answers reflect design choices that many sound companies make on purpose, and a company that answers no to them is often being candid. A buyer should read the specific answer behind a domain share and ask the provider for its reasoning.
What the ranking does not say
The benchmark scores the control answers that companies publish. It does not test any company's environment and does not rate or rank companies. The registry is self-selected, and a yes or no records whether a control is in place, not how mature it is.
What a buyer should do
- Read the no answers before the yes answers, and start with the domains at the top of the table.
- Ask about encryption keys directly. If your data is regulated, ask who holds the keys, whether you can manage your own, and what happens to them at exit.
- Ask for independent evidence, such as a STAR Level 2 certification or attestation, a SOC 2 Type 2 report or an ISO/IEC 27001 certificate.
For a longer guide to this kind of review, read the DigitalXForce guide on assessing the security of your cloud service providers. A team that wants to track the same questions across all of its suppliers can use the third-party risk management module with the External Risk View. A team that wants to check the configurations of its own cloud accounts can use ESRPM, the DigitalXForce module for enterprise security risk and posture management.
DigitalXForce checks controls with Continuous Control Assurance (CCA), which uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and Continuous Control Monitoring (CCM) is the capability within it that monitors conditions, evidence and signals associated with controls.
More questions the benchmark answers
The benchmark answers four questions in detail. Each one reads the same data and links back to the full report.
Questions about this finding
Which security area do cloud providers most often report as not in place?
Cryptography, Encryption and Key Management, where 52.0% of the 2,112 companies report at least one control not in place, measured on answers retrieved on 26 August 2026.
Which area do cloud providers least often report as not in place?
Infrastructure and Virtualization Security, where 10.2% of companies report at least one control not in place, just below Human Resources at 10.3%.
Can I reuse these figures?
Yes. The data and figures are published under CC BY 4.0, so anyone may reuse them, including commercially, with credit to DigitalXForce and a link to the benchmark page.
How to cite
Petrovic, M. (2026). DigitalXForce Security Posture Benchmark 2026: 2,112 companies scored on the DigitalXForce twelve-domain model. DigitalXForce. https://digitalxforce.com/research/security-posture-benchmark-2026/
The data and figures are licensed under CC BY 4.0.
