DigitalXForce Security Posture Benchmark 2026
By Margareta Petrovic, Chief AI Officer, DigitalXForce. Published 15 October 2026. Last updated 15 October 2026.
DigitalXForce scored the published security control answers of 2,112 companies against its twelve-domain assessment model, control by control, and mapped every result to NIST SP 800-53, NIST CSF 2.0 and CIS Controls v8.1. Data Protection and Encryption is where companies most often report a gap: 54.9% report at least one control in that domain not in place.
The benchmark covers ten of the twelve DigitalXForce domains with public data and names no company. The data files are free to download, and every figure can be cited with a link to this page.
Version 1.0. Author: Margareta Petrovic. Data: CSA STAR Registry, retrieved 26 August 2026. Population: 2,112 companies. License: CC BY 4.0.
Four findings
- Data Protection and Encryption is the weakest DigitalXForce domain. 54.9% of 2,112 companies report at least one of its controls not in place, followed by Configuration and Asset Management at 42.3%. Network and Public Exposure is the strongest, at 9.5%.
- The single most common gap is customer control of encryption keys. 47.9% of the 1,798 companies answering the question say customers cannot manage their own data encryption keys.
- A headline score separates almost no one. The median company reports 98.9% of its applicable controls in place and 26.7% report every one, so the useful signal sits in the controls reported as not in place.
- Company size is the clearest difference in the data. 29.5% of companies with more than 5,000 employees report an encryption and key management gap, against 49.8% to 55.6% of smaller companies.
The DigitalXForce twelve-domain view
DigitalXForce assesses security posture in twelve domains, from Architecture to AI/ML Security and Governance. Every question in the benchmark is assigned to its domains by DigitalXForce’s control-level mapping, and each domain is traced to the NIST SP 800-53 control families and CIS Controls v8.1 safeguards it reaches.
| DigitalXForce domain | Companies scored | With at least one control not in place | Median score | NIST SP 800-53 families reached most often | CIS Controls v8.1 reached most often |
|---|---|---|---|---|---|
| Data Protection and Encryption | 2,109 | 54.9% | 97.9% | AC Access Control; IA Identification and Authentication; SC System and Communications Protection | CIS 3 Data Protection; CIS 5 Account Management; CIS 6 Access Control Management |
| Configuration and Asset Management | 2,111 | 42.3% | 100.0% | CM Configuration Management; AC Access Control; SA System and Services Acquisition | CIS 4 Secure Configuration of Enterprise Assets and Software; CIS 3 Data Protection; CIS 2 Inventory and Control of Software Assets |
| System and Information Integrity | 2,110 | 40.0% | 100.0% | CM Configuration Management; SA System and Services Acquisition; SI System and Information Integrity | CIS 2 Inventory and Control of Software Assets; CIS 4 Secure Configuration of Enterprise Assets and Software; CIS 3 Data Protection |
| Resilience and Business Continuity | 2,110 | 33.5% | 100.0% | PM Program Management; RA Risk Assessment; CP Contingency Planning | CIS 17 Incident Response Management; CIS 11 Data Recovery; CIS 15 Service Provider Management |
| DevSecOps and CI/CD Security | 2,110 | 30.2% | 100.0% | CM Configuration Management; SA System and Services Acquisition; SI System and Information Integrity | CIS 4 Secure Configuration of Enterprise Assets and Software; CIS 2 Inventory and Control of Software Assets; CIS 3 Data Protection |
| Identity and Access Management | 2,109 | 24.9% | 100.0% | AC Access Control; IA Identification and Authentication; RA Risk Assessment | CIS 5 Account Management; CIS 6 Access Control Management; CIS 3 Data Protection |
| Architecture | 2,107 | 22.1% | 100.0% | SC System and Communications Protection; AC Access Control; CM Configuration Management | CIS 3 Data Protection; CIS 4 Secure Configuration of Enterprise Assets and Software; CIS 12 Network Infrastructure Management |
| Governance, Risk and Compliance | 2,110 | 21.3% | 100.0% | PM Program Management; CA Assessment, Authorization and Monitoring; RA Risk Assessment | CIS 14 Security Awareness and Skills Training |
| Audit, Logging and Incident Response | 2,110 | 19.5% | 100.0% | AU Audit and Accountability; AC Access Control; PM Program Management | CIS 8 Audit Log Management; CIS 15 Service Provider Management; CIS 17 Incident Response Management |
| Network and Public Exposure | 1,795 | 9.5% | 100.0% | AC Access Control; SC System and Communications Protection; CM Configuration Management | CIS 3 Data Protection; CIS 4 Secure Configuration of Enterprise Assets and Software; CIS 12 Network Infrastructure Management |
| Enterprise Security Integrations | No public equivalent | Measured in DigitalXForce technical assessments | |||
| AI/ML Security and Governance | No public equivalent | Measured in DigitalXForce technical assessments |
Enterprise Security Integrations and AI/ML Security and Governance have no equivalent in any public control framework used here. DigitalXForce measures both in its own technical assessments.
Coverage: Google Cloud, Microsoft Azure, AWS and Oracle Cloud across IaaS, PaaS, SaaS and AI/ML
The DigitalXForce twelve-domain model is vendor-neutral, so it applies to the services of Google Cloud and Google Workspace, Microsoft Azure, Amazon Web Services (AWS) and Oracle Cloud Infrastructure (OCI). It covers all three cloud service models, infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS), and it covers cloud-based AI and machine learning (AI/ML) services.
The benchmark data comes from the CSA STAR Registry, where one questionnaire, the CAIQ, describes any cloud service, whether it is IaaS, PaaS or SaaS. The registry index of 26 August 2026 lists Amazon, Google, Microsoft and Oracle among its registered organizations. The results are aggregate, so the benchmark scores, ranks and names no company.
Cloud-based AI/ML security is covered by the model’s own domain, AI/ML Security and Governance, which has 8 controls. The public CAIQ has no AI/ML equivalent, so the figures in this report do not measure that domain, and DigitalXForce assesses it in its technical assessments. The platform side of this work is described on the AI risk governance page and on the Enterprise AI governance and risk management page. Product and company names belong to their owners, and this section uses them only to describe scope, with no affiliation or endorsement.
Key statistics
Each statistic below comes from this benchmark and can be quoted on its own with a link to this page.
- DigitalXForce scored the published security control answers of 2,112 companies on its twelve-domain assessment model.
- 54.9% of companies report at least one data protection and encryption control not in place, the highest share of any DigitalXForce domain.
- The DigitalXForce twelve-domain model has 94 controls, each mapped to NIST CSF 2.0 subcategories and, for 78 of them, to CCM v4 controls, and 2,112 companies were scored on the ten domains with public data.
- 52.0% of companies report at least one encryption and key management control not in place.
- 47.9% of companies say customers cannot manage their own data encryption keys.
- 11.7% of companies say they do not run independent audits against recognized standards at least once a year.
- The median company reports 98.9% of its applicable security controls in place, and 26.7% of companies report every one.
- 36.7% of companies report an endpoint management control not in place, 33.6% a business continuity control and 25.0% an identity and access management control.
- 29.5% of companies with more than 5,000 employees report an encryption and key management gap, against 49.8% to 55.6% of smaller companies.
Cloud Controls Matrix detail
At the level of the 17 Cloud Controls Matrix domains, Cryptography, Encryption and Key Management leads at 52.0%, followed by Universal Endpoint Management at 36.7% and Business Continuity and Operational Resilience at 33.6%. The domains where companies least often report a gap are Infrastructure and Virtualization Security (10.2%) and Human Resources (10.3%).
| Domain | Companies answering | With at least one control not in place | Median score | 10th percentile score |
|---|---|---|---|---|
| Cryptography, Encryption and Key Management (CEK) | 2,098 | 52.0% | 95.7% | 78.3% |
| Universal Endpoint Management (UEM) | 2,067 | 36.7% | 100.0% | 80.0% |
| Business Continuity and Operational Resilience (BCR) | 2,110 | 33.6% | 100.0% | 88.9% |
| Identity and Access Management (IAM) | 2,109 | 25.0% | 100.0% | 90.5% |
| Datacenter Security (DCS) | 2,041 | 24.4% | 100.0% | 91.3% |
| Supply Chain Management and Transparency (STA) | 2,101 | 22.9% | 100.0% | 80.0% |
| Change Control and Configuration Management (CCC) | 2,110 | 20.9% | 100.0% | 88.8% |
| Data Security and Privacy (DSP) | 2,107 | 20.6% | 100.0% | 91.7% |
| Application and Interface Security (AIS) | 2,085 | 19.6% | 100.0% | 90.9% |
| Interoperability and Portability (IPY) | 2,078 | 19.2% | 100.0% | 80.0% |
| Threat and Vulnerability Management (TVM) | 2,109 | 18.4% | 100.0% | 90.9% |
| Logging and Monitoring (LOG) | 2,109 | 15.7% | 100.0% | 88.9% |
| Governance, Risk and Compliance (GRC) | 2,108 | 15.5% | 100.0% | 88.9% |
| Audit and Assurance (A&A) | 2,106 | 14.5% | 100.0% | 75.0% |
| Security Incident Management and Forensics (SEF) | 2,109 | 11.9% | 100.0% | 90.9% |
| Human Resources (HRS) | 2,097 | 10.3% | 100.0% | 95.0% |
| Infrastructure and Virtualization Security (IVS) | 2,103 | 10.2% | 100.0% | 93.3% |
The ten controls companies most often report as not in place
| Control | Objective | Companies answering | Answering no |
|---|---|---|---|
| CEK-08.1 | Customers can manage their own data encryption keys. | 1,798 | 47.9% |
| BCR-10.2 | Local emergency authorities take part in business continuity exercises where possible. | 1,588 | 35.8% |
| UEM-11.1 | Managed endpoints run data loss prevention rules set by a risk assessment. | 1,909 | 20.9% |
| UEM-12.1 | Remote location tracking is switched on for every managed mobile device. | 1,711 | 20.3% |
| DCS-08.1 | Connections are authenticated by identifying the equipment that makes them. | 1,759 | 18.3% |
| AIS-07.2 | Fixing application security vulnerabilities is automated where possible. | 2,037 | 13.8% |
| IAM-11.1 | Customers can take part in approving high-risk privileged access roles. | 1,707 | 13.8% |
| CEK-15.1 | Keys that exist but are not yet authorized for use are governed by defined processes. | 1,692 | 13.4% |
| A&A-02.1 | Independent audits against recognized standards run at least once a year. | 2,094 | 11.7% |
| CCC-05.1 | Contracts limit provider changes to customer environments and require the customer’s explicit approval. | 1,722 | 11.3% |
Not every no is a weakness. Remote location tracking on mobile devices, local emergency authorities in continuity exercises and equipment-based connection authentication are design choices that many sound companies make on purpose. A company that answers no to them is often being candid.
Four answers deserve a buyer’s attention. Customer-managed encryption keys (47.9% answer no) decide who can read your data if the company is compelled or compromised. Annual independent audits (11.7% answer no) decide whether anyone outside the company has checked the other answers. Automated fixing of application vulnerabilities and customer approval of privileged access decide how fast a known weakness closes and who holds the keys to your tenant.
Check a cloud provider against 2,112 companies
Enter a provider’s answers to the ten controls above. The check shows how the answers compare with every company in this benchmark and what to ask next. Nothing you enter leaves your browser.
By region, company size and industry
Headquarters region, company size and industry come from public sources researched for each company, with a confidence rating. These tables use the 2,071 companies rated high or medium confidence and show only segments of at least 10 companies.
Two differences stand out. The largest companies report an encryption and key management gap about half as often: 29.5% of companies with more than 5,000 employees, against 49.8% to 55.6% in every smaller band. Cloud infrastructure and hosting companies report one at 27.6%, against 57.0% for software and SaaS companies.
| Headquarters region | Companies | Median score | 10th percentile score | With an encryption and key management gap |
|---|---|---|---|---|
| North America | 955 | 99.2% | 93.7% | 55.7% |
| Europe | 679 | 98.5% | 84.2% | 53.8% |
| Asia-Pacific | 306 | 99.6% | 91.2% | 36.3% |
| Middle East & Africa | 89 | 99.1% | 90.6% | 46.1% |
| Latin America | 38 | 97.7% | 71.5% | 52.6% |
| Employees | Companies | Median score | 10th percentile score | With an encryption and key management gap |
|---|---|---|---|---|
| 1 to 10 | 295 | 98.1% | 73.9% | 55.6% |
| 11 to 50 | 422 | 98.8% | 87.4% | 52.4% |
| 51 to 200 | 392 | 98.8% | 92.7% | 54.6% |
| 201 to 1,000 | 421 | 99.2% | 95.2% | 53.2% |
| 1,001 to 5,000 | 221 | 99.2% | 96.2% | 49.8% |
| More than 5,000 | 166 | 99.6% | 96.3% | 29.5% |
| Industry | Companies | Median score | 10th percentile score | With an encryption and key management gap |
|---|---|---|---|---|
| Software & SaaS | 968 | 98.8% | 89.6% | 57.0% |
| IT Services & Consulting | 245 | 98.8% | 83.4% | 46.5% |
| Cybersecurity | 215 | 99.2% | 94.3% | 51.6% |
| Cloud Infrastructure & Hosting | 174 | 99.6% | 91.2% | 27.6% |
| Financial Services | 91 | 99.2% | 91.1% | 56.0% |
| Education | 70 | 98.6% | 89.1% | 60.0% |
| Healthcare | 67 | 99.2% | 94.3% | 46.3% |
| Professional Services | 56 | 97.9% | 85.7% | 57.1% |
| Telecom | 49 | 99.6% | 97.2% | 34.7% |
| Manufacturing & Industrial | 27 | 98.9% | 89.9% | 44.4% |
| Government & Public Sector | 17 | 94.6% | 79.7% | 47.1% |
| Transportation & Logistics | 12 | 98.9% | 84.7% | 50.0% |
How each domain maps to the NIST Cybersecurity Framework 2.0
Each Cloud Controls Matrix domain maps to NIST CSF 2.0 through the Cloud Security Alliance’s published mapping of CCM v4 to CSF 2.0 and NIST’s informative references. The table lists the CSF functions each domain reaches and the three CSF categories it reaches most often, so a team reporting against CSF 2.0 can read the findings above in its own terms.
| Domain | NIST CSF 2.0 functions | CSF categories reached most often in the mapping |
|---|---|---|
| Cryptography, Encryption and Key Management (CEK) | Govern, Identify, Protect, Respond | PR.AA Identity Management, Authentication, and Access Control; GV.OC Organizational Context; PR.DS Data Security |
| Universal Endpoint Management (UEM) | Govern, Identify, Protect, Detect, Respond | PR.PS Platform Security; ID.AM Asset Management; PR.AA Identity Management, Authentication, and Access Control |
| Business Continuity and Operational Resilience (BCR) | Govern, Identify, Protect, Respond, Recover | ID.IM Improvement; GV.OC Organizational Context; GV.PO Policy |
| Identity and Access Management (IAM) | Govern, Identify, Protect | PR.AA Identity Management, Authentication, and Access Control; GV.PO Policy; ID.IM Improvement |
| Datacenter Security (DCS) | Govern, Identify, Protect, Detect | GV.PO Policy; PR.AA Identity Management, Authentication, and Access Control; ID.AM Asset Management |
| Supply Chain Management and Transparency (STA) | Govern, Identify | GV.SC Cybersecurity Supply Chain Risk Management; GV.OC Organizational Context; ID.IM Improvement |
| Change Control and Configuration Management (CCC) | Govern, Identify, Protect, Detect | PR.PS Platform Security; ID.RA Risk Assessment; ID.AM Asset Management |
| Data Security and Privacy (DSP) | Govern, Identify, Protect, Respond | ID.AM Asset Management; GV.OC Organizational Context; PR.DS Data Security |
| Application and Interface Security (AIS) | Govern, Identify, Protect | PR.PS Platform Security; ID.AM Asset Management; ID.RA Risk Assessment |
| Interoperability and Portability (IPY) | Govern, Identify, Protect | GV.PO Policy; GV.SC Cybersecurity Supply Chain Risk Management; ID.AM Asset Management |
| Threat and Vulnerability Management (TVM) | Govern, Identify, Protect, Detect | ID.RA Risk Assessment; DE.CM Continuous Monitoring; PR.PS Platform Security |
| Logging and Monitoring (LOG) | Govern, Identify, Protect, Detect | DE.CM Continuous Monitoring; DE.AE Adverse Event Analysis; PR.PS Platform Security |
| Governance, Risk and Compliance (GRC) | Govern, Identify | GV.RM Risk Management Strategy; GV.PO Policy; ID.RA Risk Assessment |
| Audit and Assurance (A&A) | Govern, Identify | ID.RA Risk Assessment; ID.IM Improvement; GV.PO Policy |
| Security Incident Management and Forensics (SEF) | Govern, Identify, Protect, Detect, Respond, Recover | ID.IM Improvement; DE.AE Adverse Event Analysis; RS.MA Incident Management |
| Human Resources (HRS) | Govern, Identify, Protect | GV.RR Roles, Responsibilities, and Authorities; GV.PO Policy; PR.AT Awareness and Training |
| Infrastructure and Virtualization Security (IVS) | Govern, Identify, Protect, Detect, Respond | PR.IR Technology Infrastructure Resilience; ID.AM Asset Management; DE.CM Continuous Monitoring |
The DigitalXForce twelve domains and 94 controls
The DigitalXForce twelve-domain model has 94 controls. Each control maps to the controls of the Cloud Security Alliance’s Cloud Controls Matrix (CCM) version 4 where one exists, and to the subcategories of the NIST Cybersecurity Framework (CSF) 2.0. The 16 controls in Enterprise Security Integrations and AI/ML Security and Governance have no CCM v4 analog.
| DigitalXForce domain | Controls |
|---|---|
| Architecture | 7 |
| Enterprise Security Integrations | 8 |
| Governance, Risk and Compliance | 8 |
| Configuration and Asset Management | 10 |
| Identity and Access Management | 8 |
| System and Information Integrity | 7 |
| Network and Public Exposure | 8 |
| Data Protection and Encryption | 8 |
| Audit, Logging and Incident Response | 8 |
| Resilience and Business Continuity | 6 |
| DevSecOps and CI/CD Security | 8 |
| AI/ML Security and Governance | 8 |
Each control is one statement about a security practice that an assessor can test as in place or not in place. A control maps to a Cloud Controls Matrix v4 control when both describe the same practice. One CCM v4 control can be reached by several DigitalXForce controls, which is why the 78 controls with a CCM v4 analog reach 66 distinct CCM v4 controls. A control maps to NIST CSF 2.0 subcategories when they describe the same outcome, and the 94 controls together reach 78 distinct subcategories.
| DigitalXForce domain | Controls | CCM v4 domains reached | NIST CSF 2.0 functions reached | NIST CSF 2.0 subcategories reached |
|---|---|---|---|---|
| Architecture | 7 | BCR, IVS, LOG, UEM | Govern, Identify, Protect, Detect, Respond | 35 |
| Enterprise Security Integrations | 8 | No CCM v4 analog | Identify, Protect, Detect, Respond | 17 |
| Governance, Risk and Compliance | 8 | A&A, GRC | Govern, Identify | 13 |
| Configuration and Asset Management | 10 | CCC, CEK, IAM, IVS, TVM, UEM | Govern, Identify, Protect, Detect | 21 |
| Identity and Access Management | 8 | IAM | Govern, Protect | 8 |
| System and Information Integrity | 7 | CCC, LOG, TVM, UEM | Govern, Identify, Protect, Detect, Respond | 24 |
| Network and Public Exposure | 8 | CEK, IVS, LOG | Identify, Protect, Detect, Respond | 17 |
| Data Protection and Encryption | 8 | BCR, CEK, DSP | Govern, Identify, Protect, Recover | 16 |
| Audit, Logging and Incident Response | 8 | LOG, SEF | Govern, Identify, Protect, Detect, Respond, Recover | 32 |
| Resilience and Business Continuity | 6 | BCR | Govern, Identify, Protect, Respond, Recover | 15 |
| DevSecOps and CI/CD Security | 8 | AIS, CCC, IAM, TVM | Identify, Protect | 14 |
| AI/ML Security and Governance | 8 | No CCM v4 analog | Govern, Identify, Protect, Detect | 13 |
The mapping makes one result readable in the framework a team already reports against. A gap in Data Protection and Encryption, for example, lands on Cloud Controls Matrix controls in the CEK and DSP domains, among others, and on NIST CSF 2.0 subcategories in the PR.DS category, among others. The control wording and the control level table are part of the DigitalXForce assessment model and are not part of the data files.
What a buyer should do with this
- Read the no answers before the yes answers. They are where a provider has told you something specific, and they are the ones to ask about first.
- Ask about encryption keys directly. If your data is regulated, ask whether you can hold or manage your own keys and what happens to them at exit.
- Ask for independent evidence. A STAR Level 2 certification or attestation, a SOC 2 Type 2 report or an ISO/IEC 27001 certificate tells you someone outside the provider checked the answers.
- Monitor between reviews. A provider’s posture changes between annual reviews, and evidence collected continuously shows the change when it happens.
Where this benchmark is not the answer
This benchmark scores the control answers companies publish. It does not test any company’s environment, it does not rate or rank companies, and it does not replace an independent audit report. A company with several no answers may be more careful than one with none.
CSPM and cloud vendor assurance are different jobs
Cloud security posture management (CSPM) scans your own cloud accounts for misconfigurations; Wiz, Prisma Cloud, Microsoft Defender for Cloud and Orca are examples. Cloud vendor assurance asks whether the providers you depend on run their controls. This benchmark is about the second job.
DigitalXForce covers both from one platform: ESRPM checks configurations across your own cloud and security stack through 250+ technology integrations, and the third-party risk management module with the External Risk View assesses the providers you depend on. Both map results once to 50+ compliance frameworks through Continuous Control Monitoring.
Terms used in this report
- The DigitalXForce twelve-domain model is the structure DigitalXForce uses in its technical assessments, from Architecture to AI/ML Security and Governance, mapped at control level to the Cloud Controls Matrix, NIST SP 800-53, NIST CSF 2.0 and CIS Controls v8.1.
- The CSA STAR Registry is the public registry run by the Cloud Security Alliance where companies publish their security and privacy answers for their cloud services. Read the registry.
- The Cloud Controls Matrix (CCM) is the Cloud Security Alliance’s control framework for cloud computing. Version 4 organizes its controls into 17 domains.
- The CAIQ, the Consensus Assessments Initiative Questionnaire, turns the Cloud Controls Matrix into yes, no and not applicable questions that each company answers and publishes.
- Cloud security posture management (CSPM) scans an organization’s own cloud accounts for misconfigurations. DigitalXForce’s glossary covers security posture management more widely.
Methodology
- Source: the CSA STAR Registry. The answers are assessments that companies publish for their cloud services (STAR Level 1). On 26 August 2026 all 2,714 registry entries were read and 3,304 CAIQ workbooks downloaded, of which 3,239 could be parsed.
- Population: each company’s latest CAIQ v4 answers, 2,112 companies. 1,772 of these answer the 261 questions of CAIQ v4.0 and 288 the 283 questions of v4.1; a few answer part of the set. Earlier CAIQ versions ask different questions and are not mixed in.
- Score: yes answers divided by yes and no answers. Not applicable answers are left out, because CAIQ uses them for controls outside a company’s scope.
- DigitalXForce domains: each CAIQ v4.0 question is assigned to one or more DigitalXForce domains by DigitalXForce’s control-level mapping; questions outside that mapping are not scored in the twelve-domain view. NIST SP 800-53 families and CIS Controls v8.1 are reached through the NIST CSF 2.0 mapping.
- Cloud Controls Matrix domains: the 17 domains of CCM v4. Version 4.1 renamed Infrastructure and Virtualization Security (IVS) to I&S; both are counted as one domain here.
- Controls: a control is listed only where at least 500 companies answered it yes or no.
- DigitalXForce controls: the model has 94 controls in twelve domains, each mapped to CSA CCM v4 controls where one exists and to NIST CSF 2.0 subcategories. The domain level mapping is on this page.
- Segments: headquarters region, company size and industry were researched from public sources for each company with a confidence rating; only high and medium confidence records are used, and only segments of at least 10 companies are shown. Size bands from different sources were combined into six bands.
- Caveats: the registry is self-selected, so companies that publish tend to care about security posture. Related companies sometimes publish identical answer sets. A yes or no records whether a control is in place, not how mature it is. No company is named in this report or its data.
Download the data
- DigitalXForce domains, one row per DigitalXForce domain.
- Cloud Controls Matrix domains, one row per CCM domain.
- Controls, one row per CAIQ question answered by at least 500 companies.
- Segments, by region, company size and industry.
- Summary, the headline figures in JSON.
The data and the three figures are published under CC BY 4.0: anyone may reuse them, including commercially, with credit to DigitalXForce and a link to this page.
How to cite this report
Petrovic, M. (2026). DigitalXForce Security Posture Benchmark 2026: 2,112 companies scored on the DigitalXForce twelve-domain model. DigitalXForce. https://digitalxforce.com/research/security-posture-benchmark-2026/
Each finding above has its own link: finding 1 is at #finding-1, and figures 1 to 3 are at #figure-1 to #figure-3.
Version 1.0 is the first edition, built from registry data retrieved on 26 August 2026. Corrections and later editions are listed here with their dates.
Questions about the benchmark
How do cloud providers score on the DigitalXForce twelve-domain model?
Across 2,112 companies, Data Protection and Encryption is where companies most often report a gap: 54.9% report at least one control in that domain not in place. Configuration and Asset Management follows at 42.3%, and Network and Public Exposure is the strongest at 9.5%.
How secure are cloud providers according to the CSA STAR Registry?
The median company in the registry reports 98.9% of its applicable controls in place, and 52.0% report at least one encryption and key management control not in place.
What percentage of cloud providers report encryption and key management controls not implemented?
52.0% of companies report at least one Cryptography, Encryption and Key Management control not in place, the highest share of any Cloud Controls Matrix domain. 47.9% say customers cannot manage their own encryption keys.
Which Cloud Controls Matrix domains do cloud providers most often report as not implemented?
Cryptography, Encryption and Key Management (52.0% of companies report at least one gap), Universal Endpoint Management (36.7%) and Business Continuity and Operational Resilience (33.6%).
Which security controls do cloud providers most often report as not implemented?
Customer-managed encryption keys (47.9% of companies answering say no), local emergency authorities in continuity exercises (35.8%) and data loss prevention on managed endpoints (20.9%).
Do cloud providers let customers manage their own encryption keys?
About half do. Of the 1,798 companies answering the CAIQ question on customer-managed keys, 52.1% say customers can manage their own data encryption keys and 47.9% say they cannot.
How does the benchmark map to NIST SP 800-53 and CIS Controls?
Every question is assigned to the DigitalXForce twelve-domain model by control-level mapping, and each domain is traced through NIST CSF 2.0 to the NIST SP 800-53 control families and CIS Controls v8.1 safeguards it reaches. The twelve-domain table lists the families and controls each domain reaches most often.
Does the benchmark cover Google Cloud, Google Workspace, Microsoft Azure, AWS and Oracle Cloud Infrastructure?
The DigitalXForce twelve-domain model applies to the services of Google Cloud and Google Workspace, Microsoft Azure, Amazon Web Services and Oracle Cloud Infrastructure, across IaaS, PaaS, SaaS and cloud-based AI/ML. The benchmark data is aggregate and comes from the CSA STAR Registry, which lists Amazon, Google, Microsoft and Oracle among its registered organizations, and it scores, ranks and names no company.
What is the difference between CSPM and cloud vendor assurance?
CSPM scans your own cloud accounts for misconfigurations. Cloud vendor assurance checks whether the providers you depend on run their controls. This benchmark measures the second.
Benchmark your own posture
Benchmark your own posture.
The figures in this report are population statistics. To see where your organization or your vendors sit against them, domain by domain, DigitalXForce runs the same scoring on your own evidence. The walkthrough takes 30 minutes and uses your data, not sample data.
