Daily monitoring · 479 domains

The Fortune 500 Security Report

We continuously scan the public security configuration of the largest U.S. companies. This page tracks who's improving, who's slipping, and how the cohort as a whole is shifting on TLS, headers, and email auth.

Updated Nov 7, 2026 · 30-day rolling window

By the numbers

The cohort at a glance.

A snapshot across all 479 domains from each one's most recent scan.

Median grade

across the cohort

Behind a CDN/WAF

50%

238 of 479

Enforce HSTS

45%

215 domains

Ship a CSP

17%

81 domains

Prefer TLS 1.3

90%

430 domains

DNSSEC enabled

18%

86 domains

Grade distribution

How the whole cohort scores, A through F.

A+

2 · 0%

51 · 11%

169 · 35%

252 · 53%

5 · 1%

0 · 0%

Who's behind a CDN / WAF

Detected from response headers · 50% of domains show a known provider.

Cloudflare

81 · 17%

Fastly

48 · 10%

CloudFront

42 · 9%

Google

30 · 6%

Akamai

22 · 5%

Varnish

9 · 2%

Azure

6 · 1%

Header-based detection records one provider per domain, so this undercounts multi-CDN setups and sites that strip identifying headers.

30-day trends

The cohort, day by day.

Each chart is the percentage of Fortune 500 domains shipping that feature, sampled daily for the last 30 days.

TLS 1.3 adoption

Domains preferring TLS 1.3

88.9%

+0.8pp · 30d

HSTS adoption

Domains enforcing HSTS

44.5%

0pp · 30d

Content-Security-Policy

Domains shipping CSP

17.1%

+1pp · 30d

X-Frame-Options

Clickjacking protection

25.1%

+0.7pp · 30d

DMARC

Email auth: DMARC record

82.5%

+0.2pp · 30d

DNSSEC

DNSSEC enabled at the registrar

18%

+0.7pp · 30d

Today's leaders

The best and worst graded right now.

Same grading formula we use on every individual scan: weighted across SSL, HSTS, CSP, headers, TLS strength, cookie security, DMARC, DKIM, DNSSEC, and more.

Top 5 · highest score