The Australian Education Posture Baseline measures the public-facing security posture of Australian education institutions - universities, TAFEs and schools on .edu.au domains. Each quarterly edition scans a deterministic sample across the Security, Email and Domain categories of every Red Bridge Cyber scan. Education sits in a distinctive position in the comparison: institutions that hold large volumes of personal data and run substantial IT estates, with security capability ranging from a university SOC to a school office - a sector every Australian family interacts with.
When an article on this site says something like (Red Bridge Cyber Education Posture Baseline, June 2026), this page is what that citation points to.
Current edition - September 2026
The September 2026 edition scanned a deterministic sample of 75 domains drawn from a validated pool of Australian education institutions (.edu.au), completing on 8 September 2026. Results below; how every number is produced is on the methodology section.
Executive summary of findings
The September 2026 edition scanned 75 Australian education institutions - universities, TAFEs and schools. The sector medians an E (36/100) for web security, a B for email posture and an E (37) for DNS hardening.
- The mail basics lead the country. SPF 95%, DKIM 91% and reverse DNS 100% - centrally run mail infrastructure, professionally operated.
- Enforcement does not follow. 95% publish a DMARC record and only 60% enforce one, the widest publish-to-enforce gap of any cohort.
- Security headers are the weakest flank. 81% of scored sites publish no Content-Security-Policy and 61% send no HSTS header, both the worst rates measured.
- DNS hardening is near-absent. DNSSEC 3%, MTA-STS 5%, though CAA at 17% is the second-best figure in the programme.
Full results tables below. 75 domains sampled, 69 scored for security, with every unscorable domain disclosed with its reason.
Email posture - can the domain’s mail be trusted, and can the domain be spoofed? Median grade B (86/100). Share of the cohort passing each check:
| Check | % passing |
|---|---|
| Mail-routed (MX with STARTTLS) | 100% |
| SPF | 95% |
| DMARC | 60% |
| DKIM | 91% |
| MTA-STS | 1% |
| TLS-RPT | 8% |
| DNSSEC | 3% |
| Reverse DNS | 100% |
All 75 sampled domains were scoreable for email.
Domain
Domain (DNS) posture - the records that protect the domain name itself. Median grade E (37/100). Share of the cohort with each control in place:
| Check | % with control |
|---|---|
| SPF record | 99% |
| DMARC published | 95% |
| DMARC enforced (quarantine/reject) | 60% |
| DNSSEC | 3% |
| CAA record | 17% |
| MTA-STS | 5% |
| IPv6 at the apex | 16% |
All 75 sampled domains were scoreable for domain.
Security
Web security posture - TLS configuration, security headers and the basics of a defensible website. Median grade E (36/100), the weakest category measured. Share of scored sites missing each control:
| Check | % missing |
|---|---|
| HTTPS enforcement | 10% |
| HSTS | 61% |
| Content-Security-Policy | 81% |
| X-Content-Type-Options (nosniff) | 55% |
| Referrer-Policy | 67% |
| Permissions-Policy | 88% |
| TLS 1.3 | 7% |
| security.txt | 97% |
69 of 75 sampled domains scored (3 redirect-only, 2 unreachable, 1 bot-block - see Commentary).
Commentary
One figure in the table above is measured on less than the full cohort, and we would rather say so than round it away. HTTPS enforcement is established by a plain-HTTP request, and that probe runs through a proxy that cannot serve every scan at once; where it did not return, the result is recorded as unknown rather than as a failure to redirect. The percentage is computed only over the sites where the check actually ran, and the edition data records how many that was. An earlier build of this edition reported those unknowns as failures and put small business HTTPS enforcement at 50% missing instead of 9%; hand-testing twenty of them found fourteen that plainly do redirect. The scanner now records the difference.
Education sits where its structure predicts. The centrally-run mail estate is some of the best measured anywhere in this programme, and the web surface - spread across faculties, campaigns and legacy sites - trails it badly. An institution holding enrolment records, health details and family financial data medianing an E on public web security is the gap worth sitting with, and for most of them the fixes are configuration rather than procurement.
The DMARC pattern deserves its own line in this sector. A spoofed school or university domain is a phishing instrument aimed at parents and students. 95% of institutions have published the record that could stop it and 60% have switched enforcement on, which leaves roughly one in three monitoring an attack they have already built the machinery to block.
Against June this cohort is flat: E (36) for security in both editions, B for email in both. That is the expected result and the useful one. Twenty-three of these 75 domains were also in June’s sample, and on those, two changed anything at all across every email check - one moved DMARC to enforcement, one added TLS-RPT.
Six of the 75 sampled domains could not be scored for security and are disclosed above. Exclusion is decided on objective criteria before any score is read, and every measurement uses the public surface only.
Methodology
Every cohort baseline is produced by the same methodology: quarterly cadence, a deterministic seeded sample drawn from a validated pool, and scan failures excluded before scoring - never on score. Read the full methodology on the research overview.
Previous editions
This baseline refreshes quarterly, and this page always carries the latest edition. Superseded editions are archived unchanged at their own dated address, so a citation can always be checked against the edition it was drawn from.
- June 2026 - carries a correction