The Australian Enterprise & Government Posture Baseline measures the public-facing security posture of the organisations that are supposed to set the standard: ASX-listed enterprises and Australian government bodies at federal, state and local level. Each quarterly edition scans a deterministic sample across the Security, Email and Domain categories of every Red Bridge Cyber scan. These are the well-resourced security teams, enterprise SOCs and government CISOs - the benchmark a small business is implicitly held to every time someone says “enterprise-grade”.
When an article on this site says something like (Red Bridge Cyber Enterprise & Government Posture Baseline, June 2026), this page is what that citation points to.
Current edition - September 2026
The September 2026 edition scanned a deterministic sample of 75 domains drawn from a validated pool of ASX-listed enterprises and government domains (.gov.au), completing on 8 September 2026. Results below; how every number is produced is on the methodology section.
Executive summary of findings
The September 2026 edition scanned 75 ASX-listed enterprises and Australian government bodies. The median enterprise and government website earns an E (43/100) for web security, a B for email posture and an E (49) for DNS hardening - the best security median of the three Australian organisational cohorts, and still an E.
- Email is where the mandate shows. 99% publish a DMARC record and 88% enforce one, the strongest enforcement of any Australian cohort measured.
- The web surface is better than the other cohorts but not good. 58% of scored sites publish no Content-Security-Policy and 61% no Referrer-Policy, though only 7% fail to enforce HTTPS.
- security.txt is missing from 85% of scored sites - the simplest courtesy in the rubric, in the sector most likely to receive a vulnerability report.
- DNS hardening does not follow the budget. DNSSEC 7%, CAA 11%, MTA-STS 12%.
Full results tables below. 75 domains sampled, 59 scored for security, with every unscorable domain disclosed with its reason.
Email posture - can the domain’s mail be trusted, and can the domain be spoofed? Median grade B (86/100). Share of the cohort passing each check:
| Check | % passing |
|---|---|
| Mail-routed (MX with STARTTLS) | 93% |
| SPF | 92% |
| DMARC | 88% |
| DKIM | 79% |
| MTA-STS | 8% |
| TLS-RPT | 9% |
| DNSSEC | 11% |
| Reverse DNS | 92% |
All 75 sampled domains were scoreable for email.
Domain
Domain (DNS) posture - the records that protect the domain name itself. Median grade E (49/100). Share of the cohort with each control in place:
| Check | % with control |
|---|---|
| SPF record | 99% |
| DMARC published | 99% |
| DMARC enforced (quarantine/reject) | 88% |
| DNSSEC | 7% |
| CAA record | 11% |
| MTA-STS | 12% |
| IPv6 at the apex | 19% |
All 75 sampled domains were scoreable for domain.
Security
Web security posture - TLS configuration, security headers and the basics of a defensible website. Median grade E (43/100), the weakest category measured. Share of scored sites missing each control:
| Check | % missing |
|---|---|
| HTTPS enforcement | 7% |
| HSTS | 31% |
| Content-Security-Policy | 58% |
| X-Content-Type-Options (nosniff) | 42% |
| Referrer-Policy | 61% |
| Permissions-Policy | 76% |
| TLS 1.3 | 7% |
| security.txt | 85% |
59 of 75 sampled domains scored (6 redirect-only, 10 unreachable - see Commentary).
Commentary
One figure in the table above is measured on less than the full cohort, and we would rather say so than round it away. HTTPS enforcement is established by a plain-HTTP request, and that probe runs through a proxy that cannot serve every scan at once; where it did not return, the result is recorded as unknown rather than as a failure to redirect. The percentage is computed only over the sites where the check actually ran, and the edition data records how many that was. An earlier build of this edition reported those unknowns as failures and put small business HTTPS enforcement at 50% missing instead of 9%; hand-testing twenty of them found fourteen that plainly do redirect. The scanner now records the difference.
June published an F (26) for this cohort and this edition reads E (43). Most of that gap is a measurement correction, not improvement. Twenty of June’s enterprise and government domains were scanned unsuccessfully and counted as F-grade zeros rather than excluded; corrected on the same captures, June reads E (41). The real quarter-on-quarter movement is two points. The June edition carries a correction note setting this out, and we would rather publish that than quietly restate a better number.
The internal contrast remains the story. Where a control belongs to a discipline with a mandate - email anti-spoofing, at 88% enforcement - this cohort leads the country. Where it belongs to whoever runs the website, it lands within a couple of points of businesses it out-resources enormously. Large organisations secure what their org chart tells them to secure.
Sixteen of the 75 sampled domains could not be scored for security, the highest exclusion count of any cohort this edition. Most permanently redirect their apex elsewhere, which is routine around machinery-of-government changes and rebrands; several refused the scan. All are listed above with their reason. Exclusion is decided on objective criteria before any score is read.
Methodology
Every cohort baseline is produced by the same methodology: quarterly cadence, a deterministic seeded sample drawn from a validated pool, and scan failures excluded before scoring - never on score. Read the full methodology on the research overview.
Previous editions
This baseline refreshes quarterly, and this page always carries the latest edition. Superseded editions are archived unchanged at their own dated address, so a citation can always be checked against the edition it was drawn from.
- June 2026 - carries a correction