The Australian Medium Business Posture Baseline measures the public-facing security posture of substantial Australian businesses above the SMB tier - large private and family-owned companies, partnerships, mutuals, co-operatives and large not-for-profits on .com.au and .au domains, none of them ASX-listed. Each quarterly edition scans a deterministic sample across the Security, Email and Domain categories of every Red Bridge Cyber scan. In the comparison story this is the middle rung - businesses big enough to have IT budgets and often a managed-services provider, but without a listed company’s security team. It is the first test of whether posture actually improves with size.
When an article on this site says something like (Red Bridge Cyber Medium Business Posture Baseline, June 2026), this page is what that citation points to.
Current edition - September 2026
The September 2026 edition scanned a deterministic sample of 75 domains drawn from a validated pool of Australian medium businesses (.com.au/.au, non-ASX), completing on 8 September 2026. Results below; how every number is produced is on the methodology section.
Executive summary of findings
The September 2026 edition scanned 75 substantial Australian businesses above the SMB tier, none ASX-listed. The median medium business website earns an E (41/100) for web security, a B for email posture and an E for DNS hardening.
- Size buys defaults, not decisions. 70% of scored sites publish no Content-Security-Policy and 79% no Permissions-Policy, while only 5% fail to enforce HTTPS - the kind of control a managed-services provider switches on without being asked.
- Email discipline is genuinely better. 96% publish a DMARC record and 79% enforce one, well clear of the small business figure.
- DNS hardening stays thin. DNSSEC 9%, CAA 11%, MTA-STS 4%.
- TLS 1.3 is nearly universal - only 3% of scored sites lack it, the best rate of any cohort.
Full results tables below. 75 domains sampled, 67 scored for security, with every unscorable domain disclosed with its reason.
Email posture - can the domain’s mail be trusted, and can the domain be spoofed? Median grade B (86/100). Share of the cohort passing each check:
| Check | % passing |
|---|---|
| Mail-routed (MX with STARTTLS) | 97% |
| SPF | 95% |
| DMARC | 79% |
| DKIM | 85% |
| MTA-STS | 3% |
| TLS-RPT | 4% |
| DNSSEC | 9% |
| Reverse DNS | 96% |
All 75 sampled domains were scoreable for email.
Domain
Domain (DNS) posture - the records that protect the domain name itself. Median grade E (44/100). Share of the cohort with each control in place:
| Check | % with control |
|---|---|
| SPF record | 97% |
| DMARC published | 96% |
| DMARC enforced (quarantine/reject) | 79% |
| DNSSEC | 9% |
| CAA record | 11% |
| MTA-STS | 4% |
| IPv6 at the apex | 21% |
All 75 sampled domains were scoreable for domain.
Security
Web security posture - TLS configuration, security headers and the basics of a defensible website. Median grade E (41/100), the weakest category measured. Share of scored sites missing each control:
| Check | % missing |
|---|---|
| HTTPS enforcement | 5% |
| HSTS | 46% |
| Content-Security-Policy | 70% |
| X-Content-Type-Options (nosniff) | 54% |
| Referrer-Policy | 69% |
| Permissions-Policy | 79% |
| TLS 1.3 | 3% |
| security.txt | 99% |
67 of 75 sampled domains scored (7 redirect-only, 1 unreachable - see Commentary).
Commentary
One figure in the table above is measured on less than the full cohort, and we would rather say so than round it away. HTTPS enforcement is established by a plain-HTTP request, and that probe runs through a proxy that cannot serve every scan at once; where it did not return, the result is recorded as unknown rather than as a failure to redirect. The percentage is computed only over the sites where the check actually ran, and the edition data records how many that was. An earlier build of this edition reported those unknowns as failures and put small business HTTPS enforcement at 50% missing instead of 9%; hand-testing twenty of them found fourteen that plainly do redirect. The scanner now records the difference.
This cohort exists to answer one question for a small business owner: does posture improve when a business gets bigger and hires help? The September answer is the same qualified yes June gave. The controls a provider switches on by default are in better shape, and the controls that need somebody to decide - security headers, DMARC enforcement, DNS hardening - look much like the small business picture.
The comparison with June is close to flat: E (41) against E (43) for security, B for email in both. That is what we expect, and it is worth saying why. The sample is re-drawn every edition, so only 21 of these 75 domains were also in June’s. On those 21, exactly two changed anything across every email check we capture - one moved DMARC to enforcement, one added an SPF record. Nothing regressed.
Eight of the 75 sampled domains could not be scored for security and are disclosed above. Exclusion is decided on objective criteria before any score is read. Everything is measured from the public surface only: DNS lookups, a normal page fetch, and public scanning endpoints.
Methodology
Every cohort baseline is produced by the same methodology: quarterly cadence, a deterministic seeded sample drawn from a validated pool, and scan failures excluded before scoring - never on score. Read the full methodology on the research overview.
Previous editions
This baseline refreshes quarterly, and this page always carries the latest edition. Superseded editions are archived unchanged at their own dated address, so a citation can always be checked against the edition it was drawn from.
- June 2026 - carries a correction