The Multinational Posture Baseline measures the public-facing security posture of global mega-cap companies on their .com apex domains - including Australian-headquartered multinationals. Each quarterly edition scans a deterministic sample across the Security, Email and Domain categories of every Red Bridge Cyber scan. This is the top of the comparison ladder: the brands with the largest security budgets on the planet. Where they still miss the basics, the lesson for a small business is that posture is about discipline, not headcount - and where they get it right, the gap shows exactly what good looks like.
When an article on this site says something like (Red Bridge Cyber Multinational Posture Baseline, June 2026), this page is what that citation points to.
Current edition - September 2026
The September 2026 edition scanned a deterministic sample of 75 domains drawn from a validated pool of multinational .com domains, completing on 8 September 2026. Results below; how every number is produced is on the methodology section.
Executive summary of findings
The September 2026 edition scanned 75 global mega-cap companies on their .com apex domains. They remain the best cohort measured, and the bar they set is an E: 43/100 for web security, a B for email posture, and a D (52) for DNS hardening - the only cohort in the programme to clear an E on DNS.
- The deliberate controls lead everywhere. CSP missing on 46% of scored sites against 58% to 81% elsewhere, HSTS missing on only 21%, and security.txt missing on 76% - the strongest header discipline measured.
- Email enforcement is near-universal. 96% publish a DMARC record and 91% enforce one, the highest rate in the programme.
- Even here the basics slip. 13% of the sites we could test fail to enforce HTTPS, and 27% lack TLS 1.3 - the worst TLS 1.3 rate of any cohort.
- DNS hardening leads and is still thin. DNSSEC 16%, CAA 25%, MTA-STS 13% - the best figures in the programme, and none of them is one in three.
Full results tables below. 75 domains sampled, 67 scored for security, with every unscorable domain disclosed with its reason.
Email posture - can the domain’s mail be trusted, and can the domain be spoofed? Median grade B (86/100). Share of the cohort passing each check:
| Check | % passing |
|---|---|
| Mail-routed (MX with STARTTLS) | 92% |
| SPF | 88% |
| DMARC | 91% |
| DKIM | 84% |
| MTA-STS | 8% |
| TLS-RPT | 20% |
| DNSSEC | 16% |
| Reverse DNS | 85% |
All 75 sampled domains were scoreable for email.
Domain
Domain (DNS) posture - the records that protect the domain name itself. Median grade D (52/100). Share of the cohort with each control in place:
| Check | % with control |
|---|---|
| SPF record | 95% |
| DMARC published | 96% |
| DMARC enforced (quarantine/reject) | 91% |
| DNSSEC | 16% |
| CAA record | 25% |
| MTA-STS | 13% |
| IPv6 at the apex | 11% |
All 75 sampled domains were scoreable for domain.
Security
Web security posture - TLS configuration, security headers and the basics of a defensible website. Median grade E (43/100), the weakest category measured. Share of scored sites missing each control:
| Check | % missing |
|---|---|
| HTTPS enforcement | 13% |
| HSTS | 21% |
| Content-Security-Policy | 46% |
| X-Content-Type-Options (nosniff) | 33% |
| Referrer-Policy | 63% |
| Permissions-Policy | 76% |
| TLS 1.3 | 27% |
| security.txt | 76% |
67 of 75 sampled domains scored (5 redirect-only, 1 bot-block, 1 unreachable, 1 unreachable (timeout on 3 attempts) - see Commentary).
Commentary
One figure in the table above is measured on less than the full cohort, and we would rather say so than round it away. HTTPS enforcement is established by a plain-HTTP request, and that probe runs through a proxy that cannot serve every scan at once; where it did not return, the result is recorded as unknown rather than as a failure to redirect. The percentage is computed only over the sites where the check actually ran, and the edition data records how many that was. An earlier build of this edition reported those unknowns as failures and put small business HTTPS enforcement at 50% missing instead of 9%; hand-testing twenty of them found fourteen that plainly do redirect. The scanner now records the difference.
This is the top of the comparison ladder and it reads both ways. Where the multinationals get it right - header discipline, DMARC enforcement, certificate policy - the gap to everyone else shows what disciplined operations produce, and none of it depends on headcount. Every leading control here is a configuration a small business can ship in an afternoon. Where they still miss, the lesson is that scale does not finish the job either: a quarter have not enabled TLS 1.3.
Against June the cohort is slightly down - E (43) against E (47) for security, DNS D (52) against E (49) - and neither difference should be read as movement. Only 14 of these 75 domains were also in June’s sample. On those 14, one domain changed anything at all across every email check we capture.
Eight of the 75 sampled domains could not be scored for security. One, tencent.com, produced no response at all across three attempts and to a direct request from outside the scanner, so it is excluded as unreachable rather than scored. The rest redirect their apex elsewhere or refused the scan. Exclusion is always decided on objective criteria before any score is read.
Methodology
Every cohort baseline is produced by the same methodology: quarterly cadence, a deterministic seeded sample drawn from a validated pool, and scan failures excluded before scoring - never on score. Read the full methodology on the research overview.
Previous editions
This baseline refreshes quarterly, and this page always carries the latest edition. Superseded editions are archived unchanged at their own dated address, so a citation can always be checked against the edition it was drawn from.
- June 2026 - carries a correction