The Australian SMB Posture Baseline is a quarterly measurement of the real, public-facing security posture of Australian small business websites - what their DNS, email authentication, TLS and HTTP security configuration actually looks like from the outside, measured across the same five categories as every Red Bridge Cyber customer scan: Security, Email, Domain, Speed and Visibility. The cohort is Australian small-to-mid-size businesses on .com.au domains. It is the reference cohort of the research programme - the baseline every other cohort is compared against, and the dataset behind every statistic we publish.
When an article on this site says something like (Red Bridge Cyber SMB Posture Baseline, June 2026), this page is what that citation points to.
Current edition - September 2026
The September 2026 edition scanned a deterministic sample of 150 domains drawn from a validated pool of Australian small business domains (.com.au), completing on 8 September 2026. Results below; how every number is produced is on the methodology section.
Executive summary of findings
The September 2026 edition scanned 150 Australian small business websites. The typical Australian small business website earns an E (36/100) for web security, an E for DNS hardening and a C for email posture, while scoring an A+ on the visibility basics.
- Security headers are the gap, not HTTPS. 69% of scored sites publish no Content-Security-Policy and 55% send no HSTS header. HTTPS enforcement is in far better shape - 9% of the sites we could test on that check fail to redirect plain HTTP.
- The DMARC gap is unchanged. 85% publish a DMARC record and 49% enforce one - most have done the easy half of anti-spoofing and stopped.
- DNS hardening is still close to undeployed. DNSSEC 2%, CAA 3%, MTA-STS 5%.
- Visibility is the bright spot, except for AI. The technical-SEO basics are near-universal, but only 13% publish AI-crawler rules and 27% an llms.txt.
Full results tables below. 150 domains sampled, 133 scored for security, and every domain we could not score is disclosed with its reason.
Email posture - can the domain’s mail be trusted, and can the domain be spoofed? Median grade C (73/100). Share of the cohort passing each check:
| Check | % passing |
|---|---|
| Mail-routed (MX with STARTTLS) | 99% |
| SPF | 93% |
| DMARC | 49% |
| DKIM | 81% |
| MTA-STS | 1% |
| TLS-RPT | 4% |
| DNSSEC | 2% |
| Reverse DNS | 97% |
All 150 sampled domains were scoreable for email.
Domain
Domain (DNS) posture - the records that protect the domain name itself. Median grade E (42/100). Share of the cohort with each control in place:
| Check | % with control |
|---|---|
| SPF record | 97% |
| DMARC published | 85% |
| DMARC enforced (quarantine/reject) | 49% |
| DNSSEC | 2% |
| CAA record | 3% |
| MTA-STS | 5% |
| IPv6 at the apex | 21% |
All 150 sampled domains were scoreable for domain.
Security
Web security posture - TLS configuration, security headers and the basics of a defensible website. Median grade E (36/100), the weakest category measured. Share of scored sites missing each control:
| Check | % missing |
|---|---|
| HTTPS enforcement | 9% |
| HSTS | 55% |
| Content-Security-Policy | 69% |
| X-Content-Type-Options (nosniff) | 54% |
| Referrer-Policy | 76% |
| Permissions-Policy | 89% |
| TLS 1.3 | 8% |
| security.txt | 98% |
133 of 150 sampled domains scored (14 redirect-only, 3 unreachable - see Commentary).
Visibility
Visibility - the technical signals that decide whether a site can be found, by search engines and now by AI assistants. Measured for the SMB cohort only (why below). Median grade A+ (94/100) - the strongest category in this cohort, and the one place the bar is higher than most owners think.
| Check | % with signal |
|---|---|
| HTTPS enforced | 91% |
| Page title | 99% |
| Mobile viewport | 97% |
| Meta description | 83% |
| XML sitemap | 88% |
| robots.txt | 94% |
| Sitemap referenced in robots.txt | 83% |
| Canonical tag | 88% |
| JSON-LD structured data | 74% |
AI-search readiness is the open ground - the signals AI assistants and answer engines look for:
| Check | % with signal |
|---|---|
| AI-crawler rules in robots.txt | 13% |
| llms.txt | 27% |
10% of scored sites serve mixed (insecure) content on an otherwise-HTTPS page.
143 of 150 sampled domains scored (7 unreachable - see Commentary).
Why visibility is measured for the SMB cohort only
We scan all five cohorts on Security, Domain and Email for exactly one reason: so a small business can see how it stacks up against the big end of town on the same checks. Visibility is the one category where that comparison would mislead rather than inform. Search visibility for a small business is a contest fought on a single website with table-stakes signals - the things this section measures. The other cohorts are not playing that game:
- Large businesses and multinationals market hundreds of products against thousands of search terms, with advertising budgets and whole teams running it. Their apex domain’s technical signals say almost nothing about how they actually win search.
- Education runs search as part of a seasonal enrolment go-to-market - often spread across faculty sites and separately branded campaigns rather than the main domain we measure, and timed to when enrolments happen.
- Government is the only game in town. It does not need to win a search placement contest; its visibility work is content quality and alignment with policy, not competing for position.
There is no honest like-for-like in any of that, so rather than publish a comparison that would not mean anything, we simply do not capture visibility data for the other cohorts.
Commentary
One figure in the table above is measured on less than the full cohort, and we would rather say so than round it away. HTTPS enforcement is established by a plain-HTTP request, and that probe runs through a proxy that cannot serve every scan at once; where it did not return, the result is recorded as unknown rather than as a failure to redirect. The percentage is computed only over the sites where the check actually ran, and the edition data records how many that was. An earlier build of this edition reported those unknowns as failures and put small business HTTPS enforcement at 50% missing instead of 9%; hand-testing twenty of them found fourteen that plainly do redirect. The scanner now records the difference.
The security median reads E (36) against June’s published F (20), and almost all of that difference is a measurement correction rather than a change in posture. June counted 40 small business domains that our scanner never actually reached as F-grade zeros; corrected on the same captures, June reads E (31). The honest quarter-on-quarter movement is five points, not sixteen. The correction note on the June edition explains it in full.
What did not move is the more useful finding. Of the 450 domains in this edition, 104 were also in the June sample - the sample is re-drawn each quarter - and across every email-authentication check we capture, seven of those 104 changed anything at all. Four moved DMARC to an enforcing policy, one turned on DNSSEC, one added SPF, one added TLS-RPT. Nothing regressed anywhere. Posture is sticky in both directions: hard to improve, and durable once in place.
Seventeen of the 150 sampled domains could not be scored for security and are disclosed rather than hidden. Most permanently redirect their apex to a different registrable domain, which is typical of mergers and migrations; the rest either refused the scan outright or blocked it on TLS fingerprint. Exclusion is always decided on these objective criteria before any score is read: a live site that scores an E is data, never an exclusion.
Everything here is measured from the public surface only - DNS lookups, a normal page fetch, and public scanning endpoints. No intrusive tooling, no authenticated access, nothing a regular visitor could not see.
Methodology
Every cohort baseline is produced by the same methodology: quarterly cadence, a deterministic seeded sample drawn from a validated pool, and scan failures excluded before scoring - never on score. Read the full methodology on the research overview.
Previous editions
This baseline refreshes quarterly, and this page always carries the latest edition. Superseded editions are archived unchanged at their own dated address, so a citation can always be checked against the edition it was drawn from.
- June 2026 - carries a correction