2979
Companies Analyzed
Security gap intelligence across Fortune 500, Y Combinator, and more.
How secure are the Forbes AI 50?
Original research: we scanned all 50 companies on the Forbes 2026 AI 50 list.
50
AI companies
Companies without DNSSEC
These domains haven't enabled DNSSEC, leaving them potentially vulnerable to DNS spoofing and cache …
2623
88% of scanned
Companies without DMARC configured
These domains have no DMARC record or a permissive policy (p=none), leaving them vulnerable to email…
2236
75% of scanned
Companies missing security headers
These domains are missing critical HTTP security headers like Content-Security-Policy, X-Frame-Optio…
2086
70% of scanned
Companies without HSTS enabled
These domains don't enforce HTTPS via HSTS, making users vulnerable to downgrade attacks and SSL str…
1176
39% of scanned
Companies without SPF records
These domains lack an SPF record, meaning they have no protection against unauthorized email senders…
636
21% of scanned
Companies without MTA-STS
These domains have no MTA-STS configured, leaving email in transit vulnerable to TLS downgrade attac…
632
21% of scanned
Companies without DNS CAA records
These domains have no CAA records, meaning any Certificate Authority in the world can issue SSL cert…
613
21% of scanned
Companies without security.txt
These domains have no security.txt file (RFC 9116), indicating they lack a formal vulnerability disc…
569
19% of scanned
Companies with TLS configuration issues
These domains have outdated TLS versions, weak cipher suites, or other TLS misconfigurations that co…
355
12% of scanned
Companies with insecure cookie configurations
These domains set cookies without proper security flags (Secure, HttpOnly, SameSite), leaving users …
175
6% of scanned
Companies with known data breaches
These domains have been associated with publicly disclosed data breaches, indicating historical secu…
0
0% of scanned
Companies with known CVE vulnerabilities
These domains expose technologies with known CVE vulnerabilities that could be exploited by attacker…
0
0% of scanned
Companies accepting deprecated TLS versions
These domains still accept TLS 1.0 or TLS 1.1 connections, which have known vulnerabilities and were…
0
0% of scanned
