How Secure Are the Forbes AI 50? We Scanned All 50 Companies (2026)

The 50 most promising private AI companies have encryption down cold. The next layer of domain security, the controls that stop email interception, rogue certificates and DNS tampering, is still mostly switched off.

The basics are solved

Start with the good news. Every connection to these companies' websites is encrypted with a modern protocol. 49 of 50 support TLS 1.3, and Cyera still negotiates the older but still-secure TLS 1.2. Not one accepts TLS 1.0 or 1.1, which browsers retired in 2020. Certificates come from mainstream authorities: Google Trust Services, Let's Encrypt and Amazon.

Email authentication has also crossed a threshold. All 50 domains publish a DMARC record, the policy that tells receiving mail servers what to do with messages that fail sender checks. Google and Yahoo have required DMARC from bulk senders since February 2024, so for a company that sends product email at scale it's no longer optional.

Email: everyone publishes DMARC, fewer than half enforce it fully

Publishing DMARC and enforcing it are different things. A DMARC policy has three settings: p=none only monitors, p=quarantine sends failing mail to spam, and p=reject blocks it before it reaches anyone's inbox.

22 companies, including OpenAI, Anthropic, Databricks and Perplexity, reject spoofed mail. 24 stop at quarantine, which still lands a convincing fake in a spam folder where people do go looking. Applied Intuition, EliseAI, Rogo and Clay are at p=none, so a message forged to look like it came from their domain gets delivered normally.

For buyers this matters more than it sounds. One of the most common frauds against a vendor's customers is a fake invoice or "updated bank details" email sent from the vendor's own domain. DMARC at reject is the control that makes that exact forgery fail.

On the sending side, 18 of 50 use a hard-fail SPF record (-all) and most of the rest use soft fail (~all). With DMARC enforcing, the difference is small, but it shows how many teams have tightened every setting rather than just the headline one.

MTA-STS: one company out of 50

Email between mail servers is encrypted only if both sides agree to it, and the agreement happens in the clear. An attacker positioned on the network can strip the offer to encrypt, and the message falls back to plain text without anyone noticing. MTA-STS closes that gap: it's a published policy that tells other mail servers "only deliver to me over verified TLS."

Sierra is the only company on the list with an MTA-STS policy, and it's set to testing, which reports failures without blocking anything. Sierra also publishes a TLS-RPT record, so it gets daily reports on delivery failures. Every other company leaves its inbound email to opportunistic encryption.

This is the clearest gap in the whole study because the fix is small. With 46 of the 50 companies on Google Workspace, the setup is the same for almost all of them: host a short policy file, add two DNS records, and move from testing to enforce once the reports come back clean. Read the MTA-STS guide →

DNSSEC and CAA: switched on, not always finished

DNSSEC signs a domain's DNS records so that resolvers can detect forged answers, such as a redirect of the company's login page or mail servers to an attacker. It takes two steps: sign the zone at the DNS provider, then publish a DS record at the registrar so the rest of the internet knows to check the signatures.

10 of the 50 companies took the first step. Only 5 (Databricks, Abridge, Glean, Rogo and ElevenLabs) took the second. SambaNova Systems, Fal, Physical Intelligence, Genspark and Speak have signed zones with no DS record at the registrar, which means resolvers never validate the signatures. It's a one-record fix, and it's also the most common way DNSSEC rollouts stall.

CAA records are simpler still: a DNS entry naming which certificate authorities may issue certificates for the domain. 7 of 50 publish one (OpenAI, Mistral AI, Databricks, Together AI, Fal, Listen Labs and HeyGen). Without one, any publicly trusted certificate authority can issue a certificate for the domain, so a single CA with weak validation is enough for an attacker to get one.

Browser protections: HSTS and security headers

HSTS tells browsers to only ever connect to a site over HTTPS, closing the window where a first visit over plain HTTP can be intercepted. 43 of 50 send the header. Thinking Machines Lab, Together AI, Gamma, Clay, Midjourney and Surge AI don't send it on their homepage.

A few send HSTS with a lifetime too short to help: ElevenLabs' expires after 30 minutes, Anthropic's expires after one hour, and Genspark's expires after 30 days. The protection only covers visitors who've been to the site within that window, so a one-hour policy covers almost no one. The common recommendation is at least six months, and a year with preload (12 companies do this) bakes the rule into browsers themselves.

Security headers are instructions the site sends to the browser: don't let other sites frame this page, don't guess file types, don't leak full URLs to third parties. Only Mistral AI, Lovable, Perplexity and Midjourney send all five. Safe Superintelligence, OpenEvidence, Skild AI, EliseAI and HeyGen send none on their homepage.

Content-Security-Policy is the most powerful and the hardest to get right. 32 companies send one, but Sierra's is the only one free of settings like 'unsafe-inline' or 'unsafe-eval', which re-open the script-injection attacks CSP exists to stop. A CSP with those settings is common on marketing sites built on modern frameworks. It's better than nothing, but it's not the protection it looks like.

Who do you call? security.txt and bug bounties

A security.txt file (RFC 9116) tells researchers where to report a vulnerability. It's a small file, and its absence often means a report goes to a support inbox or nowhere. 22 of 50 companies publish one. OpenAI, Anthropic, Together AI and Sierra route reports to a public bug bounty or disclosure program on Bugcrowd or HackerOne.

For AI companies this matters more than usual. Prompt-injection, data-exfiltration and model-abuse reports are a new and fast-growing category, and researchers need a clear place to send them.

Known breaches

Suno is the only company on the list that appears in Have I Been Pwned, the public breach database. According to its HIBP entry, 55,282,226 accounts were exposed in a breach in November 2025 that was added to the database on 20 July 2026. The exposed data included email addresses, names, phone numbers, physical addresses, partial payment card details (card type, expiry and last four digits) and purchase history.

Configuration scores and breaches measure different things. Suno's domain configuration scores 85, around the list average. Most breaches start with stolen credentials, a compromised vendor or a vulnerable application, none of which a DNS or header check can see. Breach history is weighted in the LynxRadar score, but a good score is never evidence that a breach couldn't happen.

The AI 50 run on the same three vendors

46 of the 50 companies handle email through Google Workspace. 28 use Cloudflare for DNS, and 32 serve their website through Cloudflare; 21 host on Vercel. Those are sensible defaults, and each vendor is better at running its piece than a startup would be. The trade-off is correlated risk: an outage or misconfiguration at one of them lands on most of the list at once, and a phishing kit that imitates the Google Workspace login works against nearly all of them.

How the categories compare

Robotics & world models companies average highest (88.2) and Data & talent lowest (77.5), but with two to eight companies per group the differences between categories are smaller than the spread inside them. What kind of AI a company builds says little about how it runs its domain.

What the score does and doesn't tell you

An external scan sees what anyone on the internet can see: DNS, certificates, email policy and the headers a homepage sends. It's a fast, objective read on how carefully a company manages its public attack surface, and it's the same view an attacker starts with.

It can't see access controls, employee security training, how customer data is stored, or whether the company has SOC 2 or ISO 27001. A small lab with a one-page website (Safe Superintelligence scores 88) can outscore a company running a large product platform, simply because there's less to configure. Treat the grade as a first filter and a list of good questions, not a verdict.

Vetting an AI vendor? Six checks that take a minute

Everything in this study can be checked for any vendor before you sign. Here's what to look for, in order of how much it tells you:

1. DMARC at p=reject. If it's at none, anyone can send email as that vendor, including invoices to you.
2. A security.txt or published disclosure policy. It shows someone owns security reports, and tells you where to send one.
3. HSTS with a max-age of at least six months. Short or missing HSTS means nobody has reviewed the site's transport settings.
4. No appearances in breach databases, or a clear public account of what happened and what changed.
5. DNSSEC fully deployed and CAA records present. Rare, so treat them as a sign of a mature team rather than a requirement.
6. MTA-STS in enforce mode. The strongest signal on this list: almost nobody has it, so the teams that do are paying close attention.