Phoenix small business cybersecurity statistics

What's the typical security score for Phoenix small businesses?

The median score was 73 out of 100. The middle half of the 400 sites scored between 65 and 81, and 13% scored 85 or higher. Scores use the same formula as every CyberVigil report, so you can compare yours directly. How scoring works

Key findings

How many Phoenix small businesses use SPF and DMARC?

34% publish a DMARC record, and 12% set it to quarantine or reject fake email. 72% publish a valid SPF record. SPF and DMARC are DNS records that help inboxes spot email pretending to come from your domain. DMARC set to monitor only (p=none) collects reports but doesn't stop fakes. Email security guides

How many Phoenix small businesses use HTTPS and security headers?

90% load over HTTPS with a valid certificate, but only 2% send all six browser security headers we check. These checks look at the homepage and its certificate. When a site blocked our automated request, we left it out of that check rather than counting it as a problem, so totals vary a little.

Do Phoenix small businesses use DNSSEC, and are any on blocklists?

2% have DNSSEC turned on and 1% publish a CAA record. None of the sites appeared on the malware and phishing blocklists we check.

Which website and email platforms do Phoenix small businesses use?

WordPress was the most common website platform we could identify, on 32% of sites. For email, 22% use Google Workspace and 27% use Microsoft 365. We detect platforms from public signals like page markup and MX records. Median scores only appear for groups of 25 sites or more.

How did we collect this data?

1. We pulled every place in the October 21, 2026 release of Overture Maps' open places data that is a shop, restaurant, clinic, salon, gym, trade or professional service (leaving out hospitals, malls, big-box stores and corporate offices) with a Phoenix, Arizona address. Only listings with a website, marked open and rated at least 70% likely to exist by Overture, counted. That gave 37,971 listings.
2. We left out websites listed in three or more cities anywhere in the US, or tied to a known brand, which usually means a chain or franchise (14,035 listings). We also dropped pages on sites the business doesn't control, like Facebook or Yelp (1,114), and public-sector sites (130). That left 19,858 independent websites.
3. We put that list in a fixed random order and scanned sites in order until 400 had loaded. Along the way we skipped 84 sites that were offline or whose domain no longer worked.
4. Each site got the same passive checks as our free scanner on October 24, 2026: public DNS records, the homepage over ports 80 and 443, and the TLS certificate. We didn't log in, probe for weaknesses or change anything. What we check

Limits to keep in mind

• Overture builds its places data from sources like Meta, Microsoft and Foursquare. It doesn't list every business, some listings are out of date, and businesses with a website may not match those without one.
• DKIM uses selectors we can only guess from outside, so we don't report it here.
• A good score here means the public settings we check look right. It doesn't mean a business can't be attacked.
• We don't publish business names or any single site's results. Business owners can run a free scan to see their own report.

Business listings from Overture Maps Foundation places data, release 2026-10-21.0, with data from Meta, Microsoft and others under CDLA Permissive 2.0 and from Foursquare under Apache 2.0.