Small business cybersecurity statistics

What's the typical security score for US small businesses?

The median score was 73 out of 100. The middle half of the 2,000 sites scored between 65 and 81, and 12% scored 85 or higher. Scores use the same formula as every CyberVigil report, so you can compare yours directly. How scoring works

Key findings

How many US small businesses use SPF and DMARC?

33% publish a DMARC record, and 11% set it to quarantine or reject fake email. 65% publish a valid SPF record. SPF and DMARC are DNS records that help inboxes spot email pretending to come from your domain. DMARC set to monitor only (p=none) collects reports but doesn't stop fakes. Email security guides

How many US small businesses use HTTPS and security headers?

89% load over HTTPS with a valid certificate, but only 2% send all six browser security headers we check. These checks look at the homepage and its certificate. When a site blocked our automated request, we left it out of that check rather than counting it as a problem, so totals vary a little.

Do US small businesses use DNSSEC, and are any on blocklists?

3% have DNSSEC turned on and 1% publish a CAA record. None of the sites appeared on the malware and phishing blocklists we check.

How do US small businesses compare by state?

In the 13 states with enough sites, median scores ranged from 71 in Pennsylvania and Michigan to 76 in Georgia, against 73 nationally. The share of sites with a DMARC record ranged from 21% in Michigan to 38% in New Jersey. With 50 to 272 sites per state, gaps of a few points can be down to chance. States with fewer sites are still part of the national numbers above, but too small to show on their own.

Which website and email platforms do US small businesses use?

WordPress was the most common website platform we could identify, on 30% of sites. For email, 21% use Google Workspace and 21% use Microsoft 365. We detect platforms from public signals like page markup and MX records. Median scores only appear for groups of 25 sites or more.

How did we collect this data?

1. We pulled every place in the October 21, 2026 release of Overture Maps' open places data that is a shop, restaurant, clinic, salon, gym, trade or professional service (leaving out hospitals, malls, big-box stores and corporate offices) with an address in one of the 50 states or Washington, DC. Only listings with a website, marked open and rated at least 70% likely to exist by Overture, counted. That gave 8,169,343 listings.
2. We left out websites listed in three or more cities anywhere in the US, or tied to a known brand, which usually means a chain or franchise (3,209,250 listings). We also dropped pages on sites the business doesn't control, like Facebook or Yelp (283,538), and public-sector sites (45,579). That left 3,877,358 independent websites.
3. We put that list in a fixed random order and scanned sites in order until 2,000 had loaded. Along the way we skipped 472 sites that were offline or whose domain no longer worked.
4. Each site got the same passive checks as our free scanner on October 24, 2026: public DNS records, the homepage over ports 80 and 443, and the TLS certificate. We didn't log in, probe for weaknesses or change anything. What we check

Limits to keep in mind

• Overture builds its places data from sources like Meta, Microsoft and Foursquare. It doesn't list every business, some listings are out of date, and businesses with a website may not match those without one.
• DKIM uses selectors we can only guess from outside, so we don't report it here.
• A good score here means the public settings we check look right. It doesn't mean a business can't be attacked.
• We don't publish business names or any single site's results. Business owners can run a free scan to see their own report.

Business listings from Overture Maps Foundation places data, release 2026-10-21.0, with data from Meta, Microsoft and others under CDLA Permissive 2.0 and from Foursquare under Apache 2.0.