Comparing organizations takes more than running the same test.
The Sector Benchmark compares IEQ results with sector aggregates. Two results are only comparable when they share the same reference, the same calculation mode, the same engine version, and equivalent coverage. Without those four conditions, the difference between two organizations may be entirely methodological, and a methodological difference presented as a difference in risk is worse than no comparison at all.
Comparing multiple organizations (units, subsidiaries, acquisition targets, or competitors) with a criterion that survives the question of why one looks worse than another.
What is at stake
GWK's sector benchmark is the IEQ publication used by the products: 80,182 companies scored by a single engine version, aggregated by sector with an anonymity floor of K = 30.
- Source
- IEQ publication used by the products, sector aggregates
- Date
- October 7, 2026
- Population
- 80,182 companies in the publication used by the products
- Coverage
- Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.
Limitation. The ruler is a static reference base, not a continuous measurement. There is no automatic update between one run and the next, and this site promises no cadence.
IEQ remains the index.
The same collection infrastructure applied to every organization in the cohort.
A single engine version and a single calibration for the entire run.
Median, dispersion, percentiles, and band distribution, respecting the anonymity floor.
Positioning a defined set of organizations against the sector ruler.
A comparison across entities you name, against anonymous aggregates.
What you receive
- A ranking of the assessed entities, with ruler and date stated.
- Each entity's percentile against its own sector cohort.
- Distribution by risk band within the set.
- Dispersion and identification of outliers in the set.
- An executive readout of what the comparison supports.
- A sanitized dataset, when the scope calls for it.
See the method's limits, the dependencies and where measurement ends
The conditions of comparison
The four comparability conditions are not a formality: breaking any one of them turns the ranking into an artifact of method.
Observed
Public collection saw
- The same public surface, collected with the same modules.
- The same collection window for the entire set.
Calculated
The IEQ engine derived
- Score on the same scale, with the same engine version.
- Percentile against the corresponding sector cohort.
- Dispersion and relative position within the set.
Inferred
The model estimated
- Each entity's sector, when not declared.
- Sector prior for data shelf life.
Out of scope
Other evidence decides
- That the better-ranked organization is more secure in general cybersecurity.
- Comparison between results from different modes, public and complete.
- Comparison with results from another run, calibration, or engine version.
- Identification of any organization inside the sector aggregates.
What it depends on
- A closed list of organizations and domains to compare.
- Authorization to assess domains that are not yours.
- Collection of all entities in the same window, so the comparison does not mix cutoffs.
Boundary
Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
Why measuring does not reduce exposureDefine the set
A comparison starts from a closed list of organizations and the decision the result will support. The more specific the set, the easier the result is to interpret.