Sector · Technology

Lowest structural exposure, largest observable surface.

The technology sector has the lowest exposure median on the operational ruler. Reading that as superior posture would be a mistake: the same ruler shows the sector has the highest observable exposure median of all. What lowers the result is the short horizon of its own data — and the client data it hosts carries the client's horizon, not its own.

01Sector profile on the ruler

The comparison available

Cohort

30,833

companies · SaaS

Sector median

26.9

Low

Half the cohort between

25.4 – 31.0

p25 – p75

Standard deviation

3.73

Distribution by band

Low99.5%
Minimal0.5%

H · time horizon

0.3409

E · observable exposure

0.6151

Cohort medians at the cutoff date. H accounts for the shelf life of the data the cryptography protects; E, for the surface reachable from outside. Both describe the cohort, not your organization.

Practically the entire sector cohort falls in the lowest band on the ruler, with the smallest dispersion among the five sectors with their own page. That makes internal comparison uninformative — nearly everyone sits in the same place — and shifts the useful readout to the observable dimension, where this sector has the highest median on the entire ruler.

The aggregates describe the cohort at the cutoff date, with an anonymity floor. No company is identifiable in them.

What this comparison is measured against

Cutoff date: July 12, 2026
Run: producao_324k_20260712
Population: 316,911 companies
Sectors: 15 sectors in the engine taxonomy
Anonymity floor: K = 30

Limits of the comparison

The ruler is a static reference base, not a continuous measurement: there is no automatic update between one run and the next.
Comparison is always against anonymous aggregates, never against another organization's individual result.
A public-mode result does not compare to a complete-mode result, because the two readings start from different kinds of evidence.

02What distinguishes the sector

Technology runs on the shortest data cycle and the widest surface: many domains, many subdomains, many APIs, and a rate of infrastructure change that does not exist in other sectors. That improves position on one dimension and worsens it on another.

A wide surface: domains, subdomains, APIs, and environments.
A short infrastructure replacement cycle.
Greater cryptographic agility, when exercised.
A supplier role: your own exposure becomes your client's exposure.

03Data shelf life

The sector's time horizon median is the lowest on the ruler: a meaningful share of the data in transit has short-term value — session, telemetry, operational state. But that applies to the company's own data. The client data it hosts may carry the client's sector horizon, and that distinction does not appear in the supplier's score.

Operational and session data, with short-lived value.
Product code and intellectual property, with long-lived value.
Credentials and integration secrets, sensitive while valid.
Hosted client data, carrying that client's sector horizon.

Typical dependencies

Cloud providers and managed services.
Content delivery networks and TLS termination.
Certificate authorities and issuance automation.
Third-party libraries and dependencies in the product.

04The sector's HNDL context

For a technology company, the HNDL question is rarely about its own data — it is about what it carries for its clients. A short-horizon supplier hosting clinical or financial data inherits, in practice, the horizon of what it hosts. That is why this sector shows up frequently in other sectors' third-party assessments, and rarely in its own.

05What applies

Here the most useful readout is usually the one your clients will run on you — plus engine licensing, for those who want to embed measurement in their own product.

Exposure Report

In production

The same readout a client would run on your surface.

Appliance

Internal use

Engine and collector licensed for integration into your product. Internal use, by contract.

Third-party assessment

In production

A readout of your own provider and dependency chain.

The limits of this readout

A low score results from a short horizon in public mode, not from a posture certificate.
The horizon of data hosted for clients does not enter the supplier's score.
A wide surface increases the chance of uneven coverage across assessed points.
The ruler does not measure product security, code quality, or development practices.

Other sectors

All sectors

Boundary

Where measurement ends

Adequacy programNot implemented

Measurement ends at: the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries — work carried out by the organization's own teams and suppliers.

This readout delivers

The readout your clients would run on your surface.
Exposure of your own provider chain.
Position against the sector cohort, with a cutoff date.

After the change, GWK

Re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
States scope, mode, coverage, and run for both measurements, so the difference is interpretable.
Attributes the observed effect only to the scope actually changed and verified.

Not included

Executing the change: GWK does not alter the client's configuration, certificates, or infrastructure.
Deployment, assisted operation, or change management.
An adequacy program: it exists as a GWK engineering project, not as a contractable capability.

See what your client would see

If you supply finance, healthcare, or government, your surface is already being assessed by them. The same readout, run first, is usually cheaper than the conversation afterwards.

Discuss an assessment Review the methodology