Sector · Technology

Low exposure from the data horizon, not from the surface.

The technology sector has the lowest exposure median among the five sectors with their own page. Reading that as superior posture would be a mistake: the same ruler shows the sector's observable exposure on par with the rest. What lowers the result is the short horizon of its own data, and the client data it hosts carries the client's horizon, not its own.

Sector median · SaaS34.7Low

8,236companies

32.9–35.6Half of the cohort between p25 and p75

The comparison available

Practically the entire sector cohort falls in the two lowest bands on the ruler, with the smallest dispersion among the five sectors with their own page.

That makes internal comparison uninformative: nearly everyone sits in the same place. Observable exposure sits on par with the other sectors: what sets technology apart is not the surface, it is the horizon.The aggregates describe the cohort on the date the ruler was generated, with an anonymity floor. No company is identifiable in them.

Cohort distribution by band

Low84.4%
Minimal15.6%

Data shelf life

The sector's confidentiality horizon median is the lowest among the five sectors with their own page: a meaningful share of the data in transit has short-term value (session, telemetry, operational state).

But that applies to the company's own data. The client data it hosts may carry the client's sector horizon, and that distinction does not appear in the supplier's score.

Data the sector keeps for a long time

Operational and session data, with short-lived value.
Product code and intellectual property, with long-lived value.
Credentials and integration secrets, sensitive while valid.
Hosted client data, carrying that client's sector horizon.

What distinguishes the sector

Technology runs on the shortest data cycle and the widest surface: many domains, many subdomains, many APIs, and a rate of infrastructure change that does not exist in other sectors.

On the ruler, the short horizon improves position; the wide surface does not show up as an advantage.The sector's HNDL context. For a technology company, the HNDL question is rarely about its own data. It is about what it carries for its clients. A short-horizon supplier hosting clinical or financial data inherits, in practice, the horizon of what it hosts. That is why this sector shows up frequently in other sectors' third-party assessments, and rarely in its own.

A wide surface: domains, subdomains, APIs, and environments.
A short infrastructure replacement cycle.
Greater cryptographic agility, when exercised.
A supplier role: your own exposure becomes your client's exposure.

Typical dependencies

Cloud providers and managed services.
Content delivery networks and TLS termination.
Certificate authorities and issuance automation.
Third-party libraries and dependencies in the product.

What applies

Here the most useful readout is usually the one your clients will run on you, plus engine licensing, for those who want to embed measurement in their own product.

01Exposure ReportThe same readout a client would run on your surface.In production

02ApplianceEngine and collector licensed for integration into your product. Internal use, by contract.Internal use

03Third-party assessmentA readout of your own provider and dependency chain.In production

See a sample report →

See the limits of this reading and what it is measured against

The limits of this readout

A low score results from a short horizon in public mode, not from a posture certificate.
The horizon of data hosted for clients does not enter the supplier's score.
A wide surface increases the chance of uneven coverage across assessed points.
The ruler does not measure product security, code quality, or development practices.

Boundary

Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.

Why measuring does not reduce exposure

What this comparison is measured against

Ruler generated: October 7, 2026
Population: 80,182 companies
Sectors: 15 sectors in the engine taxonomy
Anonymity floor: K = 30

Limits of the comparison

The ruler is a static reference base, not a continuous measurement: there is no automatic update between one run and the next.
Comparison is always against anonymous aggregates, never against another organization's individual result.
A public-mode result does not compare to a complete-mode result, because the two readings start from different kinds of evidence.

See what your client would see

If you supply finance, healthcare, or government, your surface is already being assessed by them. The same readout, run first, is usually cheaper than the conversation afterwards.

Discuss an assessment See a sample report →