According to the 'Cybersecurity of Russian Business 2026' report by Cicada8, the average security rating of the external digital perimeter for Russian companies is 6.7 out of 10. The study analyzed over 20,000 organizations under continuous monitoring during the first half of 2026.
The research indicates that security maturity is more critical than industry affiliation. Companies with 500 or more internet-accessible assets have an average security rating of 4.96, while those with 10–20 assets score 7.89. Critical vulnerabilities were identified in 77% of the larger organizations compared to 24% of the smaller ones.
In the absolute ranking, the science and education sector leads with 7.49 points, followed by transport and logistics at 6.84. The lowest scores were observed in the public sector and non-profits at 6.46. However, when adjusted for perimeter size, the financial sector improves its standing significantly, moving to second place in maturity.
Data shows that 92.6% of companies maintained their security rating range during the first half of 2026. Among firms that started the year with critical vulnerabilities, 30.8% managed to reduce their number, while 53.5% saw no change. Only 14.6% of companies fully eliminated their critical vulnerabilities.
Cicada8 analysts highlight that most data leaks occur via third-party services used by employees rather than direct internal compromises. The study suggests that organizations should prioritize independent security assessments of their contractors to mitigate risks, as external infrastructure visibility remains a major challenge.
