Breach Intelligence Blog

analysis

24% of Websites With Cookie Banners Started Ad Tracking Before Visitors Could Consent

I hate cookie banners. On one site in four that shows one, it is not even doing its job: we loaded 13,712 websites in a fresh browser, touched nothing, and on 1,662 of the 6,955 showing a consent banner, advertising tracking was already active before the visitor could choose. On 1,512 of them, Meta, Google, TikTok, LinkedIn or another ad platform had already received a request.

26 Oct 2026 · 21 min read

analysis

OpenAI's Ad Pixel Tracks by Default, and European Shops Aren't Switching It Off

OpenAI's ChatGPT ad pixel ships with tracking switched on; a site has to add a line of code to hold it back until a visitor consents. We loaded 341 shops running it, most of them European: 224 send a measurement event to OpenAI before any consent, 95 while a cookie banner is on screen. We tested the SDK: the consent control works, the default is just left on.

23 Oct 2026 · 14 min read

analysis

One in Five Websites Blocks an AI Crawler

We read the robots.txt of 110,744 websites and checked each against 19 known AI crawlers. About one in five blocks at least one. Among those that do, seven in ten block nearly every crawler, and the most-blocked bot is OpenAI's GPTBot.

15 Oct 2026 · 10 min read

analysis

A Third of European Companies Turned DMARC On and Get No Reports Back

DMARC aggregate reports are what make a deployment observable rather than blind. Across 69,887 European company domains that publish a DMARC record, a third have no rua tag and get no aggregate feedback at all. For the rest, we ranked where the reports are configured to go. The single biggest destination is a French email provider, not a US one, and among dedicated DMARC-monitoring tools the US-founded and EU/UK-founded products are almost exactly tied: 2,979 domains against 2,982.

17 Sep 2026 · 12 min read

analysis

Among European Companies That Use a CDN, Nearly 9 in 10 Use Cloudflare

Across 44,143 European companies where we detected a content delivery network, 89.6% sit behind Cloudflare. The nearest pure-CDN competitor accounts for 1,299.

8 Sep 2026 · 8 min read

analysis

CAA Has Been Mandatory Since 2017 but 93.1% of Company Domains Skip It

CAA checking has been mandatory for certificate authorities since 2017, but across 130,700 company domains we checked, 93.1% still don't publish a CAA record.

1 Sep 2026 · 9 min read

analysis

Ireland Is Being Taken to Court Over NIS2. 88% of the Security Vendor Detections We Found Were American.

Ireland is one of four member states referred to the Court of Justice over its late NIS2 transposition. We fingerprinted security and access-control vendors across an Irish dataset of 310 organisations. 88.2% of detections trace to US-parented companies; no independently EU-founded vendor appeared in the core firewall, WAF, IAM, or VPN subset except one, via a French acquisition.

12 Aug 2026 · 10 min read

analysis

Nearly Half of the Company Websites We Checked Had No Security Headers

We ran 56,251 HTTP header checks across 50,769 companies. In 47.4% of observations, the response carried none of seven standard security headers. This is a presence-only measurement, not a security audit.

4 Aug 2026 · 9 min read

analysis

DMARC Has Been Public Since 2012. 68.4% of Company Domains Still Don't Enforce It.

DMARC has been public since 2012. Across 67,336 company domains we checked, 45.1% have no record at all, and of the rest, most are set to p=none: collecting reports, not enforcing a policy.

28 Jul 2026 · 13 min read

report

Palantir in Europe: A Public-Source Map of Government and Corporate Deployments

A public-source review of 40 European organisations and public bodies publicly linked to Palantir. Evidence quality varies: some are confirmed deployments, others are pilots, partnerships, letters of intent, reported relationships or infrastructure observations.

20 Jul 2026 · 15 min read

research

Europe's company websites are mostly served by US vendors

We looked at the apex and www records for 19,450 European company entities and mapped each to its internet-facing infrastructure vendor. US-headquartered vendors serve the majority of primary company websites in the UK and the Netherlands, the plurality in Italy, Spain, and France. Cloudflare is the largest single vendor in every one of the seven markets.

7 Jul 2026 · 6 min read

analysis

"There Are No European Cybersecurity Vendors." Wrong.

Someone told us European procurement teams looking for a sovereign cybersecurity alternative are stuck choosing a foreign incumbent. We started counting EU-headquartered vendors instead. The shortage is not in the supply. It is in what gets seen.

30 Jun 2026 · 10 min read