exposure · severity low

Subdomain sprawl

Share of domains with ten or more externally discoverable subdomains.

Measured every Saturday · last updated

How it is measured

The same cached call. Bucketed: minimal 0–2, moderate 3–9, sprawling 10+. Denominator: any, capped subset.

Why it matters

Context for takeover risk. Sprawl is not itself a vulnerability, but every forgotten name is a candidate, and most organisations do not know how many they have.

The base rate

Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.

Global (all domains) 18.58% fail · n=14,893
0–2 subdomains: 35.9%3–9: 45.52%10+ (sprawl): 18.58%
France companies 12.3% fail · n=862
0–2 subdomains: 47.45%3–9: 40.26%10+ (sprawl): 12.3%
UK companies 19.42% fail · n=2,652
0–2 subdomains: 52.38%3–9: 28.21%10+ (sprawl): 19.42%
Norway companies 10% fail · n=990
0–2 subdomains: 63.13%3–9: 26.87%10+ (sprawl): 10%
0–2 subdomains · 63.13%3–9 · 26.87%10+ (sprawl) · 10%

By company size band

Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.

France
micron=229
0–2 subdomains: 45.85%3–9: 38.43%10+ (sprawl): 15.72%
15.72%
smalln=253
0–2 subdomains: 44.27%3–9: 41.9%10+ (sprawl): 13.83%
13.83%
mediumn=200
0–2 subdomains: 49%3–9: 40.5%10+ (sprawl): 10.5%
10.5%
largen=180
0–2 subdomains: 52.22%3–9: 40%10+ (sprawl): 7.78%
7.78%
UK
micron=230
0–2 subdomains: 56.96%3–9: 28.7%10+ (sprawl): 14.35%
14.35%
smalln=961
0–2 subdomains: 52.45%3–9: 26.22%10+ (sprawl): 21.33%
21.33%
medium/largen=1061
0–2 subdomains: 49.58%3–9: 31.48%10+ (sprawl): 18.94%
18.94%
dormantn=194
0–2 subdomains: 48.97%3–9: 26.8%10+ (sprawl): 24.23%
24.23%
no-accountsn=206
0–2 subdomains: 64.56%3–9: 21.36%10+ (sprawl): 14.08%
14.08%
Norway
micron=278
0–2 subdomains: 71.22%3–9: 17.99%10+ (sprawl): 10.79%
10.79%
smalln=253
0–2 subdomains: 63.64%3–9: 27.67%10+ (sprawl): 8.7%
8.7%
mediumn=266
0–2 subdomains: 57.89%3–9: 31.58%10+ (sprawl): 10.53%
10.53%
largen=193
0–2 subdomains: 58.03%3–9: 32.12%10+ (sprawl): 9.84%
9.84%

Every segment

Pick one to see the citable answer for a company like yours, with its trend and methodology.

Show the remaining 62 segments

From the newsletter

Where this base rate turned up as a real, fixable exposure.

Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.