exposure · severity low

Subdomain sprawl

Share of domains with ten or more externally discoverable subdomains.

Measured every Saturday · last updated

How it is measured

The same cached call. Bucketed: minimal 0–2, moderate 3–9, sprawling 10+. Denominator: any, capped subset.

Why it matters

Context for takeover risk. Sprawl is not itself a vulnerability, but every forgotten name is a candidate, and most organisations do not know how many they have.

The base rate

Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.

Global (all domains) 18.77% fail · n=15,007
0–2 subdomains: 35.76%3–9: 45.47%10+ (sprawl): 18.77%
France companies 12.84% fail · n=841
0–2 subdomains: 49.35%3–9: 37.81%10+ (sprawl): 12.84%
UK companies 19.48% fail · n=2,597
0–2 subdomains: 52.18%3–9: 28.34%10+ (sprawl): 19.48%
Norway companies 10.7% fail · n=944
0–2 subdomains: 59.64%3–9: 29.66%10+ (sprawl): 10.7%
0–2 subdomains · 59.64%3–9 · 29.66%10+ (sprawl) · 10.7%

By company size band

Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.

France
micron=212
0–2 subdomains: 47.17%3–9: 40.09%10+ (sprawl): 12.74%
12.74%
smalln=245
0–2 subdomains: 46.94%3–9: 38.78%10+ (sprawl): 14.29%
14.29%
mediumn=200
0–2 subdomains: 53%3–9: 33%10+ (sprawl): 14%
14%
largen=184
0–2 subdomains: 51.09%3–9: 39.13%10+ (sprawl): 9.78%
9.78%
UK
micron=231
0–2 subdomains: 61.9%3–9: 21.65%10+ (sprawl): 16.45%
16.45%
smalln=954
0–2 subdomains: 49.06%3–9: 29.98%10+ (sprawl): 20.96%
20.96%
medium/largen=1025
0–2 subdomains: 50.05%3–9: 29.76%10+ (sprawl): 20.2%
20.2%
dormantn=195
0–2 subdomains: 57.44%3–9: 26.67%10+ (sprawl): 15.9%
15.9%
no-accountsn=192
0–2 subdomains: 61.98%3–9: 22.4%10+ (sprawl): 15.62%
15.62%
Norway
micron=266
0–2 subdomains: 63.53%3–9: 22.93%10+ (sprawl): 13.53%
13.53%
smalln=242
0–2 subdomains: 61.16%3–9: 27.69%10+ (sprawl): 11.16%
11.16%
mediumn=253
0–2 subdomains: 59.68%3–9: 32.02%10+ (sprawl): 8.3%
8.3%
largen=183
0–2 subdomains: 51.91%3–9: 38.8%10+ (sprawl): 9.29%
9.29%

Every segment

Pick one to see the citable answer for a company like yours, with its trend and methodology.

Show the remaining 62 segments

From the newsletter

Where this base rate turned up as a real, fixable exposure.

Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.