Sector Resilience Scorecard - Israel 2026

52% of measured Israeli organizations have no CDN or WAF on their primary domain

We ran passive edge resilience checks on 21 organizations across banking, insurance, healthcare, and telco. No load was applied. No vulnerabilities were exploited. Every score is derivable from public signals.

Measured May 2026 · Passive signals only · Companies anonymized · Methodology below

21
Organizations
11
No CDN / WAF
D
Avg Grade
4
Sectors

By sector

Average grade and headline finding per sector. Companies are anonymized (Bank A, Insurer B, etc.) with stable pseudonyms across reports.

Banking · 8 companies
D
Avg score: 48 / 100
4 of 8 banks have no CDN or WAF on their primary domain. Two grade F. One scores 0 across all signals.
Insurance · 5 companies
D
Avg score: 44 / 100
3 of 5 insurers have no CDN or WAF. All 5 have SPF and DMARC - mail security is the one bright spot.
Healthcare · 5 providers
D
Avg score: 43 / 100
3 of 5 providers grade F or D. Two of Israel's most prominent hospital networks score below 20.
Telco · 3 measured
C
Avg score: 60 / 100
Best-performing sector. 2 of 3 carriers have Imperva WAF. Mail and TLS posture is solid across the board.

Banking 8 organizations

Israel's eight largest retail banks by asset size. Sorted by score descending.

Organization Grade Score CDN / WAF HSTS SPF DMARC
Bank AB
85
Impervayesyesyes
Bank BB
75
CloudFrontyesyesyes
Bank CC
70
Impervayesnono
Bank DC
60
Cloudflarenonono
Bank ED
40
noneyesyesyes
Bank FD
40
noneyesyesyes
Bank GF
15
nonenoyesyes
Bank HF
0
nonenonono

Insurance 5 organizations

Israel's five largest insurers by premium volume. Consistent with findings from the OpIsrael 2026 audit of six insurers.

Organization Grade Score CDN / WAF HSTS SPF DMARC
Insurer AB
85
CloudFrontyesyesyes
Insurer BB
80
Fastlyyesyesyes
Insurer CF
25
nonenoyesyes
Insurer DF
15
nonenoyesyes
Insurer EF
15
nonenoyesyes

Healthcare 5 organizations

Israel's major HMO networks and hospital systems. Patient portals and appointment systems included in domain scope.

Organization Grade Score CDN / WAF HSTS SPF DMARC
Health AB
75
Impervayesyesyes
Health BC
70
Cloudflarenoyesyes
Health CD
45
noneyesyesyes
Health DF
15
nonenoyesyes
Health EF
10
nonenoyesyes

Telco 3 measured

Israel's major mobile network operators. Best-performing sector overall.

Organization Grade Score CDN / WAF HSTS SPF DMARC
Telco AB
75
Impervayesyesyes
Telco BC
60
Impervanoyesyes
Telco CD
45
noneyesyesyes

Methodology

CDN / WAF (25 pts)HEAD request to apex domain. CDN/WAF fingerprinted from response headers (x-amz-cf-id, x-iinfo, x-served-by, etc.) and IP-to-ASN for Cloudflare (AS13335). No load sent to target.
TLS posture (up to 35 pts)HTTPS availability, HSTS header, HTTP-to-HTTPS redirect, HTTP/2 via alt-svc. One connection per domain.
DNS posture (up to 20 pts)DoH queries (cloudflare-dns.com) for IPv6 (AAAA), CAA records, SPF (TXT), DMARC (_dmarc.domain TXT). No zone transfers attempted.
Origin concealment (up to 10 pts)Single query to crt.sh Certificate Transparency log. Subdomain count used as proxy for origin IP discoverability.
Public hygiene (5 pts)HEAD request to /.well-known/security.txt. Presence indicates a formal vulnerability disclosure policy.
GradingA=90+, B=75-89, C=60-74, D=40-59, F<40. Same rubric as the free scan grade. All scores reproducible with public tools.
Anonymization policy: No organization is named without written consent. Pseudonyms (Bank A, Insurer B, etc.) are stable - the same letter maps to the same organization across all DDactic sector reports. Findings at this level of aggregation cannot plausibly fingerprint a specific organization. Individual-company breakdowns, including domain-level data, are available to the organization itself on request. Every score traces to a timestamped JSON receipt stored at s3://ddactic-scan-results/sector-scans/il-2026/.

Are you in this report?

Run a free passive scan on your domain. You'll see your grade, CDN/WAF coverage, and DNS posture within seconds - same methodology, applied to your estate.

Run free scan

Want your sector measured?

We're expanding to EU banks, US fintech, and government portals. If you want your sector covered - or want to opt in as a named case study - get in touch.

[email protected]