How ready are Turkish companies for the age of AI attacks?
AI has made phishing and vulnerability hunting cheap. We passively checked 716 websites and e-mail domains of companies listed on Borsa Istanbul.
Free · PDF Key findings
- 52.9%
of companies have no DMARC rule that blocks spoofed e-mail, or only monitor it.
- 72.1%
of websites set no Content-Security-Policy to limit the impact of XSS attacks.
- 43.3%
of websites name their server software and version in the response headers.
- 51.8%
of websites score D or F in the grading of our free security check.
Inside the report
- 01
How AI changed the attacks
AI-written phishing, deepfake CEO fraud, autonomous agents hunting for flaws and prompt injection. Sourced from Microsoft, Mandiant, Verizon, Google and Anthropic.
- 02
E-mail: the first line against spoofing
The state of SPF and DMARC records. How many companies actually block spoofed e-mail?
- 03
Website security headers
HSTS, CSP, clickjacking protection and the rest. The ones most often missing.
- 04
Clues handed to attackers
Server and PHP versions, CMS versions, software past its end of life.
- 05
Industries and BIST 30
Average scores by industry and how the largest companies compare.
- 06
A 30-day action plan
What to do first against AI-assisted attacks, in order of priority.
Methodology
- Sample: the 746 Borsa Istanbul companies listed on KAP (Public Disclosure Platform) that publish a website. 716 reachable sites were checked.
- Date: a one-off scan run on 2026-10-31.
- Method: the passive checks of our free website security check. Each site received only a few ordinary requests; no attacks or vulnerability probes were sent.
- Privacy: the report names no companies and shows aggregate results only.
Frequently Asked
No. It shows aggregate shares and averages by industry and index only. No individual company results are published.
No. We used the passive checks of our free security check: requests for the home page, robots.txt and security.txt, public DNS records and the TLS certificate. No attacks or vulnerability probes were sent.
Use our free website security check. It runs the same checks used in the report against your site in seconds.
