Two lenses on the same question, side by side. Attacked: each sector's share of the 90 headline incidents in our three-year global log. Defended: how well the UK-listed companies in that sector protect their email (DMARC against impersonation, TLS enforcement in transit). The point is the gap between the two.
Read this carefully — the two columns are different measures. The attack count is a curated global sample, and it reflects what becomes visible (through disclosure rules and press coverage), not where risk is truly highest. The email-defence columns cover only UK-listed FTSE 250 operating companies, and only email — not a sector's overall security. Sectors from the two datasets are mapped to one shared set; some appear in only one lens (government and education have no FTSE 250 members; real estate and transport barely feature in the global log). Nothing here is a score of any one company.
Share of logged attacksEmail defence (DMARC enforced)
Sector
Attacks
·
Share
FTSE firms
·
DMARC enf.
TLS enf.
Read
Government & public
15
17%
–
–
no listed firms
–
Attacked, but no FTSE 250 members — mostly public sector.
Technology & software
14
16%
12
83%
–
Financial services
10
11%
24
92%
1
Attacked and well defended.
Healthcare & pharma
8
9%
6
67%
1
Gap: heavily attacked, email defence lagging.
Retail & consumer
7
8%
28
71%
1
Telecoms & media
7
8%
7
100%
–
Well defended.
Travel, leisure & hospitality
7
8%
11
73%
1
Energy, utilities & infrastructure
4
4%
11
45%
–
Weak email defence.
Education
5
6%
–
–
no listed firms
–
Attacked, but no FTSE 250 members — mostly public sector.
Manufacturing & industrials
3
3%
23
87%
3
Professional & support services
2
2%
8
100%
2
Well defended.
Transport & logistics
0
0%
5
60%
–
In the index, but not visible in the global incident log.
Real estate & construction
0
0%
26
58%
1
In the index, but not visible in the global incident log.
Other
8
9%
–
–
no listed firms
–
Attacked, but no FTSE 250 members — mostly public sector.
What stands out
Finance is attacked and ready. Financial services take 11% of logged attacks and are the best-defended group in the index (92% enforce DMARC) — regulation (the FCA) shows.
Healthcare and energy are the worrying gaps. Both are attacked and, when hit, the most disruptive — yet listed healthcare/pharma enforces DMARC on only 67%, and energy, utilities and mining on just 45%, the weakest of all.
Technology is the most-attacked private sector (16% of incidents) and defends reasonably (83%), but not as tightly as finance.
The most-attacked sector of all isn't a listed one. Government and public bodies take 17% of logged attacks and education another 6% — neither has FTSE 250 members, so the index can't see them. Worth saying plainly.
Well-defended, rarely in the headlines: manufacturing and industrials (87% DMARC, the most TLS enforcers) and telecoms and media (100%) defend well and appear less often in the log.
In the index but off the incident radar: real estate and construction (26 listed firms, only 58% enforce DMARC) and transport barely feature in the global log — a blind spot, not a clean bill of health.