Unicorns outpace Global 2000 on core domain security

CSC has published research that finds privately held start-ups valued at more than USD $1 billion score higher than Forbes Global 2000 companies in five out of eight domain security measures, while still showing gaps in more advanced protections.

The company said its sixth annual Domain Security Report compares domain security practices of the Global 2000 with those of the world's top 100 unicorns. The study focused on the adoption of controls used to protect domains and the Domain Name System.

CSC said unicorns record strong take-up of several measures managed through DNS records. It also said many unicorns fall short on registry lock and DNS redundancy. The report said only 1% of the top 100 unicorns employ DNS redundancy, and close to 90% use a single cloud infrastructure.

CSC assessed adoption across a set of measures. These included registrar type, registry lock, certificate authority authorisation records, DNS redundancy, DNS security extensions, sender policy framework, DomainKeys Identified Mail, and domain-based message authentication, reporting, and conformance.

Unicorn profile

CSC said the majority of the top 100 unicorns are IT companies, with many in artificial intelligence. It said teams managing unicorn domain names are likely to include IT professionals familiar with DNS security options. CSC said this may account for strong results on DNS record-based protections.

The company also pointed to the registrar choices of newer businesses. CSC said adoption of advanced measures could remain low because unicorns use consumer-grade registrars more often. It said such registrars often do not offer some domain security measures.

CSC said unicorns still tend to sit in the middle range for domain risk scores in higher numbers than Global 2000 companies. It linked that pattern to uneven adoption of advanced security protocols across the unicorn group.

"Domain names, DNS, and brand trust are fundamental to our online presence. Long-overlooked dependencies will compound cyber risks as new AI and IT stacks emerge," said Vincent D'Angelo, Senior Director, CSC. "It's encouraging to see unicorns adopting strong domain security practices early, yet much work remains. As these new tech platforms scale, continued prioritization of domain security will be essential to reducing cybercrime, strengthening trust and safety, and lowering systemic risk across customer and partner supply chains," said D'Angelo.

Sector shifts

CSC reported that the semiconductor and banking industries show the largest rise in overall domain security scores over the past year. It said each sector improved its ranking by five places.

The report tied the shift to technology and regulatory pressure. CSC pointed to the growth of artificial intelligence and financial technology over the past year. It also cited stricter cyber security demands from regional governments and agencies.

Registrar gap

CSC highlighted differences in registry lock adoption based on registrar type. It said the disparity in registry lock adoption between Global 2000 companies using enterprise-class versus consumer-grade registrars is more than six times.

Registry locks protect domains against unauthorised changes and domain hijacking. CSC said consumer-grade registrars often lack the resources required to support the service.

Brand lookalikes

The research also examined domains that resemble Global 2000 brands. CSC said 88% of registered web domains that resemble Global 2000 brands, known as homoglyphs, are owned by third parties and do not belong to the brand. It said that figure rose by 8% compared with the prior year's report.

CSC described homoglyph domains as a route for fraud and impersonation. It said threat actors use them for fraudulent websites, false advertisements and phishing emails.

Email controls

CSC said adoption of DMARC rose from 39% in 2020 to 80% in 2025. It called this the fastest growth among the measures tracked in the report.

The company linked the change to phishing trends and regulatory requirements. CSC pointed to growth in the volume and complexity of phishing attacks. It also cited the European Union's Network and Information Security 2 directive, which came into effect in October 2024.

Certificate pressure

CSC said the domain landscape continues to change as threat actors become more efficient and regulation pays closer attention to domain security. It also said life cycles for SSL and TLS digital certificates will begin to shrink in 2026. CSC said that shift will affect existing domain management policies across many organisations.