Insights

What the FTSE 100 infrastructure data actually shows — each piece grounded in the same passively-collected facts behind every company page and the cross-portfolio analysis, not general commentary.

The photographs that still say where they were taken are the ones nobody edited 326 images on the websites of 61 large listed companies still carry GPS coordinates. Sorted by the device that made them the rate runs from 69% to 0.002% - and the split is not between careful companies and careless ones, it is between professional cameras and the phones and drones of the people who work there.
2,989 photographs name the individual camera that took them A camera model is a type of thing. A body serial number is one physical object, for the life of that object - which across 139 companies is a way of joining unrelated corporate websites into one photographer's client list. We count them and never store them, and not even as a hash.
When the photographer field is filled in, it is almost never a placeholder We expected a field full of N/A and unknown. Across 189,746 corporate images, 1,902 creator fields hold something shaped like a person's name and exactly 9 hold a placeholder. The expectation was wrong by two orders of magnitude, in the direction that mattered.
The most common tool name on these websites was discontinued in 2007 Adobe ImageReady last shipped nineteen years ago and is still the largest single entry - because it stopped shipping, so there is only one version of it left, while Photoshop's larger total is split across dozens. A carbon date for the site furniture nobody re-exports, and one tool that writes an account id into the file.
We had our robots.txt rule wrong, and it excluded sites that had done nothing Our crawler treated any non-200 response as a complete refusal, including a plain 404. RFC 9309 says a 404 means no rules exist. What that cost, what it did not change, and the larger gap the check uncovered instead.
Two years on, only 10 of 82 companies have finished renaming Twitter Changing a link is the cheapest maintenance a website has. More than half the companies here link to twitter.com and x.com from different pages of the same site - which makes it a rare outside measure of how corporate websites are actually kept.
A quarter of the biggest listed companies can't tell us what they allow Their CDNs block the robots.txt request itself — so a crawler that treats an unreadable robots.txt as a refusal never gets to read the rules it was trying to obey. Measured across 177 companies, with the user-agent controls.
42 FTSE 250 constituents have no digital infrastructure at all Not a collection gap — a fact about what they are. Every one is an investment trust: a listed legal wrapper whose entire web presence belongs to the fund manager that runs it.
14 companies running their own network Which FTSE 100 and S&P 500 companies run infrastructure on a network registered in their own name, rather than renting it from AWS, Azure or Cloudflare — verified live against the internet registries, not just our own stored data.
Dev, test and staging subdomains outnumber production 15 to 1 across the FTSE 100 What Certificate Transparency logs reveal about the shadow estate of non-production infrastructure sitting alongside every FTSE 100 company's public-facing website.
Who hosts the FTSE 100? Cloudflare fronts more than a third of FTSE 100 corporate websites. What that concentration means, and how we measured it without touching a single company's infrastructure.
FTSE 100 email security: who's actually blocking spoofed mail DMARC policy across the index, the vendors routing corporate mail, and the gap between having a DMARC record and having one that does anything.
One registrar controls 42% of FTSE 100 domain names Corporate domain registration is a brand-protection business, and it is remarkably concentrated. What that tells you about how large companies actually manage their web presence.
95 vendors, identified from public DNS alone Domain-verification TXT records and SPF includes name every third-party vendor a company has ever proven a relationship to — including, in a few cases, things nobody meant to publish.
Passive OSINT, explained: mapping FTSE 100 infrastructure without touching it What "passive collection" actually means in practice, and why it's the difference between OSINT and unauthorised scanning.