RPKI Barometer, August 2026: 1 in 5 networks at risk
Of the 166 networks (ASNs) graded by our free public checker between 21 July and 4 August 2026, one in five gets a C, D or E, and 24 have almost no RPKI protection at all: their prefixes can be hijacked (forged-origin) with nothing for validating operators to reject. And the worst performers are not who you would expect.
Grade distribution
| Grade | ASNs | Share | |
|---|---|---|---|
| A — exemplary, full ROA coverage | 86 | 52% | |
| B — broad protection, minor gaps | 46 | 28% | |
| C — significant gaps | 10 | 6% | |
| D — majority of prefixes without ROA | 23 | 14% | |
| E — no protection | 1 | 0.6% |
Who is at risk?
Not the big consumer ISPs: among the best-graded ASNs in the sample are Free (A), Orange (B), SFR (B) and Swisscom (B). The 24 D/E ASNs, which we qualified one by one, fall into categories you would not expect:
- a major French local government
- a French "sovereign cloud" provider
- a certified healthcare data hoster
- a healthcare software vendor
- several French B2B operators and hosting providers
- legacy ASNs of global transit providers and international industrial groups
In other words: the very entities NIS 2 designates as essential or important, whose customers assume the infrastructure is protected. We do not name the organizations here; anyone can check their own ASN in 30 seconds below.
Why this is a real risk
Without an RPKI ROA, nothing attests which AS is allowed to originate a prefix. A forged-origin hijack, accidental or malicious, is then accepted by most networks, including RPKI-validating operators: they can only reject what is declared. Real-world consequences seen in recent years: traffic diversion, interception, outages, address space abused for spam and phishing.
The fix is fast: ROAs are created in your RIR's portal (RIPE NCC in Europe), with no infrastructure change.
How does your ASN score?
Free, no signup, A-E grade with full prefix-by-prefix detail in 30 seconds.
Methodology and limitations
Grades are computed by the public checker at sentinelle-routage.fr from public data only: the routing table as seen by RIPE RIS collectors (used with attribution), the RPKI status of every announced prefix, and IRR route objects. Scoring: share of prefixes covered by a valid ROA, RPKI-invalid prefixes, overly permissive ROAs (maxLength), IRR coverage.
Known limitations: self-selected sample (ASNs analyzed by checker visitors, biased towards the French, German and Swiss operator communities our traffic comes from), snapshot at analysis time. This barometer describes the sample, not the full population. Activity: 570 distinct ASNs and 989 analyses since 13 June; A-E grading exists since 21 July.
Badly graded? One-shot audit with a full remediation plan, report within 48h, fully async, from €490.
See the audits