It security and incidents in enterprises (10+ employees) by enterprise size, activity (NACE REV2) and topics (DISCONTINUED) - StatBank Denmark

The table is discontinued. For more recent periods seeITAV26

The reference period for it security incidents is the previous calendar year. When comparing the individual years' results regarding breaches of IT security, changes in question wording must be taken into account. The question about strong passwords has changed the number of characters along the way. Before 2023, passwords of at least 8 mixed characters were asked, in 2023 this increased to 12 and in 2025 this increased to 15. The results between the periods are therefore not directly comparable.

The category 1. Implemented one or more types of IT security measures depends on the subcategories. Comparisons between different years must therefore take the subcategories into account.

In 2025, some values have been updated after publication, this is due to missing values or the Business Services activity and the addition of the category 1.11 Use an antivirus program.

Select

Advanced selection

Information

enterprise size (5)

activity (NACE REV2) (7)

topics (27)

year

Number of selected data cells for the table: (select max. 10000)

9-10-2026 Statistics Denmark , statbank.dk/ITAV15

1. Implemented one or more types of IT security measures
1.1 Have strong passwords for authentication
1.2 Have systematic updating of software (incl. operating systems)
1.3 Have biometric methods for user identification and authentication
1.4 Encrypt data, files or e-mails
1.5 Have backup of data at alternative geographical location (incl. cloud)
1.6 Have access control to the enterprises network
1.7 Have VPN (virtual private network)
1.8 Store log files
1.9 Make risk analyses
1.10 Test IT security
1.11 Use an antivirus program
2. Have experienced breach of IT security
2.1 Have experienced blocked access to IT services
2.2 Have experienced deletion or destruction of data
2.3 Have experienced disclosure of confidential data (whether intentional or not)
3.1 Increasing level of investments in IT security in the previous calendar year
3.2 Unchanged level of investments in IT security in the previous calendar year
3.3 Declining level of investments in IT security in the previous calendar year
4.1 Own employees handle activities related to IT security for the enterprise
4.2 External suppliers handle activities related to IT security for the enterpeise
5. Have documentation on precautionary measures, activities and procedures regarding IT security
5.1 Have documentation on management of IT access rights
5.2 Have documentation on storage, protection, access to data
5.3 Have documentation on procedures on IT security incident
5.4 Have documentation on the responsibilities of employees in relation to IT security
5.5 Have documentation on IT security training of employees