The Norwegian register for businesses in Norway has lots of public information available, including the homepage for companies, if registered. Which, of course, provide an amazing opportunity to measure Internet security across a wide variety of industries and more.

So I thought about law firms of course, since they have special privileges and most certainly need to maintain high security.

Using the excellent free service Dutch Internet Standards Platform (Internet.nl) , I scanned 557 law firms / domains in Norway, and these are my results.

Trigger warning: All data examined and ranked are publicly available. I’m not designating the scoring values, neither do I have any say on how the scoring is done. No “hacking” is needed to examine & produce the results. Data only represent a snapshot in time, and may change at any time for better or worse. If your employer doesn’t score well: fix the issues found. That is beneficial not just for you, but for everyone on the Internet. Don’t shoot me, I’m just the messenger.

Scanning was done on November 5-6, 2025. New scans of these domains will be carried out every first day of the month, with data automatically available, including changes observed for each domain since the previous scan.

First an overview of email security for the 19 largest law firms in Norway. Email security could be considered critical for these, depending on what type of information is sent by email to and from these companies, and to what extent email with attachments are encrypted or not. More details on the findings can be found in the public report here.

Report number 1 is for web security. It checks to see if name servers (DNS) and webserver is available using IPv6, in addition to IPv4. It checks if the domain is secured using DNSSEC. The test also checks to see if the cryptography used to secure the communication between your web browser and their site holds up to the recommendations of the Dutch NCSC requirements. The check also looks for various security options and their configuration and some extra data. Last but not least it checks if RPKI (for BGP) is configured correctly.

The aggregated results look like this:

Congratulations to Jan Sandtrø for being alone on top with a 100% score!

Honorable mentions for 12 law firms with a 98% score, including Rikke Arnesen Nina Monssen (FAM advokat), Advokatfirmaet Haavind AS , Advokatfirmaet Hasle , Bjørn Ivar Christie Østberg , Advokatfirma Sekse & Co AS & Advokatfirmaet Verito AS . (not everyone are on Linkedin).

Report number 2 is for mail security. This checks if DNS & mail servers for a given domain are available using IPv6, as well as DNSSEC. It then checks to see if Internet standards (SPF, DKIM & DMARC) to verify the authenticity of email to protect users from phishing are available and configured properly. It also looks for properly configured STARTTLS (opportunistic email encryption) and DANE (mandatory authenticated email encryption). Last but not least, it checks if RPKI (for BGP) is configured properly as well.

Congratulations to 7 law firms with a perfect 100% score for their email security, including Silje Trosten Johnsen , Lars Reed , RETTEN PÅ DIN SIDE SOLFRID HAMMERSLAND , Jan Sandtrø & Thomassen Advokatfellesskap .

1 out of all 557 domains has a 100/100 score, additional congratulations to technology lawyer Jan Sandtrø for this achievement!