TPN 2026 STAR Report
An industry-wide view of content security maturity, based on three years of independently validated TPN assessments.
What the report is
STAR stands for Security, Trends, Analytics, Readiness. The report aggregates anonymized findings from independent TPN assessments carried out across the content supply chain over three years, and sets out how security controls perform in practice rather than how organizations describe them.
That distinction is the point. Most industry studies rely on surveys and self-reported answers. STAR is built on assessor-validated results, so the figures describe what was actually found on site: which controls were in place, which were not, and how long identified problems took to fix.
Its central finding is an execution gap. Controls are frequently documented but not consistently implemented, monitored or maintained, and non-compliance concentrates in the technical layers — vulnerability management, cryptography, endpoint hardening and access management. The same weaknesses turn up repeatedly in real incidents, which means much of what causes an incident is visible in an assessment beforehand.
**Those weaknesses map closely onto the high-impact fixes in this Toolkit: patching, access management and multi-factor authentication are among the most common gaps in the report, and among the cheapest and quickest things to put right. The problems the industry struggles with most are often not the expensive ones.
Why it is worth reading
- It shows where the industry as a whole falls short, so you can see whether your own gaps are unusual or the norm.
- It quantifies the perception gap — how often organizations believe a control is working better than it is — which is a useful prompt to check rather than assume.
- It reports how long remediation actually takes across the industry, and how often it is refused outright. Those timelines are far longer than they should be, which is the argument for closing your own findings faster rather than matching them.
- It names the five actions the industry is being asked to prioritize, which is a ready-made agenda if you are deciding where to start.
- It is free to read and requires no assessment history, so it is useful whether or not you have ever been assessed.
If this one helped, try another.
Consider these suggestions for what to do next. They either address the same gaps, or are logical next steps.