Case study • Barometrul Digital
Barometrul Digital is Romania’s first nationwide audit of public-sector website security: 2,487 institutions, a fully passive and auditable methodology, and a conversation with institutions that started on launch night.
Discovery
Romania was going through a run of major public-sector breaches, one after another, with nobody systematically measuring what made them possible.
Breached through a vulnerability publicly catalogued since 2021 and left unpatched.
A major incident at an institution holding highly sensitive personal data.
Medical systems locked by ransomware, with clinical activity directly affected.
A breach at one of the central institutions of the state.
Insight
Lightning strikes where the rod is broken. What did not exist was a map of the broken rods: no recurring, comparable measurement of public-sector digital hygiene.
Build
Tyche, an AI agent that audited 2,487 public institution websites: city halls, county councils, hospitals, central institutions, water and energy operators. The architecture is not one model making calls, it is an orchestration where every step has a defined role.
Works through the institution list, collects public signals for each domain and decides what is worth verifying further.
Every finding passes reproducible controls: certificate, headers, DMARC, WAF, HTTPS. The same inputs produce the same result, every run.
Data comes from the open registries of the internet and from public institutional records, never from private collection.
Before publication and before any institution is notified, critical findings go through human verification.
Notifications to exposed institutions, technical briefs on request, subscriptions to future editions. The workflow does not stop at the report.
First edition
The Romanian state’s overall grade on digital hygiene: mediocre.
Best score
A rural commune in Cluj county
A clean 10. Communes (7.2 average) score above municipalities (6.8).
The surprise in the data
County hospitals
An average of 7.1, level with city halls, although the stakes are incomparably higher.
Go-to-market
A coordinated launch across three channels on the same day, 27 July 2026: the personal post, the PressOne article and barometrul-digital.ro.
An all-time distribution record for the page. The content left its own audience within the first hours.
Euronews România, „Vocile care contează”, 29 July 2026. The same broadcast featured commentary from the director of DNSC, Romania’s national cyber security directorate. In the same week the barometer was picked up by ProTV, Economedia and Euronews România.
Impact
An audit that gets read is a report. An audit that gets acted on is a product.
Edition 2
August 2026: the same institutions, measured again, on the distribution channels built during the first edition.
Same institutions, same methodology, so the repairs become visible.
The aggregate picture of the state’s digital hygiene, not only per-institution briefs.
The channels and subscriber list from edition one become the infrastructure of edition two.
Tell me what you want measured and on what cadence. I will reply with how it could work as a recurring product rather than a one-off report.
You will get a concrete proposal for scope, methodology and publication cadence.