Case study • Barometrul Digital

Nobody was measuring the state’s digital hygiene. Now an agent does.

Barometrul Digital is Romania’s first nationwide audit of public-sector website security: 2,487 institutions, a fully passive and auditable methodology, and a conversation with institutions that started on launch night.

Discovery

The problem

Romania was going through a run of major public-sector breaches, one after another, with nobody systematically measuring what made them possible.

ANCPI, the e-Terra land registry system

Breached through a vulnerability publicly catalogued since 2021 and left unpatched.

National Administration of Penitentiaries

A major incident at an institution holding highly sensitive personal data.

Hospitals encrypted, 2024

Medical systems locked by ransomware, with clinical activity directly affected.

Chamber of Deputies, 2024

A breach at one of the central institutions of the state.

Insight

Lightning strikes where the rod is broken. What did not exist was a map of the broken rods: no recurring, comparable measurement of public-sector digital hygiene.

Build

The solution

Tyche, an AI agent that audited 2,487 public institution websites: city halls, county councils, hospitals, central institutions, water and energy operators. The architecture is not one model making calls, it is an orchestration where every step has a defined role.

Autonomous AI agent

Works through the institution list, collects public signals for each domain and decides what is worth verifying further.

Deterministic checks

Every finding passes reproducible controls: certificate, headers, DMARC, WAF, HTTPS. The same inputs produce the same result, every run.

Public registries as sources

Data comes from the open registries of the internet and from public institutional records, never from private collection.

Human-in-the-loop review

Before publication and before any institution is notified, critical findings go through human verification.

Communication pipeline

Notifications to exposed institutions, technical briefs on request, subscriptions to future editions. The workflow does not stop at the report.

Passive, legal, auditable methodology

  • Only what any browser sees when it opens the site.
  • Plus the open registries of the internet, available to anyone.
  • No active scanning, no password testing, no touching the systems.
  • Every score can be reproduced by anyone, step by step.

First edition

The findings

The Romanian state’s overall grade on digital hygiene: mediocre.

7/10
overall average across every institution audited
502
institutions with open ports
117
institutions exposing critical services
158
institutions on addresses with publicly catalogued vulnerabilities
49.3%
without DMARC, so trivial to spoof by email
94.4%
without a WAF, no filtering of hostile traffic
13
public websites with no HTTPS at all

Best score

A rural commune in Cluj county

A clean 10. Communes (7.2 average) score above municipalities (6.8).

The surprise in the data

County hospitals

An average of 7.1, level with city halls, although the stakes are incomparably higher.

Go-to-market

The launch

A coordinated launch across three channels on the same day, 27 July 2026: the personal post, the PressOne article and barometrul-digital.ro.

1,277
shares of the launch post
8,435
total engagement on the launch post
3
channels launched simultaneously

An all-time distribution record for the page. The content left its own audience within the first hours.

Media coverage

Euronews România, „Vocile care contează”, 29 July 2026. The same broadcast featured commentary from the director of DNSC, Romania’s national cyber security directorate. In the same week the barometer was picked up by ProTV, Economedia and Euronews România.

Impact

Adoption

An audit that gets read is a report. An audit that gets acted on is a product.

Within 24 hours

  • 23 institutions requested the technical brief on their own findings.
  • One municipal city hall started fixing things that first evening.

Within the first week

  • 41 institutions across 24 counties entered the conversation: city halls, county councils, central institutions, a county hospital.
  • 131 notifications sent to institutions with critical exposures.
  • Contact pipeline covering 2,640 of 2,660 institutions.
  • A subscription system for future editions, shipped in the same week.

Edition 2

Iteration

August 2026: the same institutions, measured again, on the distribution channels built during the first edition.

Re-measurement

Same institutions, same methodology, so the repairs become visible.

Country report

The aggregate picture of the state’s digital hygiene, not only per-institution briefs.

Distribution already built

The channels and subscriber list from edition one become the infrastructure of edition two.

Links

Have a field that should be measured systematically?

Tell me what you want measured and on what cadence. I will reply with how it could work as a recurring product rather than a one-off report.

You will get a concrete proposal for scope, methodology and publication cadence.