Cybersecurity Website Speed and Core Web Vitals Statistics 2026: 26 Security Vendors on Real-User Data

Only 3 of the 26 cybersecurity vendor websites we checked passed all three Core Web Vitals for phone visitors in September 2026, according to Chrome UX Report data read through Treo. That is 12%, against 52.8% of all mobile origins and 46.6% of the top million in the HTTP Archive's technology report for the same month. None of the eight large network and endpoint platforms passed, and none of them loaded fast enough to meet the 2.5 second target.

No public dataset labels a website as cybersecurity, so this page combines two sources. The first is our own sample of named security vendors, with Chrome's real-user field data for each origin. The second is the HTTP Archive's technology data for the platforms and sales tools those sites run, which covers thousands of origins rather than dozens.

The thresholds, and what the field data covers

Google judges a page on three field measures from real Chrome users: Largest Contentful Paint (LCP) for loading, Interaction to Next Paint (INP) for responsiveness and Cumulative Layout Shift (CLS) for visual stability. A page passes when 75% of visits meet all three targets, judged separately for mobile and desktop (web.dev).

Two details matter for a security vendor reading these numbers.

The data leaves out iPhone users. The Chrome UX Report excludes Chrome on iOS, Android apps using WebView and other Chromium browsers such as Edge (Chrome for Developers, CrUX methodology). Edge is common on managed corporate Windows machines, so enterprise visitors are under-represented.

Small sites may have no score at all. Pages and origins must be publicly discoverable and "sufficiently popular", and Google does not publish the threshold. When a page group lacks data, Search Console falls back to the origin, and when the origin lacks data it shows nothing (Google Search Console Help). A seed-stage security startup may only ever have an origin score.

How 26 cybersecurity websites score on real-user data

We listed 47 security vendors across five segments and read each origin's September 2026 phone data from Chrome UX Report through Treo's public site speed pages on 2026-10-28. Treo returned data for 26. For the other 21, including SentinelOne, Rapid7, Proofpoint, Darktrace and Drata, Treo's job was still processing after repeated requests, so they are left out rather than counted as failures. A site passes when Treo rates LCP, INP and CLS all good.

The biggest vendors are the slowest. Palo Alto Networks, CrowdStrike, Fortinet, Check Point, Zscaler, Trend Micro, Sophos and Huntress all failed, and not one had a good LCP. Fortinet and Check Point sat above 4.5 seconds. These are large, multi-product, multi-language sites with heavy navigation and many owners, which is where page weight piles up.

Cloud-native vendors did best. Snyk and Wiz both passed with LCP at or under 2.0 seconds and INP under 200 ms, and 1Password passed in the identity segment. All three run Next.js. That is a small group, and it is also the group most likely to have engineers who look at web performance.

Server time is the quiet problem. Only 4 of 26 sites had a good time to first byte, under 0.8 seconds. Sophos was at 2.9 seconds and Qualys at 2.5 seconds before anything rendered. A page that waits 1.8 seconds for its first byte has 0.7 seconds left for everything else if it wants a good LCP.

Platforms: the enterprise CMS shows up, and so does our bias

From each homepage's initial HTML, six of the 26 sites run Adobe Experience Manager: Palo Alto Networks, CrowdStrike, Fortinet, Okta, Ping Identity and Trend Micro. None passed, and none had a good LCP. Six run Next.js, and three of those passed. Four run WordPress and none passed. Vanta, the one Webflow site with data, had the slowest LCP in the sample at 6.3 seconds.

We build marketing sites in Webflow and applications in Next.js, so we are not neutral, and a sample this size cannot rank platforms. The wider data is more useful, and it shows that how a site is built and loaded matters more than the logo on the CMS.

Next.js passes least often across the top million, yet it carries the three passing sites in our sample. That is the real lesson: a framework does not make a site fast or slow, the team running it does. Our B2B SaaS website speed statistics cover the platform pass rates across all origins, where Webflow leads at 71.3%.

The sales stack security vendors carry, and what it costs

Security vendors sell to buying committees, so their sites carry account-based marketing, chat and marketing automation tools. In the initial HTML of our 26 homepages, we found Marketo on ten, OneTrust on seven, Qualified on five and 6sense on two. Tools injected later through a tag manager are not visible this way, so these counts are a floor.

The figures are correlational: a site running 6sense is usually a large enterprise site with many other tags too. Our sample points the same way. Of the ten homepages loading Marketo, one passed. Of the five loading Qualified, none passed and four missed the INP target; KnowBe4 was the exception with a 125 ms INP.

Chat and intent tools cost responsiveness. These scripts run on the main thread, often on every page, and they react to scrolling and clicks. That is exactly what INP measures. Google's INP guidance breaks every interaction into input delay, processing time and presentation delay, and recommends breaking long tasks up and yielding to the main thread so the page can paint (web.dev).

What the wider web tells a security marketing team

The HTTP Archive's 2025 Web Almanac, built on July 2025 data, found 48% of sites passing on mobile, up from 44% in 2024, and 56% on desktop. Two of its findings map onto security vendor sites.

Busy sites struggle with INP. Good INP on mobile ran at 63% for the top 1,000 sites, 56% for the top 10,000 and top 100,000, 64% for the top million and 77% across all sites. Home pages did better than inner pages, 80% against 69%. Platform tours, product comparison tabs and resource libraries sit on inner pages, so that is where to measure.

Most mobile LCP elements are images. An image was the LCP element on 76.0% of mobile pages, and 17% of mobile pages lazy-loaded it, which delays the very element the metric measures. A security hero with a large product dashboard screenshot or an animated threat map is a typical case.

For a broader view across industries, our post on website speed statistics collects the load time and bounce studies, and the Webflow page speed fixes post lists the changes that move these numbers on a Webflow build.

How much speed is worth to a security demo funnel

There is no published controlled study of page speed on a cybersecurity site that we could verify. The nearest evidence is general, and old.

Lead-generation sites. The "Milliseconds Make Millions" study by Deloitte and 55, commissioned by Google, followed 37 brand sites and over 30 million user sessions at the end of 2019. On lead-generation sites, a 0.1 second gain lifted progression from the homepage to the first form step by 5.5% and from the first form step to the submission page by 21.6%. A demo request or free trial form behaves like a lead-generation funnel, so this is the closest proxy.

A telecom case study. Google's Core Web Vitals business impact page reports that Vodafone Italy improved LCP by 31% and saw 8% more sales. It is a telecom, not a security vendor, and a case study reported by the company promoting the metrics.

Treat both as direction rather than forecast. A security buyer is unlikely to abandon a vendor over one slow page, but the demo form is where small frictions add up. Our demo request conversion rates post gives the form baselines to measure against, and Cybersecurity Demo Request and Lead Form Statistics 2026 adds the sector view.

What this means for a cybersecurity website: a five-page test order

Test in the order that pipeline moves through the site, on phones first, with field data where it exists and a lab run where it does not.

Before the first test, list every third-party script with an owner and a reason, and remove anything nobody claims. On a four-week marketing-site build we would agree an LCP of 2.5 seconds and an INP of 200 milliseconds on phones for these five pages in the brief, and check field data monthly after launch. Our marketing websites service page explains how we scope a cybersecurity build.