Sectigo survey: most IT leaders saw certificate outages, automation remains rare

En bref

• Sectigo surveyed 500 IT leaders about TLS certificate management.
• 61% reported at least one outage or incident in the last year.
• 40% said they were prepared; only 4% had complete automation.
• Help Net Security published the findings on October 29, 2026.
• Manual certificate processes remain a widespread operational risk.

A Sectigo survey of 500 IT leaders examined how organizations manage TLS certificates and whether automation is in place. Help Net Security reported the results on October 29, 2026. The central finding is not a software flaw but an operational gap: certificate lifecycle work is still largely manual for many teams.

In the prior year, 61% of those surveyed reported encountering at least one certificate-linked outage or incident. That means expired, misconfigured, or poorly tracked certificates disrupted services for a majority of the surveyed group.

Readiness is uneven. Only 40% described their organizations as prepared for certificate management demands, and a mere 4% said automation was fully implemented. The gap between awareness and action leaves room for avoidable disruptions.

For K-12 and government IT, the stakes are practical: portals, authentication, email, and internal applications depend on trusted TLS. A lapsed certificate can lock out staff or students and create incident-response load. Manual spreadsheets and calendar reminders do not scale across diverse endpoints and owners.

The survey points to a need for clearer ownership, complete certificate inventories, and automated renewal with monitoring. Watch for vendors and districts to prioritize automation in 2026 planning, and for Help Net Security and Sectigo to publish further breakdowns. The absence of a CVE does not make certificate hygiene less urgent.

À faire maintenant

1. Build a complete inventory of TLS certificates, including owner, expiration date, issuer, and dependent service.
2. Assign named owners for every certificate and require quarterly ownership reviews.
3. Enable automated renewal where supported, starting with public-facing and authentication-related endpoints.
4. Configure expiry and configuration alerts at 60, 30, and 7 days before expiration.
5. Test renewal and deployment in a staging environment before enabling production automation.
6. Create a certificate incident runbook that covers revocation, replacement, and service validation.
7. Review third-party and vendor-managed certificates on the same schedule as internally managed ones.

Source originale

Help Net Security