WebPKI Observatory — Concentration Risk
An HHI of 2325 and 91.8% five-firm concentration ratio reveal systemic dependency on a handful of issuers, where operational failure at any top-three CA would affect nearly three-quarters of encrypted web traffic. The gap between Internet Security Research Group's 39.2% share and the fourth-place GoDaddy at 9.7% shows winner-take-most dynamics in the free certificate era. This concentration amplifies governance demands on leading CAs while simultaneously reducing their individual reputational risk from any single incident.