WebPKI Observatory — Operational Risk
CAs have reported 1,531 incidents across 54 organizations, with misissuance representing 596 cases and governance failures accounting for 488. Only 25% of incidents emerged through CA self-detection, while external researchers discovered 19% and automated tools found 17%, revealing gaps in internal controls. Policy failures affected 183 incidents and disclosure failures 136, with just 107 audit findings despite mandatory annual examinations, foreshadowing the audit intelligence finding that oversight mechanisms miss operational realities.