WebPKI Observatory — Operational Risk
1,716 total compliance incidents have been recorded across 55 CAs, with misissuance leading at 658 cases, followed by 555 governance failures and 372 revocation issues. CAs self-report only 30% of their own incidents, while external researchers discover 17%, automated tools find 15%, and formal audits catch just 7%, revealing a systemic detection gap. Of the 1,716 incidents, 230 represent explicit policy failures, 157 involve disclosure failures, and 110 were audit findings, demonstrating that even third-party oversight misses the majority of compliance breakdowns.