Weaving a Safer Web

Communicating securely on the web is a fundamental competency, yet it remains an elusive goal for a significant portion of the enterprise landscape. While individual host data suggests that only 2.2% of HTTPS systems fail to support TLS 1.2, this metric masks a deeper organizational struggle. When viewed through the lens of firms rather than hosts, the data reveals that 22.2% of organizations have not fully rolled out modern encryption protocols across their entire web infrastructure.

The failure to implement TLS 1.2—now a baseline requirement for most standards—is rarely an isolated technical oversight. This report rewards the click by proving that a lack of modern TLS support is a powerful “smoke signal” for systemic insecurity. Organizations that struggle with this low-hanging fruit exhibit a 70% higher density of severe security findings across their entire network. If a firm cannot manage its web encryption, it is highly likely that it also struggles with more fundamental operations like software patching.

Remediation speed and environment choice play critical roles in these outcomes. On-premises hosts are 23.8% more likely to fail implementation compared to those in top-tier cloud environments, which boast impressively low incompatibility rates. This research provides the benchmarks needed for security teams to use “cyber hygiene” markers like protocol support to accurately gauge the broader risk management capabilities of their partners and third parties.

Key Findings

• The 22% Implementation Gap: Nearly 22% of organizations have failed to comprehensively implement TLS 1.2 across their web infrastructure.
• 70% Higher Finding Density: Firms that do not fully support TLS 1.2 exhibit a 70% higher rate of high and critical security findings overall.
• Patching and Protocol Link: 67% of servers running older TLS versions also exhibit significant struggles with basic software patching.
• 1-in-10 Critical Risk: One in ten organizations is actively transmitting private PII or credential information over flawed, outdated protocols.
• On-Prem Exposure Penalty: Compared to the global baseline, on-premises hosts are 23.8% more likely to run incompatible encryption protocols.
• The 5x Jump in High-Value Risk: High-value assets running older TLS versions see a 5x increase in critical security issues compared to those using modern standards.