Topic starter
25/06/2026 2:57 pm
TL;DR: The middle third of organisations are more vulnerable than they think, even when they avoid the lowest-performing group, according to DigiCert’s State of Digital Trust 2024 survey of 300 enterprise leaders. The gap is less about awareness than execution, and it now affects identity, device, software, and certificate governance alike.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Survey says: 1/3 of leaders are more vulnerable than they think”.
Key questions
Q: How should security teams prove digital trust maturity instead of assuming it?
A: Security teams should tie digital trust claims to operational evidence: certificate health, device update visibility, software signing status, and incident response performance.
Q: Why do organisations become overconfident about digital trust?
A: Overconfidence usually comes from siloed reporting and partial success.
Q: What breaks when digital trust is managed in silos?
A: Siloed trust management breaks the organisation’s ability to see cumulative risk.
Practitioner guidance
- Map trust to operational evidence Replace maturity labels with evidence for outages, breaches, response times, device visibility, and software integrity across the business.
- Unify siloed trust reporting Create a single governance view across enterprise access, connected devices, software supply chain, and eSignature control ownership.
- Test IoT identity and monitoring Validate that device identities can be updated, monitored, and revoked in the field, not only at provisioning time.
Bottom line: The survey’s core risk is not ignorance of digital trust, but confidence that exceeds actual control performance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:13 pm
Digital trust overconfidence is a governance failure before it becomes a technical failure. The article shows that leaders can recognise the importance of digital trust while still misjudging their actual exposure. That gap matters because security programmes often report maturity in categories, but attackers experience the organisation as one connected trust surface. Practitioners should treat confidence as untrusted until it is backed by control evidence.
A question worth separating out:
Q: Should organisations prioritise PQC readiness or device trust first?
A: Prioritise the area where weak trust has the widest blast radius in your environment. If connected devices are hard to monitor or software signing is inconsistent, those gaps can undermine multiple programmes at once. Use PQC readiness to surface cryptographic dependencies, but do not ignore runtime trust controls.
👉 Read our full editorial: Digital trust overconfidence is leaving enterprise controls exposed