Guarding digital trust

At eMudhra, weak cryptographic keys went undetected for about 18 months, prompting the company to exit its global website-security certificate business. The PHP flaws raised fears of attackers executing malicious code on vulnerable servers, while the reported SBI data exposure renewed questions about customer data protection. The common thread is the need to ensure that safeguards underpinning digital services work as intended.

As more transactions and public services migrate online, even a technical failure in one part of the system can have consequences for users well beyond the organisation directly affected. The incidents expose the limits of compliance-based security. Periodic audits, prescribed standards, and regulatory certifications are necessary, but cannot guarantee that systems remain secure between inspections.

At eMudhra, a flaw in key generation reportedly escaped detection because the output was not reviewed. The PHP vulnerabilities show how a weakness in widely used software can affect organisations across sectors, even when their own applications are developed responsibly. Organisations need continuous monitoring, independent technical validation, prompt software updates, and clear procedures to detect and contain breaches.

Security must be built into everyday operations, rather than treated as a box to be ticked during an audit. Equally, responsibility cannot rest solely with individual organisations when they depend on external software, cloud infrastructure, and vendors whose security practices may be difficult to assess. The implications extend beyond financial losses or service disruptions. A compromised certificate can undermine confidence in a website’s identity; a software vulnerability can expose servers to unauthorised access; and leaked customer data can facilitate fraud and identity theft.

Risks can spread across organisations using shared software and service providers. Artificial intelligence adds urgency: It can help researchers identify vulnerabilities faster, but may also accelerate the development of exploits. Organisations must shorten the time between discovering a flaw and deploying a fix, maintain an inventory of software and third-party dependencies, and address systems that no longer receive updates.

Where customer data is exposed, timely disclosure and a clear account of the incident are essential to help affected users protect themselves. Policymakers must strengthen accountability without excessive regulation. Investigations should establish the causes of failures, assess whether safeguards were adequate, and identify responsibility where controls were neglected. Findings should be made public wherever possible.

Regulators should promote independent testing of critical systems, clear incident-reporting procedures, and regular reviews of security practices. Companies must recognise that protecting data and maintaining digital trust are continuing responsibilities, not costs to be minimised until a problem emerges. Not every vulnerability makes digital services unsafe, but the absence of confirmed misuse does not prove that safeguards were adequate.

As more economic activity and public services move online, confidence will depend on resilient systems, transparent responses to failures, and lessons translated into stronger controls. The objective must be to prevent lapses where possible and ensure that they are detected quickly and addressed credibly.