Our research first raised alarms back in 2019, when we discovered CNNIOC issued “999-year” digital certificates inside an Accenture Gold Standard flagship corporate laptop during a session attended by Accenture senior leadership and their PKI expert.

These 999 years CNNIC digital certificate with full admin access handed near-permanent administrative access to anyone who possessed the corresponding keys.

Instead of triggering an emergency response, the finding was quietly brushed aside and covered up.

Then within two years, Accenture fell victim to a massive 2021 cyber incident, a flashing red siren for any organisation claiming to be a global authority on digital transformation and security.

But rather than seize the moment to overhaul its questionable security foundations, the company allowed the same systemic weaknesses to persist.

Today TLS/SSL failures, DNSSEC breakage, certificate mismatches, and erratic PKI governance continue to expose Accenture, their clients, governments, partners and employees to unnecessary and avoidable risk.

This wasn’t a one-off mistake: it continues to be exposed.

This is a pattern of negligence, a widespread corporate culture that treats cybersecurity as an accessory instead of the backbone of trust.

And the world’s largest enterprises are left to absorb the consequences and fallout.

Accenture have secured their DNS records and servers for the last 6 years which is great especially when compared to the majority, however, as harsh as it may seem, cyber criminals only require one configuration error, Not Secure subdomain, or unsecured server to get a foothold and launch an attack.