Domains and the domain name system (DNS) sit at the perimeter of a company’s external attack surface. CSC’s Domain Security Report 2026 shows how Global 2000 companies and top unicorns adopt key domain security measures, where risk concentrates, and why DNS security belongs in business continuity planning.
Picture this: A bank that doesn’t use registry lock with its domain registrar gets completely hijacked with all its domains and DNS compromised, including its internal email and File Transfer Protocol (FTP) servers. The attackers redirect traffic from the bank’s official website to malicious lookalike sites, securing them with free SSL certificates to look more real with the HTTPS padlock on the address bar.
This leads to a long list of compounding consequences. For the next few hours, customers attempting to access their accounts online not only have their login credentials harvested on the fraudulent site, but also malware installed on their personal computers. Internally, email communications grind to a halt as email servers tied to the affected domain stop working. The bank can’t inform customers or contact their domain and DNS provider as a result.
This isn’t a fictional scenario. It’s based on a real incident that occurred at a major bank with hundreds of branches in Brazil. Plus, similar incidents have occurred around the world—at many different companies and across many different industries. And they continue to happen regularly—even today.
These increasing common incidents underscore the importance of incorporating domain security into business continuity planning. Domains act as the backbone of digital interactions. And breaches in this space have far-reaching consequences that ripple across operations, customer trust, and financial outcomes.
Domains and DNS as business-critical infrastructure
It might not have been the case two decades ago in the early days of e-commerce, but global businesses now rely on the internet for far more than hosting a public website. Email, authentication, voice over IP (VoIP), client and partner portals, supplier applications, and even parts of the supply chain depend on domains and DNS. The internet is no longer just a “marketing channel.” Instead, it’s now part of operational infrastructure.
Many companies focus on securing their firewalls but neglect domain security and allow attackers to infiltrate systems, just like the bank, through their domains and DNS. CSC’sDomain Security Report 2026 reveals that even among the most reputable companies, domain security adoption is surprisingly low.
More than half of the Forbes Global 2000 companies use retail-grade domain registrars, which often lack advanced security controls. This gap exposes them to significant risks, as attackers can exploit these less secure domains to launch phishing campaigns, distribute malware, or disrupt essential online services.
Risk leaders need to turn their attention to domain names, now crucial elements of an organization’s cybersecurity posture, especially as it becomes essential to business infrastructure, continuity, and the emerging AI stack. In other words, domains, DNS, and SSL certificates act as the connective tissue these systems use to function and communicate securely. Once DNS fails or gets manipulated, the business can experience outage, fraud, impersonation, or loss of trust long before a technical root cause gets briefed to the board.
Why domain security belongs in leadership-level risk conversations
There exists a galaxy of domain threats tied to business disruption, including phishing attacks, ransomware attacks, impersonation attacks, business email compromise (BEC) and more. Attackers can exploit different parts of a portfolio, not only primary brand domains.
As cited in CSC’s report, examples include:
- Compromised or hijacked legitimate domains, where cybercriminals target domains left unsecured
- Hijacked subdomains, where attackers exploit forgotten DNS records (dangling DNS) to host malicious content
- Dormant domain names, which may look inactive, but attackers can still weaponize
- Malicious domain registrations, including spoofing permutations and homoglyphs
- Newly lapsed branded domains reregistered by a third party, often after cost-driven lapses
For these reasons, DNS and domain security shouldn’t sit only in a technical backlog. As the report points out, they map directly to executive concerns, such as consumer safety, intellectual property, supply chains, revenue, and reputation.
The adoption data also signals a governance gap. Our research found that 67% of all Global 2000 companies implemented less than half of eight key security measures used to determine the strength of a company’s domain security posture.
Domains as critical infrastructure: the need for ongoing oversight
Domain names are core infrastructure assets, integral to both cybersecurity and business continuity.And as continuity risk is an ongoing factor, companies shouldn’t treat it as a one-time project. Businesses must maintain continuous DNS monitoring, regular audits and reviews, and proactive issue detection before it impacts customers.
A governance tradeoff also risks more cost and consolidation pressures. Many companies now turn to a single infrastructure on the cloud for cost savings, scalability, and data accessibility. However, this method lets in potential threats if attackers take parts of the system offline. The only way to truly mitigate DNS risks is therefore implementing a dual infrastructure, or two independent networks, for redundancy.
External monitoring is also key to a robust strategy. Our research found that brands don’t own suspicious or malicious domains containing Global 2000 brand names. Instead, third parties own 88% of homoglyph domains. Moreover, 32% of third-party domains are inactive but contain Mail Exchange (MX) records, meaning they can be used for email activity even without a live website.
How domain security strategy connects to the big picture
CSC’s Domain Security Report 2026 frames domains and DNS as operational infrastructure that sits directly on the external attack surface. The adoption trends show progress in some controls, like Domain-Based Message Authentication, Reporting, and Conformance (DMARC) growth to 80% in 2025. But they show persistent gaps in others, like Domain Name System Security Extensions (DNSSEC) at 11% and declining DNS redundancy. Risk leaders focused on continuity must begin to treat domain security as a business resilience dependency and govern it accordingly.
This document is provided by CSC for information purposes only and does not constitute an offer, invitation, or inducement to contract. The information herein does not constitute legal, tax, regulatory, accounting, or other professional advice, and therefore one should seek appropriate professional advice before considering a transaction as described in this document. No liability is accepted whatsoever for any direct or consequential loss arising from the use of this document.
