ctscout research · note 3

Who Uses What?

The software vendors confirmed in note 2 hold certificates on 59,995 web domains whose names are not the vendor's own brand. For 7,246 of those domains a second certificate names the owner, and that name can be tied to one registered legal entity, so its country and its securities can be looked up. Across the whole collection, 7.8% of all domains carry a vendor's certificate and nobody else's, so the name on the certificate is the vendor's, not the owner's.

ctscout.dev · note 2's domain list as of 2026-10-25 · GLEIF 2026-10-25 · ISIN mapping 2026-10-25 · Wikidata 2026-10-25

Two ways to count a customer

Note 2 found that a vendor's certificate on a company's domain means the vendor operates that part of the company's website, and it produced the list of such domains this note works from. That list gives two counts. Candidates are every domain the vendor certified that does not carry the vendor's own brand in its name. DNS-confirmed customers are the sampled domains where a DNS check showed the address the vendor certified pointing at the vendor's own servers while the domain demonstrably belongs to someone else. Note 2 drew 60 domains per vendor; the ones that could actually be checked are the "testable" column, and the confirmed figure is the result of that check, not a count of customers. The precision column is the confirmed share of the testable domains, and it is the best estimate of the share of candidates that are real customers. Candidates and DNS-confirmed are two views of the same domains, so they are never summed.

vendor_customers_profile.py · 2026-10-25 09:43 UTC · candidates and DNS-confirmed are separate counts

Which organizations, in which countries

A vendor's certificate names the vendor, so the owner has to come from somewhere else. When the owner also buys an OV certificate for the same domain, the owner's name is on that certificate, and note 1's procedure ties the name to an LEI: the name matches one GLEIF record, and nothing the domain itself shows (its country-code suffix, the other organizations certified on it) contradicts that record's country; a match with no such evidence either way is kept, so this is "not contradicted", not "confirmed". This note calls a customer domain LEI-resolved when exactly one LEI is found among the non-vendor names on its certificates; a name that matched nothing may remain beside it, and the method box says how often that happens. Of the 59,995 candidate domains, 13,846 carry another organization's certificate and 46,149 carry only vendors'. Among the first group, three outcomes are possible and the table shows each: one LEI (resolved), several LEIs (the names point at different entities), or no LEI at all (the name matched no GLEIF record, or matched ambiguously). Only the resolved column feeds the country and securities figures.

vendor_customers_profile.py · LEI-resolved = the non-vendor names on the domain match exactly one GLEIF record whose country the domain's own evidence does not contradict

How many of those customers issue securities

Among LEI-resolved customer domains, the table says how many belong to an entity with at least one ISIN recorded in GLEIF's ISIN-to-LEI mapping. This is a lower bound: the mapping records ISINs that have been tied to an LEI, and an entity absent from it may still have securities. The share is of LEI-resolved domains, whose count is repeated in the table, and it says nothing about the customers that could not be resolved.

vendor_customers_profile.py · ISIN mapping 2026-10-25 · share = ISIN-bearing / LEI-resolved

Who uses several vendors at once

Co-use counts customer domains that carry certificates from two confirmed vendors and, for owners that could be identified, the legal entities that are customers of both vendors, on the same domain or on different ones. The domain count is a fact about the certificates; the entity count depends on identification and is usually smaller, though it can exceed the domain count when one owner uses the two vendors on different domains. 1,954 of 59,995 candidate domains carry two or more confirmed vendors; the pair table sums to 2,162 because 101 domains carry three or more vendors and appear in every pair they form.

vendor_customers_profile.py · each pair with any co-use listed once, by domains then entities; the matrix is checked symmetric at build time

When the customers were first seen

The month a customer domain first appeared in the warehouse with the vendor's certificate, counted separately for candidates and for DNS-confirmed domains. The warehouse starts in 2026-02, so the first month collects everything that already existed; later months are new arrivals only. A large one-month count can be a certificate-issuance event rather than a sales event: note 2 documents a vendor issuing very short-lived certificates (valid a few days) on thousands of domains in one month. Those domains stay in the candidate count on this page; only the monthly chart should not read them as sales.

Domains that carry only a vendor's certificate

Note 1 asked how often the organization on a certificate is not the owner of the domain at all. With the confirmed vendors in hand, this can be counted across the whole collection: a domain is vendor-only when it is on note 2's list (a confirmed vendor certifies it and it does not carry that vendor's brand) and no other organization holds a certificate on it. Of 591,423 domains, 46,130 (7.8%) are vendor-only: anyone reading the certificate to learn who owns the domain gets the vendor. These are the 46,149 candidate domains that carry only vendors' certificates, less 19 whose name contains another confirmed vendor's brand. The second row restricts the count to the 8,616 domains whose owner is independently known from Wikidata, the public encyclopedia database, which lists an LEI and an official website for the organizations note 1 used as its check set: 454 of them (5.3%) are vendor-only.

vendor_customers_profile.py · denominators: every domain in the warehouse (note 1's total) and the Wikidata-listed domains present in it

One page per vendor

Each confirmed vendor has a page with its counts, its country table and up to 10 DNS-confirmed customer domains (9 of the 10 vendors have the full 10; the others list every confirmed domain they have), rebuilt with this note.

• Salesforce · 23,928 candidate domains
• Microsoft · 22,895 candidate domains
• Adobe Systems · 6,835 candidate domains
• Criteo Technology · 4,946 candidate domains
• Thomson Reuters · 1,036 candidate domains
• Hong Kong Sar Government · 684 candidate domains
• Tessitura Network · 605 candidate domains
• Cdnetworks · 468 candidate domains
• Powerschool Group · 389 candidate domains
• Yahoo Holdings · 266 candidate domains

What this cannot tell you

• Who the unresolved customers are. 52,749 of 59,995 candidate domains carry no name other than vendors', or names that match no GLEIF record or several; nothing here says who owns them.
• Whether a candidate is a customer. Only the sampled domains were checked against DNS; we know roughly what share of candidates are real (the precision), not which ones.
• What the customer bought. A certificate on community.example.com says the vendor operates that host, not which product, seat count or contract.
• Anything about internal use. A company using a vendor only behind its firewall, or under a certificate without an organization name, is invisible.
• The industry of a customer. GLEIF has no sector field and none is inferred.
• A trend. The collection starts in 2026-02; the first month is the backlog and later months are a few months of arrivals.