Ask most business owners what TLS version their company's website uses, and the answer will be silence. And that's fine — it's not their job to know. It's ours.
The problem is that whoever administers the server often doesn't know either. Not because they don't care, but because it's exactly the kind of setting that gets configured once, works, and nobody touches again for years.
We found it in our own infrastructure a few days ago.
What TLS 1.0/1.1 is, in one sentence
TLS is the protocol that encrypts the connection between a visitor's browser and your server — the padlock you see in the address bar. TLS 1.0 shipped in 1999. TLS 1.1 in 2006. Both have structural weaknesses known for over a decade (attacks like BEAST, and the POODLE-style family of attacks) that can't be fixed with a patch — they're design flaws in the protocol itself.
Since 2020, modern browsers (Chrome, Firefox, Safari) disabled them by default. Since 2018, the PCI-DSS standard directly prohibits them for anyone processing card payments.
And yet, they remain alive on a surprising number of production servers — including, until recently, ours.
How we found it
It wasn't an incident. It was the result of a routine perimeter review we regularly run on our own infrastructure — the same discipline we apply when auditing a client's. We verified real external exposure (not just paper configuration), reviewed every layer of the stack — DNS, firewall, certificates, and yes, encryption protocols — and there it was: the server was still accepting TLS 1.0 and 1.1 negotiations alongside the modern versions.
Nothing was exploited. No alert, no incident. Just an old configuration nobody had reviewed with that specific question in mind.
That's actually the most common pattern in security: it's not sophisticated attacks that expose you. It's the default configuration nobody looked at again.
What we did
We restricted the server to accept only TLS 1.2 and 1.3 — the two current versions, without the structural weaknesses of their predecessors. The change was applied at the server level, covering all traffic through it at once.
We didn't settle for "it should work." We verified from outside, the way a real attacker or a client evaluating the site would: confirmed that a TLS 1.0 or 1.1 connection fails to negotiate, and that TLS 1.2 still negotiates fine, with a modern cipher. Without external evidence, we didn't call it closed.
The part that matters
We're not sharing this to show off a two-line config fix. We're sharing it because it's representative of something bigger: security isn't a project that gets finished, it's a process you have to keep reviewing — even, or especially, on the own infrastructure of a cybersecurity company.
If you've never asked this question about your own site or app, you're probably not the only one. And it's probably not the only thing nobody's reviewed again.
We look first. Then we decide.
Want to know what your infrastructure is really exposing today? That's exactly the kind of finding we look for in every Assessment. Schedule a technical conversation.