TL;DR: Certificate-related outages hit 86% of organisations in the past year, with 31% experiencing them at least quarterly and 10% seeing weekly disruption, as Keyfactor’s Digital Trust Digest: The Automation Edition finds, with visibility and automation gaps driving operational risk. The real problem is not certificate expiry alone, but governance built on incomplete inventory, weak ownership, and partial automation.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Keyfactor's research: Certificate outages are common, visibility is low, and partial automation is leaving machine identity operations exposed.
Why it matters: It matters because certificate failure is now an operational identity governance problem, so IAM, PKI, PAM, and NHI teams need ownership, inventory, and renewal controls that hold up under shorter lifespans.
By the numbers:
- An overwhelming 86% of companies suffered at least one outage and subsequent disruption due to expired or mismanaged digital certificates within the past year.
- Nearly one-third of companies, 31%, reported certificate outages at least once a quarter.
- 10% reported a certificate outage every single week.
Context
Digital certificate management is an identity governance problem because certificates are machine credentials that authenticate systems, services, and workloads. When ownership, inventory, and renewal timing are fragmented, certificate expiry becomes an outage pattern rather than a routine maintenance event.
Keyfactor’s research shows that organisations are still managing certificates with incomplete visibility and only partial automation even as certificate lifespans shorten. That creates an operational gap for NHI programmes, because the control surface is not just issuance and renewal but discovery, assignment, and revocation across the full certificate lifecycle.
The article’s central point is that the failure mode is governance drift, not a single expired certificate. That makes it a typical machine identity problem, not an edge case.
Key questions
Q: What breaks when certificate ownership is not clearly assigned?
A: When ownership is unclear, renewal becomes inconsistent, orphaned certificates persist, and no one can prove which services still rely on outdated trust. That creates a control gap in both availability and security, because expired or weak cryptography can break access while also expanding attack surface.
Q: Why do certificate outages keep happening even when some automation is in place?
A: Partial automation leaves manual gaps between discovery, approval, renewal, and deployment, so the organisation still depends on humans for the steps most likely to break. That is why teams can automate part of the lifecycle and still suffer outages. End-to-end coverage matters more than isolated workflow automation.
Q: How should security teams measure whether certificate governance is actually working?
A: Use operational signals, not policy statements. Track certificate expiry outages, provisioning and revocation latency, support ticket volume, and whether teams can identify all cryptographic assets in use. If a trust programme looks compliant on paper but still produces outages, workarounds or blind spots, governance is not working as intended.
Q: How should teams manage certificate renewals when lifecycles keep shrinking?
A: Teams should move from calendar-based renewal to continuous lifecycle orchestration. That means tracking certificate state, owning the deployment path, and automating verification after renewal. Shrinking lifecycles make delayed approvals and missed notifications operational risks, so the control objective is uninterrupted service continuity, not just timely renewal.
Technical breakdown
Why certificate expiry becomes an outage problem
A digital certificate is a cryptographic authenticator with a fixed lifespan, so expiry is expected. The outage happens when the organisation cannot reliably discover every certificate, map it to an owner, and renew it before services fail. In practice, fragmented inventories, orphaned certificates, and manual handoffs turn a routine lifecycle event into a production incident. Shorter lifespans compress the response window and expose any gap in ownership or process handoff. Practical implication: Treat certificate expiry as a managed lifecycle event, not as a helpdesk exception.
Practical implication: Treat certificate expiry as a managed lifecycle event, not as a helpdesk exception.
How partial automation still leaves machine identity risk
Automating one part of the certificate lifecycle does not solve the problem if discovery, approval, renewal, and deployment remain disconnected. Partial automation often creates a false sense of control because it handles the easy certificates while leaving the risky edge cases in manual queues. That is why teams report partial success even when they have automation in place. The failure is not automation itself, but uneven coverage across the lifecycle and the surrounding approvals. Practical implication: Measure certificate automation by end-to-end coverage, not by the number of automated steps.
Practical implication: Measure certificate automation by end-to-end coverage, not by the number of automated steps.
Why visibility is the first control for certificate governance
Visibility is the prerequisite control because you cannot renew, revoke, or assign ownership to a certificate you cannot find. A centralized view needs to show where certificates exist, what they protect, when they expire, and whether they are actively used. Without that, teams react after services fail, which means the organisation is already in recovery mode. For NHI governance, this is the same structural issue seen in other hidden credential estates: unknown assets cannot be governed. Practical implication: Build a complete certificate inventory before scaling automation decisions.
Practical implication: Build a complete certificate inventory before scaling automation decisions.
Threat narrative
Attacker objective: The operational objective is not theft but disruption of trusted machine communication by exploiting governance gaps around certificate lifecycle control.
- Entry occurs when an expired or mismanaged certificate is still trusted by dependent systems until renewal fails or the service is interrupted.
- Credential abuse appears when certificate ownership and lifecycle controls are incomplete, allowing stale authenticators to remain in use or fail unpredictably.
- Impact follows as applications, services, or customer-facing workflows go down, creating operational disruption and trust erosion.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Certificate outages are an identity governance failure before they are an infrastructure failure. When teams do not know where certificates live, who owns them, or which services depend on them, expiry becomes a production event instead of a managed renewal. This is a machine identity problem because the certificate is the credential and the outage is the symptom. The practitioner conclusion is that governance must start with inventory and ownership, not renewal workflows.
Partial automation creates a governance illusion if renewal, deployment, and discovery are not connected. Automating one slice of the lifecycle does not remove operational risk when edge cases still fall back to manual handling. The article’s figures show that many teams are already automated in part, yet outages continue because coverage is inconsistent. The practitioner conclusion is to judge automation by lifecycle completeness, not by tool adoption.
Shorter certificate lifespans turn weak lifecycle discipline into visible business risk. As validity periods shrink, the margin for error collapses and every ownership gap becomes more expensive to absorb. This is where machine identity governance stops being a background hygiene task and becomes a resilience control. The practitioner conclusion is to align certificate governance with business continuity, not only with cryptographic hygiene.
Machine identity management now needs a dedicated inventory-and-ownership model. Certificate estates are often distributed across platforms, teams, and third parties, which means the control problem spans discovery, assignment, and offboarding. That is exactly where NHI programmes succeed or fail: the credential exists somewhere, but the accountability does not. The practitioner conclusion is to treat certificate estate visibility as an executive control, not a technical afterthought.
Digital trust breaks when certificate control is measured as process activity instead of service assurance. Organisations can renew some certificates, automate some workflows, and still experience frequent outages if the wrong services are excluded from governance. The article points to a control gap in completeness, not capability. The practitioner conclusion is to measure certificate management by outage reduction and recovery avoidance, not by workflow counts.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- An unplanned outage in a cloud environment costs an average of $9,000 per minute, per the Uptime Institute’s 2023 Global Data Center Survey.
- Read next: Certificate Lifecycle Management Buyer's Guide
What this signals
Certificate lifecycle management has become a governance dependency, not a background operations task. As certificate lifespans shorten, the margin for delayed ownership changes, missed renewals, and partial automation narrows. Programmes that still treat certificates as isolated IT artefacts will keep inheriting avoidable outages.
Real-time certificate visibility is the control boundary that separates managed trust from reactive recovery. Once the estate is fully known, teams can assign ownership, set renewal paths, and measure exposure before expiry turns into disruption. Without that inventory baseline, automation simply accelerates blind spots.
For practitioners
- Map the full certificate estate Build a complete inventory of certificates, the services they protect, and the owners responsible for each lifecycle event. Include cloud, on-premises, and third-party issued certificates so orphaned assets do not hide outside the renewal process.
- Assign accountable owners Tie every certificate to a named business or technical owner with renewal, revocation, and escalation responsibility. Where ownership is unclear, treat the certificate as unmanaged until it is remediated.
- Automate renewal end to end Connect discovery, approval, renewal, deployment, and verification so automation covers the full path rather than only the easiest renewals. Track how many certificates still require manual intervention at each stage.
- Shorten the exposure window Prioritise certificates that protect customer-facing or operationally critical services and reduce the time between renewal notice and replacement. The goal is to shrink the period in which expiry can trigger service disruption.
- Measure outage exposure, not activity Report certificate governance in terms of prevented outages, recovery time avoided, and percentage of the estate under real-time visibility. Activity metrics alone do not show whether the control is working.
Key takeaways
- Certificate outages now reflect a machine identity governance gap, not just a renewal problem.
- The article shows that visibility and partial automation are not enough when ownership and lifecycle control are incomplete.
- Teams should treat certificate inventory, ownership, and renewal coverage as resilience controls that must be measured against outage reduction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Orphaned certificates and unclear owners create lifecycle gaps similar to unmanaged offboarding. |
| NHI-07 — Long-Lived Secrets | Shortening lifespans is central to the article's certificate governance problem. | |
| NHI-05 — Overprivileged NHI | Certificates that remain trusted across too many services expand outage and trust risk. | |
| Recommendation — Track certificate owners and revoke or replace credentials that no longer have a valid business owner. Reduce long-lived certificate exposure by enforcing shorter validity and timely renewal workflows. Limit certificate trust scope to the smallest set of services that actually require it. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate lifecycle handling is a direct authenticator management problem. |
| Recommendation — Apply IA-5 to govern certificate issuance, renewal, and revocation across the estate. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Expired or mismanaged certificates are credentials whose failure or misuse affects access and trust. |
| Recommendation — Map certificate failure modes to credential access risks and prioritise high-value authenticator inventory. | ||
Key terms
- Digital certificate: A cryptographic credential issued for a defined period that can be used to prove identity during authentication. It supports stronger, time-bound access control, but only when issuance, renewal, and revocation are managed as part of the identity lifecycle.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Certificate Visibility: Certificate visibility is the ability to see what certificates exist, where they are used, who owns them, and when they will expire or renew. Without it, automation can speed up the wrong actions just as easily as the right ones, especially in hybrid environments.
Deepen your knowledge
NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org