TL;DR: Only 34% of organisations report complete certificate visibility, while 74% are highly concerned about certificate sprawl and nearly three-quarters fear outages from expired certificates, according to DigiCert’s 2026 Global PKI Research Report. Manual PKI management is no longer sustainable when machine identities multiply faster than teams can inventory, review, and automate them.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on DigiCert's research: Poor certificate visibility across enterprises is now constraining PKI modernization, outage prevention, and crypto-agility.
Why it matters: IAM and platform teams need certificate inventory, automation, and governance that can keep pace with machine identity growth, shrinking lifespans, and AI-era trust demands.
Context
Certificate visibility is the basic control that tells an organisation what certificates exist, where they live, and when they expire. When that inventory is incomplete, PKI teams cannot reliably manage renewal, revocation, or policy enforcement across a distributed estate of machine identities.
This survey shows that visibility is now the limiting factor in PKI modernization, not just certificate volume. As machine identities expand and certificate lifespans shrink, manual tracking and siloed ownership create outage risk, weaken trust governance, and make AI-era and cloud-era certificate management harder to sustain.
DigiCert's research frames the issue as an operating model problem: organisations need centralized oversight, automation, and crypto-agility to keep certificate governance current. The article's starting point is typical for large enterprises, where inventory gaps and fragmented responsibility are now common rather than exceptional.
Key questions
Q: How should security teams prevent certificate outages in distributed environments?
A: Security teams should centralise certificate inventory, assign explicit ownership, and automate both renewal and deployment. Most outages happen because no one knows a certificate exists, who owns it, or whether the renewed certificate was installed everywhere it needed to be. The fix is lifecycle control, not isolated renewal tooling.
Q: Why does certificate sprawl make PKI modernization harder?
A: Because sprawl spreads certificates across too many systems for manual oversight to keep pace. That fragmentation hides ownership, delays renewal, and makes policy changes expensive to coordinate. Modernization only works when discovery, lifecycle automation, and central policy are aligned across the full certificate estate.
Q: What are the signs that certificate governance is failing in critical infrastructure?
A: Common warning signs include unclear ownership, expired certificates, mixed use of approved and unapproved issuers, and last-minute manual renewals. If teams cannot produce a complete certificate inventory or evidence of renewal and revocation controls, governance is already weak. Those gaps usually surface as service disruption, audit friction, or insecure exceptions.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
Technical breakdown
Why certificate visibility breaks PKI operations
Certificate visibility is the ability to discover, classify, and continuously track certificates across environments. In practice, it is what makes lifecycle management possible because renewal, revocation, policy enforcement, and expiry monitoring all depend on knowing what exists. When visibility is partial, teams fall back to spreadsheets, siloed consoles, and local ownership, which creates blind spots between issuance and retirement. That is especially problematic in distributed infrastructure, where certificates may sit in apps, load balancers, APIs, devices, and automation pipelines at the same time.
Practical implication: treat certificate inventory as an operational control, not a reporting exercise.
How certificate sprawl creates outage and governance risk
Certificate sprawl appears when organisations accumulate too many certificates across too many systems for manual governance to keep up. The risk is not only expiry. Sprawl also fragments accountability, obscures ownership, and slows response when cryptographic requirements change. In a modern PKI, each unmanaged certificate extends the chance of service interruption, policy drift, or delayed revocation. Shrinking certificate lifespans make the problem sharper because renewal windows compress while the estate keeps growing.
Practical implication: map certificate owners and renewal paths before shortening certificate lifetimes.
Why crypto-agility depends on centralised automation
Crypto-agility is the ability to adapt cryptographic controls without disrupting services. It depends on centralised policy, automation, and current inventory because teams need to know where certificates are deployed before they can rotate algorithms, adjust trust chains, or respond to emerging requirements. The article's AI and quantum references point to a broader reality: certificate governance is moving from a static maintenance task to a continuous resilience function. Without automation, every cryptographic change becomes a manual coordination problem.
Practical implication: pair central policy enforcement with automated certificate lifecycle workflows.
Threat narrative
Attacker objective: The operational objective is to exploit governance gaps in certificate management so trust failures, outages, and delayed remediation become more likely.
- Entry occurs through incomplete certificate inventory, where certificates exist outside central oversight and renewal tracking.
- Escalation follows when certificate sprawl and manual tracking delay expiry handling, ownership checks, and policy enforcement.
- Impact appears as service outages, slower cryptographic response, and reduced confidence in the trust fabric supporting applications and machine identities.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Certificate visibility is now a governance control, not an inventory nicety: The article shows that organisations cannot modernise PKI if they do not know where certificates live or who owns them. That is an identity governance problem because certificates are machine trust credentials, and incomplete visibility turns lifecycle management into guesswork. Practitioners should treat current inventory as the prerequisite for every downstream PKI decision.
Machine identity growth is turning certificate sprawl into trust debt: The more certificates accumulate across cloud, software, and device estates, the more manual tracking conceals expiration, ownership, and revocation risk. The survey's concern about outages reflects a structural problem, not a temporary backlog. The practitioner conclusion is that trust debt must be measured and reduced before modernization efforts can be credible.
Centralisation is becoming the only scalable certificate governance pattern: The article's emphasis on centralized management, automation, and crypto-agility reflects where the market is heading. Distributed ownership can still exist, but policy, issuance, and renewal oversight need a single control plane. For identity teams, that means PKI modernisation should be designed as lifecycle governance across the machine estate, not as a collection of local fixes.
AI-era trust expands the certificate problem beyond traditional PKI users: The article notes that PKI is moving into securing AI systems, which raises the stakes for certificate accuracy and lifecycle discipline. That widens the audience for certificate governance from infrastructure teams to AI, platform, and security teams. Practitioners should align certificate controls with the systems that now depend on them for runtime trust.
Visibility blind spots are the named concept organisations should operationalise against: A visibility blind spot is the gap between certificate existence and certificate governance. It matters because every missing certificate in the inventory weakens renewal, revocation, and resilience decisions. The field should use that concept to frame executive risk discussions and justify lifecycle automation investments.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Machine Identity, PKI and Certificate Lifecycle Guide
What this signals
Visibility blind spots are now a machine identity governance problem: PKI teams are not just managing certificates, they are managing the trust credentials that keep applications, devices, and AI systems running. When visibility is incomplete, the organisation loses the ability to prove who owns what and when it will expire, which is why lifecycle automation has become the baseline control.
Certificate sprawl is the operational symptom, not the root cause: The article points to fragmented ownership, manual tracking, and distributed deployments as the conditions that turn normal certificate growth into outage risk. The practical signal for practitioners is that certificate governance should be integrated into broader identity lifecycle management, not treated as a separate admin function.
For practitioners
- Define a current certificate inventory baseline Build one authoritative view of all certificates, owners, expiry dates, and deployment locations across infrastructure, applications, and devices.
- Eliminate spreadsheet-based tracking Replace manual tracking methods with automated discovery and lifecycle workflows so renewal and revocation are driven from current data.
- Assign ownership for every certificate Require named business or technical owners for each certificate so no renewal, revocation, or policy exception sits without accountability.
- Shorten renewal risk windows Use automation to detect certificates approaching expiry and route renewals before service interruption becomes likely.
- Plan crypto-agility for AI and quantum pressure Review where certificates support AI systems and where future cryptographic changes would create operational disruption if handled manually.
Key takeaways
- Incomplete certificate visibility creates a governance gap that undermines renewal, revocation, and policy enforcement across modern PKI estates.
- The survey points to outage risk, certificate sprawl, and manual tracking as the main symptoms of a trust model that no longer scales.
- Centralised policy and automation are the practical response when certificate lifecycles, machine identities, and cryptographic change all move faster than human review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Shrinking lifespans make unmanaged certificates behave like long-lived credentials. |
| NHI-01 — Improper Offboarding | Certificates without owners or retirement paths create the same lifecycle risk as orphaned NHIs. | |
| Recommendation — Inventory certificate lifetimes and replace manual renewal paths with automated rotation before expiry. Revoke and retire certificates through a defined offboarding process when systems or services are decommissioned. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate issuance, renewal, and revocation are authenticator lifecycle controls. |
| Recommendation — Apply authenticator management controls to centralise certificate renewal, revocation, and exception handling. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | Expired or unmanaged certificates can enable trust abuse and service disruption. |
| Recommendation — Map certificate governance gaps to credential access and impact scenarios in detection and resilience planning. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificate governance depends on current permissions, ownership, and authorization records. |
| Recommendation — Use entitlement governance to keep certificate ownership and renewal authority current across the estate. | ||
Key terms
- Certificate Visibility: Certificate visibility is the ability to see what certificates exist, where they are used, who owns them, and when they will expire or renew. Without it, automation can speed up the wrong actions just as easily as the right ones, especially in hybrid environments.
- PKI modernisation: PKI modernisation is the shift from manual, legacy certificate operations to managed, automated, and more visible certificate governance. It matters because the value is not only lower cost, but tighter control over expiry, ownership, and trust boundaries across the environment.
- Certificate Sprawl: Certificate sprawl is the uncontrolled growth of certificates across systems, services, and environments. It creates operational risk because each certificate becomes another trust object that can expire, duplicate, or remain unowned, making outages and governance failures more likely.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org