TL;DR: Encryption now has to cope with shorter key lifecycles, distributed cloud and AI environments, and the need to swap algorithms without disruption, according to Fortanix. The central challenge is no longer key storage alone but unified governance, automation and crypto-agility across the full encryption lifecycle.
At a glance
What this is: Fortanix argues that modern encryption strategy now depends on crypto-agility and next-generation key management to handle distributed, fast-changing key estates.
Why it matters: This matters to IAM and NHI practitioners because the same lifecycle, inventory and rotation problems that affect human credentials also affect machine keys, certificates and workload trust.
Context
Encryption governance is moving from static protection to continuous lifecycle control. As cloud, edge and AI workloads multiply, keys, certificates and algorithms age at different speeds, and that creates a governance gap when inventory, rotation and policy enforcement remain fragmented.
The identity angle is real here because machine identities, workload credentials and cryptographic keys sit inside the same trust fabric. When keys are scattered across cloud services, CI/CD pipelines and Kubernetes clusters, organisations lose the ability to answer who or what is authenticated, for how long, and under which policy.
The article’s starting position is typical of modern infrastructure, but the failure mode is now common rather than exceptional.
Key questions
Q: How should organisations manage crypto-agility across cloud and AI workloads?
A: Organisations should treat crypto-agility as a lifecycle control, not a one-time migration. The practical goal is to keep keys, certificates and algorithms governable as environments change, with unified inventory, policy-driven rotation and a defined path for algorithm replacement across cloud and AI workloads.
Q: Why does manual key management break down in distributed environments?
A: Manual key handling breaks down because distributed environments create too many keys, too many dependencies and too much change for people to track reliably. When cloud services, pipelines and clusters each manage their own crypto state, stale keys and inconsistent policies persist even when governance looks complete on paper.
Q: What breaks when an organisation has no crypto-agility strategy?
A: Without crypto-agility, teams cannot change algorithms, certificates, or trust anchors quickly when standards or regulations shift. The result is lock-in to legacy dependencies, longer remediation cycles, and higher operational risk during migration. In practice, the environment becomes difficult to adapt without service disruption.
Q: What is the difference between key storage and key lifecycle governance?
A: Key storage protects where a key sits, but lifecycle governance controls how it is issued, used, rotated, revoked and retired. Storage alone does not prevent stale or obsolete keys from remaining active, while lifecycle governance is what keeps cryptographic trust current across systems.
Technical breakdown
Why distributed key estates break legacy governance
Legacy key management assumed a smaller number of keys, slower change, and more predictable platforms. Modern environments generate thousands of keys across cloud services, Kubernetes clusters, SaaS applications and CI/CD pipelines, so inventory, access policy and rotation all become moving targets. When each platform manages keys independently, teams lose the ability to enforce a single governance model and hidden weak points accumulate. The result is not just operational drift but control drift, where policy says one thing and actual key usage says another.
Practical implication: Practitioners need a cross-environment inventory and policy model before they can trust rotation or access controls.
What crypto-agility changes in encryption operations
Crypto-agility is the ability to change algorithms and keys without reworking the whole environment. In practice, that means cryptographic choices are treated as a managed dependency rather than a fixed design decision. This matters because algorithms age, standards shift and long-lived systems need a path to migration. Agility also reduces the risk that outdated encryption remains in service simply because the replacement process is too disruptive. The architectural shift is from static trust in one algorithm to governed change across many systems.
Practical implication: Treat algorithm migration as an operational capability, not a one-off project after a cryptographic deadline appears.
Why PQC readiness depends on discovery and automated migration
Post-quantum cryptography changes the problem from simply updating algorithms to finding every place those algorithms exist. Long-lived keys, archived data, code-signing paths and tokens can all depend on RSA or ECC, so discovery is a prerequisite for migration. Without automated assessment and lifecycle orchestration, teams cannot tell which assets are exposed or which applications need hybrid support during transition. That makes visibility and change control the foundation of PQC readiness, not an afterthought. The practical issue is scope: the weaker the cryptographic inventory, the harder the transition.
Practical implication: Map cryptographic dependencies first, then automate rotation and replacement where legacy algorithms remain embedded.
Threat narrative
Attacker objective: The objective is to preserve access to data or trust relationships by exploiting weak, stale or poorly governed encryption assets.
- Entry begins when cryptographic assets are created and distributed across cloud and application pipelines without unified oversight.
- Escalation happens when weak inventory and manual rotation allow obsolete algorithms or expired keys to remain active across multiple systems.
- Impact occurs when outdated cryptography undermines long-term confidentiality, certificate trust and the ability to migrate safely to stronger standards.
Breaches seen in the wild
- Google API Keys Exposure — Gemini AI: Google API keys exposed in client-side code via Gemini AI integrations, creating data leak risk.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Crypto-agility is becoming a governance requirement, not an optimisation. Encryption estates now change faster than the controls that manage them, especially in cloud and AI-heavy environments. When algorithms, keys and certificates are treated as static assets, governance fails by delay rather than by design. The right question is no longer whether encryption exists, but whether it can be changed safely when the cryptographic baseline moves.
Unified visibility is the control that separates manageable encryption from inherited risk. Siloed KMS deployments and manual rotation create blind spots that no policy document can repair later. This is where the identity intersection matters: workload identities, service credentials and cryptographic keys all depend on the same lifecycle discipline. Organisations that cannot inventory keys across environments also cannot enforce consistent trust boundaries.
Crypto inventory debt: the longer cryptographic assets stay undiscovered, the more expensive every migration becomes. That debt shows up first as slow rotations, then as delayed algorithm replacement, then as exposure to obsolete trust assumptions. In practice, long-lived encryption programs fail when no one can prove where a key is used, who can rotate it, and what breaks if the algorithm changes.
PQC readiness is an operational change-management problem before it is a cryptography problem. Organisations should expect the hardest work to be discovery, dependency mapping and phased migration, not the mathematical replacement itself. That makes NIST-style lifecycle discipline and control mapping more useful than abstract post-quantum messaging. Practitioners should frame PQC as a managed transition across trust domains, not a future-only research topic.
What this signals
Encryption teams are now managing a trust lifecycle, not a vault. The practical shift is from protecting a static secret to governing how cryptographic assets evolve across applications, clouds and deployment pipelines. That means lifecycle evidence, ownership and migration planning matter as much as key custody.
Crypto-agility is the control that makes post-quantum transition survivable. When algorithm changes are inevitable, the programme that can discover dependencies and update them without service disruption will outlast the one that relies on manual change windows. For readers, that makes discovery and automation the near-term priority.
Machine identity and encryption policy are converging. Certificates, service accounts and workload credentials all depend on the same operational discipline of inventory, rotation and revocation. If those controls are fragmented, resilience claims will not hold under a cryptographic transition.
For practitioners
- Build a unified cryptographic inventory Map keys, certificates, algorithms and consuming applications across cloud, edge, CI/CD and SaaS so ownership and policy are visible in one place.
- Automate rotation and revocation workflows Remove manual key handling where possible and enforce rotation, revocation and retirement through policy-driven lifecycle controls.
- Prioritise algorithm migration paths Identify RSA and ECC dependencies, then define a phased transition plan for hybrid and post-quantum replacements before deadlines force emergency change.
- Tie encryption policy to DevOps pipelines Embed key issuance and algorithm rules into application delivery so new workloads inherit approved crypto settings from the start.
Key takeaways
- Distributed cloud and AI environments have made encryption governance a lifecycle problem, not just a storage problem.
- Crypto-agility matters because organisations need to change algorithms and keys without breaking dependent systems.
- Discovery, automation and policy-driven rotation are the practical controls that reduce cryptographic drift.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-57, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Part 1 — Key Management Lifecycle | The article centres on key lifecycle governance, rotation and retirement across environments. |
| Recommendation — Apply key lifecycle governance to inventory, rotate and retire cryptographic assets across all environments. | ||
| NIST CSF 2.0 | PR.DS-02 — Data-in-Transit is Protected | Encryption strategy is directly about protecting data in transit through managed cryptography. |
| Recommendation — Use managed cryptography to protect data in transit and keep encryption aligned to changing environments. | ||
| CIS Controls v8 | CIS-3 — Data Protection | The article focuses on securing data through stronger encryption governance and lifecycle control. |
| Recommendation — Implement data protection controls that keep encryption, keys and rotation policies consistently enforced. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of Cryptography | Cryptographic use and governance are the central topic of the article. |
| Recommendation — Define cryptographic use rules and maintain them through controlled key and algorithm lifecycle management. | ||
Key terms
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- Key Lifecycle Management: Key lifecycle management is the set of controls that govern cryptographic keys from creation through rotation, revocation, and retirement. It is not just storage protection. It is the operational discipline that keeps keys current, traceable, and removable when trust relationships change.
- Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
- Cryptographic Inventory: A cryptographic inventory is a continuously updated record of keys, certificates, algorithms, libraries and trust anchors across an organisation. It is not a spreadsheet or one-time audit output. In practice, it links each asset to ownership, usage, lifecycle state and risk so teams can make remediation decisions.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore it if your programme now has to govern machine credentials, service identities, and cryptographic trust together.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org