DigiCert patents point to the next phase of digital trust

At a glance

What this is: DigiCert’s patent update says digital trust is broadening beyond certificates into AI, IoT, encryption, and quantum security, with 32 filings in FY24.

Why it matters: IAM and NHI teams should treat trust, certificate lifecycle, and machine-identity governance as one programme boundary, because the control surface is converging rather than staying in separate silos.

By the numbers:

• DigiCert started the year with a goal of submitting 20 patents.
• DigiCert filed 32 patents by the end of FY24.
• DigiCert said it exceeded its initial patent target by 160%.

Context

Digital trust is the set of controls that let people, systems, and devices verify each other, protect data in transit and at rest, and keep transactions authentic over time. In this article, DigiCert argues that the trust problem is no longer limited to TLS and PKI; it now spans certificates, IoT, content verification, encryption, machine learning and AI, and quantum-safe cryptography.

For identity practitioners, that matters because certificate lifecycle, workload identity, device trust, and AI-era assurance are increasingly interdependent. A programme that still treats these as separate workstreams will miss how issuance, verification, and cryptographic resilience now form one operational control plane.

Key questions

Q: How should security teams govern digital trust across human and machine identities?

A: Security teams should treat digital trust as a shared governance model across human identities, service identities, workloads, and devices. That means one inventory for certificates and keys, clear ownership for renewal and revocation, and access policies that reflect where trust is actually created and consumed. The goal is alignment, not separate control planes.

Q: When should organisations prioritise post-quantum upgrades over routine certificate maintenance?

A: Prioritise post-quantum upgrades when systems protect sensitive data, mission-critical services, or public key based authentication and signatures. The most exposed assets should move first, especially where long-lived cryptography or embedded certificates would be hard to replace later. A risk-based order helps teams avoid treating quantum readiness as a purely theoretical exercise.

Q: What breaks when certificate governance is separated from workload and device identity?

A: Separation creates blind spots in ownership, expiry handling, and trust assurance. A certificate may be renewed on time while the workload or device it authenticates is misconfigured, orphaned, or no longer aligned to the business process it supports.

Q: What is the difference between digital identity and PKI in online trust?

A: Digital identity answers who or what is trying to access a system, while PKI provides the cryptographic framework that proves it and protects the exchange. Identity relies on credentials, attributes, and behavior to establish trust signals. PKI then uses certificates and key pairs to authenticate parties, encrypt traffic, and support integrity and non-repudiation in digital interactions.

Technical breakdown

How digital trust expands beyond PKI

Digital trust used to be framed mainly as certificate issuance and TLS protection. This article shows a wider model: authenticated transactions, tamper-evident records, content verification, and device assurance now sit beside classic PKI. That shift matters because trust is no longer a single protocol control. It is a layered property created by identity binding, cryptographic assurance, and workflow governance across systems that exchange data and decisions.

Practical implication: Map trust controls across certificates, device identity, and content verification instead of treating PKI as the whole programme.

Why AI and machine learning change trust governance

When machine learning and AI enter the trust stack, the problem is not only encryption. It becomes whether the system can keep producing reliable decisions and verifiable records as inputs, models, and workflows change. That moves trust from a static property of a certificate or key to a governance problem that includes model reliability, decision provenance, and the integrity of machine-assisted processes.

Practical implication: Review where AI-assisted decisions depend on cryptographic trust and make provenance part of the control model.

What quantum security means for certificate and key planning

Quantum-safe planning is not just a future cryptography topic. It affects today’s inventory, algorithm choices, and migration assumptions because long-lived certificates and sensitive records may outlive current primitives. The operational issue is deciding which trust assets must be re-architected first and where cryptographic agility is needed so future migration does not become a crisis.

Practical implication: Inventory long-lived certificates and sensitive systems now so cryptographic agility is built into migration planning.

NHI Mgmt Group analysis

Digital trust is converging into one governance domain. The article’s patent themes show that certificates, IoT, content verification, encryption, AI, and quantum security are no longer separate conversations. Practitioners should read that as a sign that trust architecture is becoming cross-domain rather than point-solution driven. The implication is that identity, cryptography, and verification policy need one governance model, not scattered owners.

Certificate lifecycle is still the anchor, but it is no longer the full story. PKI remains central because it gives systems a way to establish cryptographic trust, yet the article places that inside a larger set of assurance problems. That includes workflow integrity, secure deployment, and trust in connected devices and content. Teams that only track issuance and expiry are already behind the real control surface.

AI-era trust turns assurance into a provenance problem. Once machine learning and AI are part of the trust chain, the question is not just whether data is encrypted. It is whether the data, model inputs, and resulting actions can be trusted and explained across automated workflows. Practitioners should treat AI trust as part of identity and cryptographic governance, not as a separate innovation track.

Quantum readiness is a lifecycle issue, not a lab exercise. The article’s quantum focus signals that long-lived trust assets will need migration planning long before quantum attacks are operationally urgent. That makes cryptographic agility, certificate inventory, and lifecycle ownership the practical control points. The conclusion for security leaders is simple: post-quantum planning belongs in mainstream identity and certificate governance now.

Identity teams should expect convergence across humans, workloads, and devices. The same assurance logic increasingly applies whether the subject is a person, a machine, or an AI-supported process. That convergence does not eliminate specialised controls, but it does require shared policy language across IAM, NHI, and certificate programmes. Practitioners should align governance structures before the tooling landscape forces the issue.

From our research library:

• 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.

What this signals

Digital trust is becoming a control-plane issue: the practical boundary is no longer just certificate issuance, but how identity, encryption, and verification decisions are governed across systems. For IAM and NHI teams, that means lifecycle ownership has to span workloads, devices, and AI-assisted workflows rather than stopping at the PKI team.

The strongest programme response is to treat cryptographic agility as an operating requirement, not a future project. Long-lived trust assets create migration pressure later, so certificate inventory, renewal logic, and post-quantum readiness should be governed together now.

For practitioners

• Map trust domains to one governance model Inventory where certificates, devices, AI workflows, and content verification are managed today, then assign common ownership for identity binding and assurance policy.
• Review certificate lifecycle dependencies Document which applications, devices, and workloads depend on long-lived certificates so expiry, renewal, and revocation are governed as business-critical events.
• Build cryptographic agility into roadmaps Identify systems that would be hardest to migrate to post-quantum algorithms and prioritise them for redesign before refresh cycles lock in technical debt.
• Bring AI trust into identity governance Include machine-learning and AI-assisted workflows in assurance reviews so provenance, decision integrity, and cryptographic trust are assessed together.

Key takeaways

• Digital trust now spans certificates, IoT, content verification, encryption, AI, and quantum resilience, so siloed ownership no longer matches the control problem.
• The article’s FY24 patent count shows that the trust surface is expanding faster than traditional PKI-only governance models can comfortably absorb.
• Security teams should align certificate lifecycle, workload identity, and cryptographic migration planning under one governance model before the next refresh cycle locks in risk.

Key terms

• Digital Trust: Digital trust is the set of cryptographic and identity controls that allow systems, users, and services to verify each other reliably. It includes PKI, federation, certificates, and authentication foundations that must remain adaptable as technologies and threat conditions change.
• Cryptographic agility: The ability to change cryptographic algorithms, key lengths, or trust models without reworking every application. For machine identities, it reduces the risk that long-lived services will fail when standards shift or when post-quantum migration becomes necessary.
• Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
• Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.