DigiCert’s 2025 security predictions point to trust automation

At a glance

What this is: DigiCert's 2025 security predictions argue that digital trust is moving toward automation, crypto-agility and provenance controls as PQC, AI-driven phishing and shorter certificate lifespans reshape operations.

Why it matters: IAM, NHI and platform teams need to treat certificate and trust lifecycle management as an operational control plane, not a periodic admin task, because manual processes are no longer keeping pace.

By the numbers:

• 23.53% of respondents said certificates are managed via manual effort such as spreadsheets.

Context

Digital trust now behaves like an identity problem with a faster clock. Certificates, cryptographic dependencies, content provenance and AI-enabled deception all shift the burden from periodic administration to continuous governance.

That matters because certificate lifecycles, private PKI choices and phishing resilience sit across NHI, human IAM and workload trust. When those controls remain manual, organisations inherit longer exposure windows than their operating model can justify.

DigiCert's predictions are therefore best read as a governance signal, not a product story. The common thread is that trust operations are becoming too dynamic for spreadsheet-era controls.

Key questions

Q: What breaks when certificate management still depends on spreadsheets?

A: Spreadsheets can track data, but they cannot execute the renewal process or enforce accountability. When cadence shrinks, the failure mode is stale ownership, delayed replacement, and missing exception control. The result is operational instability, not just administrative inconvenience.

Q: When should organisations prioritise crypto-agility over a full algorithm swap?

A: They should prioritise crypto-agility whenever their estate includes many dependent applications, vendors, or certificate chains, because replacement will be slower than a simple technology refresh. Crypto-agility reduces outage risk by allowing phased updates. It is the practical path when the board needs resilience now and the migration timeline is long.

Q: How should security teams respond to AI-generated phishing campaigns?

A: Security teams should assume the message quality will be good enough to fool users and focus on reducing what a successful click can do. That means phishing-resistant MFA, stronger mailbox recovery checks, tight privilege scopes, and rapid session revocation. If the attacker cannot convert a click into useful identity access, the campaign loses much of its value.

Q: How do teams know whether trust automation is actually working?

A: They should measure renewal success rates, expiry exceptions, revocation latency, and the percentage of certificates still handled manually. If those signals are not improving, the programme is still exposed to the same lifecycle failures it was meant to remove.

Technical breakdown

Why shorter certificate lifespans force trust automation

Shorter SSL/TLS certificate lifespans compress the time available for discovery, renewal and revocation. That changes certificate management from a calendar task into a lifecycle control problem, because every expiry event becomes an availability risk and every missed rotation becomes an authentication failure. In practice, the harder part is not issuance. It is maintaining inventory, ownership and dependency awareness across applications, APIs, devices and service identities. Once the lifecycle shortens, the organisation needs reliable automation to prevent outages and orphaned trust paths.

Practical implication: map every certificate to an accountable owner and automate renewal before expiry becomes an operational incident.

What crypto-agility means when post-quantum cryptography arrives

Crypto-agility is the ability to change cryptographic algorithms, keys and trust chains without redesigning the service. Post-quantum cryptography matters because the migration path will involve mixed estates, hybrid trust chains and staged policy changes rather than a clean cutover. That creates a governance challenge for identity teams, because certificates, authentication flows and trust stores all have to move in step. If crypto choices are embedded too deeply in platforms, the organisation loses the ability to respond at the pace that standards and threat models demand.

Practical implication: inventory where cryptography is hard-coded and prioritise systems that cannot swap algorithms without application change.

How AI-driven phishing changes human identity assumptions

AI-driven phishing does not merely increase volume. It raises the quality of social engineering by making impersonation, context matching and timing more convincing at scale. That weakens controls that assume human recipients can reliably spot unusual language or formatting. The risk is especially acute where authentication journeys still depend on user vigilance rather than phishing-resistant controls. Human identity programmes therefore have to treat deception as a systemic threat vector, not a training failure, and align authentication design with the reality of high-fidelity attacks.

Practical implication: reduce dependence on human recognition and move critical access paths toward phishing-resistant authentication.

NHI Mgmt Group analysis

Trust automation is now an identity governance requirement, not an efficiency preference. DigiCert's forecast shows certificate lifecycles, trust policy and provenance checks moving faster than manual control loops can absorb. The implication is that identity programmes must stop treating certificates as isolated infrastructure artefacts and start governing them as part of the broader identity plane.

Manual certificate management is the last visible symptom of a larger lifecycle gap. The cited 23.53% manual-management figure is not just an operations metric. It shows that a significant share of enterprises still depend on spreadsheet-era ownership, which cannot reliably support expiry pressure, revocation discipline or cross-environment inventory. Practitioners should read this as a maturity gap in lifecycle accountability.

Crypto-agility is the named concept that will separate prepared trust estates from brittle ones. The article points to shorter lifespans, PQC and CBOM adoption as forces that make cryptographic change routine rather than exceptional. The governance implication is that organisations need to know where cryptography is embedded, who owns it and how quickly it can be changed when standards shift.

AI-driven phishing is raising the bar for human identity assurance. The attack surface is no longer only credential theft, but also highly believable pretexting that can defeat user judgement. That means identity programmes have to pair stronger authentication with a realistic model of deception, especially where privileged access or sensitive approvals still depend on human decisions.

Content provenance is becoming part of identity trust, not a separate media problem. The article's C2PA prediction reflects a broader shift toward verifying source integrity across digital interactions. For practitioners, that means trust frameworks increasingly need to span people, devices, workloads and content flows rather than stopping at authentication alone.

What this signals

Crypto-agility is the operating condition that will matter most as PQC migration accelerates. Teams should assume cryptographic change will become a recurring programme rather than a one-time project, which means the real question is whether they can reissue trust artefacts without service disruption.

Manual certificate work and human-dependent phishing defence are different symptoms of the same governance problem: trust decisions are happening faster than the controls around them. Identity programmes that still rely on periodic review cycles will need to shift toward continuous ownership, continuous inventory and continuous verification.

For practitioners

• Automate certificate ownership and renewal Build a complete inventory of public and private certificates, map each one to an owner, and eliminate renewal workflows that depend on calendar reminders or manual spreadsheets.
• Identify where cryptography is hard-coded Review applications, trust stores and platform dependencies for embedded algorithms and libraries that cannot change without code modification, then rank them for crypto-agility remediation.
• Harden human identity flows against AI phishing Prioritise phishing-resistant authentication for access paths where a convincing impersonation could lead to privileged approval, account recovery or session takeover.
• Add provenance checks to trust decisions Treat content provenance, software provenance and trust signals as part of the same governance picture so that digital authenticity is verified before it influences action or distribution.

Key takeaways

• The article's central risk is not any single prediction, but the convergence of shorter certificate lifespans, PQC change and AI-enabled deception into a faster trust environment.
• The strongest evidence point is that 23.53% of respondents still manage certificates with manual effort such as spreadsheets, which shows the gap is operational, not theoretical.
• Practitioners should respond by automating trust lifecycle ownership, preparing for cryptographic change and reducing reliance on human recognition in access decisions.

Key terms

• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
• Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
• Content Provenance: Content provenance is the practice of tracking where input came from and how trusted it should be before an AI system uses it. For agents, it helps separate instructions from retrieved or external data so malicious content is less likely to be treated as operational guidance.
• Cryptographic Bill of Materials: A cryptographic bill of materials lists the cryptographic capabilities built into software components, such as supported algorithms and libraries. It is useful for component visibility, but it does not show live configuration, deployment context or actual runtime usage. That makes it a partial input, not the full governance record.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.