TL;DR: Equifax’s 76-day breach showed how an expired digital certificate on a network device can disable vulnerability scanning, delay detection, and contribute to massive PII exposure, according to DigiCert’s analysis. The lesson is that certificate lifecycle management is not housekeeping; it is a control for visibility, continuity, and breach containment.
At a glance
What this is: This is a DigiCert analysis of the Equifax breach showing how an expired certificate on a network device created a visibility failure that helped attackers stay hidden for 76 days.
Why it matters: It matters because certificate lifecycle management is part of governance, not administration, and IAM teams need centralized visibility to prevent blind spots that turn into prolonged exposure.
By the numbers:
- The breach lasted 76 days while attackers stole personally identifiable information from multiple databases.
- The stolen information affected more than 150 million Americans.
- DigiCert says the company paid $575 million in FTC fines alone.
Context
Certificate visibility is the difference between knowing a credential is expiring and discovering it only after a control fails. In this case, the underlying governance gap was not merely an expired certificate, but the absence of centralized inventory and ownership across the certificate estate.
Equifax is the kind of failure mode that shows up when certificate lifecycle management is treated as a narrow PKI task instead of an identity governance discipline. When certificates are scattered across business units, spreadsheets and point tools, the organisation loses the ability to enforce policy, renew on time, and sustain dependent security functions such as vulnerability scanning.
That makes this a human IAM adjacent governance lesson as much as a machine identity lesson. The issue is lifecycle control over machine-held trust material, and the operational impact lands on detection, continuity, and breach containment.
Key questions
Q: What breaks when certificate visibility is missing in a large enterprise?
A: When certificate visibility is missing, teams lose reliable ownership, renewal timing and dependency mapping. That means an expired certificate can disable a security control such as vulnerability scanning long before anyone notices, turning a routine lifecycle miss into a prolonged exposure window.
Q: Why do expired or misissued certificates create more than an availability problem?
A: Because a certificate is a trust assertion, not just a connectivity setting. If it expires, is misissued, or no longer matches the intended domain, the service may still be reachable while trust is broken. That can undermine compliance, customer confidence, and the integrity of protected transactions.
Q: How should teams prioritise certificate lifecycle management over manual administration?
A: Teams should prioritise lifecycle management when certificate populations are too large for spreadsheets and ad hoc reminders. Central discovery, ownership and renewal workflows reduce the chance that critical certificates expire unnoticed across business units and hybrid environments.
Q: Who is accountable when a certificate expires and enables a breach?
A: Accountability should sit with the team that owns certificate governance, not only with the administrator who notices the expiry. In mature programmes, PKI, identity governance, and the business system owner all share responsibility for inventory, renewal, and risk acceptance. If ownership is unclear, the control model has already failed.
Technical breakdown
How expired certificates break visibility controls
A certificate is a trust object that allows a device, service or application to authenticate and communicate securely. When it expires, dependent systems may stop functioning even if the network path itself remains intact. In the Equifax case, the expired certificate on a network tracking device prevented vulnerability scanning from running, which removed a detection layer that should have surfaced hostile activity. This is why certificate lifecycle management is not only about renewal dates. It is about preserving the control plane that other security functions depend on.
Practical implication: Treat certificate expiry as a control outage, not a routine maintenance event.
Why centralized inventory matters for certificate lifecycle management
Centralized visibility means the organisation can discover, classify and track every certificate in one authoritative inventory. Without that inventory, certificate ownership fragments across business units, admins and local scripts, and expiry notices can reach the wrong people or nobody at all. The problem is not just missed renewals. It is that no one can reliably answer where certificates are, who owns them, what they support, and which ones are already outside policy. That is a governance failure, not an operational nuisance.
Practical implication: Build one authoritative certificate inventory and tie each certificate to a clear owner and renewal path.
What certificate sprawl means for PKI and NHI governance
Modern certificate estates scale into the hundreds of thousands, especially in environments with websites, web services, containers and microservices. At that scale, manual tracking cannot sustain accurate lifecycle governance. The NHI angle is that certificates are non-human identities with lifecycle, ownership and revocation requirements, even when teams still treat them as infrastructure artefacts. Once certificate sprawl outpaces governance, expired trust material becomes both a resilience issue and an exposure issue.
Practical implication: Use lifecycle controls that scale with certificate sprawl instead of relying on spreadsheet-driven oversight.
Threat narrative
Attacker objective: The attackers sought to steal sensitive personal and financial information while avoiding detection long enough to extract data at scale.
- Entry into the environment was enabled by a network device whose certificate had already expired, leaving a critical scanning function unavailable.
- Credential or trust material failure prevented the device from performing vulnerability scanning, so attackers were able to operate without that detection layer.
- Escalation occurred as intruders moved through the network undetected and collected PII from multiple databases over an extended period.
- Impact culminated in a 76-day breach affecting more than 150 million Americans and triggering major regulatory fines.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Certificate visibility is a governance control, not an operations detail. The Equifax case shows that once certificate inventory is fragmented, the organisation loses the ability to govern expiration, ownership and dependency risk. The real failure was not the missed renewal alone, but the inability to see the certificate in time to preserve a security control. Practitioners should treat certificate visibility as part of identity governance, not as a back-office PKI chore.
Centralised inventory is the control that determines whether lifecycle policy can exist at all. Spreadsheets and local scripts cannot reliably surface the full certificate estate across business units. That means policy compliance becomes accidental rather than enforceable, and a single expired certificate can outlive the team that should have renewed it. For practitioners, the lesson is that lifecycle governance begins with authoritative discovery.
Certificate sprawl creates an identity governance blind spot that traditional manual review cannot close. When certificate populations reach the hundreds of thousands, renewal responsibility, alert routing and dependency mapping all become failure points. The governance challenge is not simply more certificates, but more distributed trust relationships than local owners can manage consistently. That is why certificate lifecycle management must be treated as an enterprise control surface.
The named concept here is certificate visibility debt: the gap between where trust material exists and where governance can actually see it. Equifax demonstrates that this debt compounds until a routine expiry disables a security function and extends attacker dwell time. The implication is that practitioners must rethink how trust assets are inventoried, owned and governed across the enterprise.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Certificate Lifecycle Management Buyer's Guide
What this signals
Certificate lifecycle issues are now governance issues because the control surface includes every machine-held trust object that can expire, drift or disappear from view. When visibility breaks, renewal becomes reactive and the organisation starts managing outages instead of trust.
Certificate visibility debt: the longer an enterprise runs with partial inventory, the more likely a routine expiration will disable a dependent control before anyone can intervene. IAM and PKI teams should treat this as a lifecycle governance problem that demands authoritative ownership and discovery.
For practitioners, the practical test is simple: if a certificate expires today, can you tell which service, device or detection control fails with it. If the answer is no, the programme still lacks operational visibility.
For practitioners
- Establish one certificate inventory Create a single authoritative register for all certificates across business units, devices and services. Tie each certificate to an owner, a dependency and a renewal path so expiry cannot hide behind local spreadsheets or siloed tools.
- Map certificates to dependent controls Identify which security functions rely on each certificate, especially scanning, monitoring and service authentication. If a certificate expires, you should know exactly which detection or availability control fails with it.
- Replace manual renewal workflows Move away from alert-by-email and spreadsheet-driven maintenance for enterprise certificate estates. Use lifecycle processes that can discover expiring certificates before the dependent system loses function.
- Assign accountable certificate ownership Make business unit owners accountable for certificates they request or operate, while central PKI teams retain governance oversight. Without named ownership, expiry alerts and policy exceptions are easy to miss.
Key takeaways
- The Equifax case shows that certificate expiration can become a governance failure when organisations cannot see or own their trust inventory.
- The breach persisted for 76 days and affected more than 150 million Americans, which is strong evidence that missed lifecycle control can magnify impact.
- Centralised certificate visibility and clear ownership are the controls that keep expired trust material from disabling security functions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The expired certificate stayed in place because it was not discovered and removed from use on time. |
| NHI-07 — Long-Lived Secrets | The article centres on long-lived certificate trust material that outlived its valid lifecycle window. | |
| Recommendation — Track certificate retirement with the same rigor as offboarding and revoke expired trust material immediately. Reduce reliance on long-lived certificates by enforcing shorter renewal and rotation cycles. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate renewal and replacement are authenticator lifecycle controls under IA-5. |
| Recommendation — Apply IA-5 to govern certificate issuance, renewal, replacement and revocation across the estate. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificate visibility supports enforcement of who and what can authenticate in the environment. |
| Recommendation — Use PR.AA-05 to keep machine authentication entitlements visible and aligned to current ownership. | ||
| MITRE ATT&CK | TA0006;TA0007 — Credential Access; Discovery | The breach shows how a trust failure can enable undetected access and blind defenders to discovery activity. |
| Recommendation — Map certificate blind spots to credential access and discovery detections that reveal hidden attacker movement. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Certificate Visibility: Certificate visibility is the ability to see what certificates exist, where they are used, who owns them, and when they will expire or renew. Without it, automation can speed up the wrong actions just as easily as the right ones, especially in hybrid environments.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- pnPKI: The Philippine National Public Key Infrastructure is the government-backed framework for issuing and managing digital certificates used in authentication, encryption, and legally recognised signatures. It relies on asymmetric cryptography, certificate lifecycle controls, and trusted certificate authorities to support high-assurance, non-repudiable transactions in regulated Philippine workflows.
Deepen your knowledge
NHI governance, machine identity security, and identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org