TL;DR: PKI operating costs are often far higher than organisations expect, with a Forrester model showing $12.7 million in three-year benefits and a 356% ROI from modernisation against $2.8 million in costs, according to Keyfactor. The practical lesson is that certificate lifecycle automation, not manual administration, is now the decisive control for scale and cost.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Keyfactor's blog post: PKI is becoming more expensive to run, with the biggest costs tied to manual certificate operations and legacy infrastructure.
Why it matters: It matters because IAM, PAM, and NHI teams need to treat certificate lifecycle work as a governance and operating-cost problem, not just a technical maintenance task.
By the numbers:
- The Forrester model cited by Keyfactor found $12.7 million in benefits against $2.8 million in costs over three years.
- Manual certificate provisioning takes 90 minutes, while automated provisioning takes 2 minutes.
- The CA/Browser Forum is moving toward 47-day TLS certificate lifespans by 2029.
Context
PKI cost is not driven only by software or hardware. It is driven by the certificate lifecycle itself, which expands as certificate counts rise and renewal cycles accelerate across websites, devices, workloads, and internal services.
For identity and access teams, this is a governance issue as much as an infrastructure one. Certificate management is part of workload identity and NHI operations, so manual handling now creates cost, fragility, and scale pressure in the same control plane.
The article frames PKI modernisation as a business case problem, not a tooling story. That is consistent with enterprise environments where certificate sprawl and renewal churn are starting to outgrow manual operating models.
Key questions
Q: What happens when certificate renewals are still handled manually at enterprise scale?
A: Manual renewal processes tend to break under volume. As certificate counts grow, teams miss expirations, updates become inconsistent across environments, and service disruptions become more likely. The result is avoidable downtime, wasted IT effort, and a higher chance that security controls will age out unnoticed. At enterprise scale, manual certificate handling is a reliability risk, not just an administrative burden.
Q: Why do shrinking TLS certificate lifespans raise PKI cost so sharply?
A: Shorter lifespans multiply the number of renewal events every year, which means the same certificate estate generates far more human work. If renewal remains manual, cost rises in step with frequency, not just with total certificate count.
Q: How should teams decide where PKI automation comes first?
A: Start with the certificate families that combine high renewal frequency, broad service dependency, and poor ownership clarity. Those are the areas where missed renewals are most likely to create outage exposure and where automation usually returns value fastest. Prioritisation should follow business impact and trust criticality, not just certificate count.
Q: What should IAM teams do when public certificates are being used internally?
A: They should test whether those internal services truly require public trust or whether private issuance can meet the same operational need at lower recurring cost. The decision should be based on trust scope, governance, and lifecycle overhead, not habit.
Technical breakdown
Why certificate renewal dominates PKI operating cost
Certificate renewal becomes the dominant cost because it repeats across the largest installed base and requires coordination at issuance, distribution, deployment, and replacement. When lifespans shorten, the renewal workload multiplies even if the environment itself does not grow. That makes certificate management a lifecycle problem, not a one-time provisioning task. The more fragmented the estate, the more time is spent on exceptions, scheduling, validation, and remediation rather than policy. In enterprise PKI, the labour burden is usually the real scaling constraint, not cryptography itself.
Practical implication: Track renewal volume as a core operating metric, not just an administrative task.
How legacy PKI infrastructure drives hidden cost
Legacy PKI often carries costs that stay invisible in budget lines until the environment is mapped end to end. CA servers, HSMs, licences, and dedicated staff create a fixed baseline before any certificate operations are counted. As estates grow, that baseline is amplified by support effort and infrastructure sprawl. The result is that PKI can appear stable on paper while quietly consuming more labour and platform spend each year. In practice, the cost structure punishes fragmented ownership and manually maintained infrastructure more than it punishes certificate volume alone.
Practical implication: Baseline your CA, HSM, licensing, and staffing costs together so the real operating model is visible.
Why certificate volumes turn PKI into an NHI governance problem
Certificates are a machine identity primitive, so their economics are tied to governance over non-human identity lifecycles. As workloads, devices, and internal services multiply, the certificate estate becomes a governed identity population with renewal, rotation, and deployment obligations. Without automation, each certificate adds recurring operational friction and increases the chance of mis-issuance or expiry-related outages. This is where PKI stops being an isolated crypto function and becomes part of NHI control design. The business case is strongest when certificate lifecycle work is treated as identity infrastructure, not a side process.
Practical implication: Treat certificate lifecycle ownership as part of NHI governance and service reliability.
Threat narrative
Attacker objective: The practical objective of the risk is not covert compromise but operational depletion, where identity teams lose efficiency and resilience as certificate workloads grow.
- Entry occurs through scale pressure, as growing certificate estates and shorter lifespans create more renewal events than manual teams can handle consistently.
- Escalation follows when certificate tasks consume engineering time that should be reserved for higher-value identity and infrastructure work, increasing operational drag and error risk.
- Impact appears as higher operating cost, more renewal exposure, and greater outage risk when certificate lifecycles outpace human administration capacity.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
PKI cost is now a lifecycle governance problem, not a tooling line item. The article shows that the real burden sits in repetitive renewal, deployment, and exception handling rather than in cryptography itself. That shifts the decision from platform preference to operating model design. Practitioners should evaluate PKI as part of identity lifecycle control.
Certificate sprawl creates identity debt in the machine estate. Every additional certificate adds recurring work across issuance, distribution, renewal, and replacement. Shorter TLS lifespans make that debt compound faster, especially where ownership is split across teams. The practical consequence is that unmanaged certificate growth becomes a structural drag on workload identity programmes.
Manual PKI operations no longer scale with enterprise certificate volumes. The article’s cost model makes clear that staffing does not expand cleanly enough to absorb renewal churn, especially as certificate counts rise. This is where lifecycle automation becomes an operational requirement rather than an optimisation project. Practitioners should expect manual control to fail first at renewal scale.
Renewal frequency shock: The move toward 47-day certificate lifespans means the old assumption that certificate renewal is occasional is breaking. That assumption was designed for slower certificate turnover and long-lived operational windows. It fails when renewal becomes a recurring, high-frequency identity event, so leadership must rethink how certificate governance is staffed and measured.
PKI modernisation is increasingly about business continuity and cost control. The article ties ROI to infrastructure consolidation, labour reduction, and fewer certificate-related outages. That matters because certificate management failures now affect both operational reliability and spend discipline. Practitioners should present PKI as a resilience and cost governance issue, not a narrow engineering refresh.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Read next: Machine Identity, PKI and Certificate Lifecycle Guide
What this signals
Certificate lifecycle automation is becoming the control that separates manageable PKI from operational debt. As TLS lifespans shorten, renewal cadence becomes a staff planning issue, not just a certificate policy issue. That means identity programmes should measure certificate work as part of operational load, with special attention to renewal-heavy estates and machine identity ownership.
Machine identity economics now influence zero trust execution. If certificates authenticate workloads, devices, and services, then the cost of maintaining those identities affects how quickly zero trust can scale in practice. A programme that cannot sustain its certificate lifecycle will struggle to sustain its trust model.
Public certificate premium: The article shows that some organisations are paying more than necessary because internal services still consume public certificates where private issuance would suffice. That creates avoidable spend and adds governance complexity, especially when certificate ownership is split across infrastructure and application teams.
For practitioners
- Map certificate lifecycle labour by workflow Quantify provisioning, renewal, deployment, and exception handling time separately so the highest-cost workflow is obvious.
- Inventory the full PKI operating baseline Include CA servers, HSMs, licensing, and dedicated PKI staff in one view so the infrastructure cost is not undercounted.
- Prioritise automation for renewal-heavy estates Focus first on the certificate population with the highest renewal frequency and the most manual touchpoints, because that is where labour savings and outage reduction will be most visible.
- Reclassify public-vs-private certificate spend Identify internal use cases still using public certificates and test whether private issuance can reduce recurring cost without weakening trust requirements.
- Model the 47-day lifespan impact Recalculate staffing and control workload against shorter TLS renewal cycles so the organisation can see where manual operations stop being viable.
Key takeaways
- PKI cost is rising because manual certificate work scales poorly as certificate volumes grow and renewal windows shrink.
- The strongest cost pressure comes from recurring lifecycle tasks, not from cryptography itself or from licence spend alone.
- Organisations that want sustainable PKI need to treat certificate automation, ownership, and renewal frequency as governance controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Short-lived TLS certificates and renewal volume make secret lifespan a core cost driver here. |
| NHI-05 — Overprivileged NHI | Public certificates used internally can signal broader trust scope and unnecessary cost exposure. | |
| Recommendation — Reduce renewal burden by shortening unmanaged certificate lifetimes and standardising lifecycle ownership. Reassess internal certificate trust scopes and remove broader public issuance where private trust suffices. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate issuance, renewal, and revocation are authenticator lifecycle controls in PKI operations. |
| Recommendation — Apply authenticator management controls to govern certificate issuance, renewal, rotation, and retirement. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificate-based access depends on controlled entitlements and service identity authorisation. |
| Recommendation — Review service certificate entitlements so identity scope matches the intended trust boundary. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Expired or mismanaged certificates can expose credential-like access paths and operational weaknesses. |
| Recommendation — Map certificate lifecycle failures to credential access risk and prioritise renewal-critical assets. | ||
Key terms
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- PKI Operating Baseline: The PKI operating baseline is the fixed cost of keeping certificate authority infrastructure available, staffed, and licensed before certificate work is counted. It usually includes servers, HSMs, software licences, and specialist labour, and it often hides the true cost of legacy PKI.
- Renewal Churn: Renewal churn is the recurring operational load created when certificates must be replaced frequently across large estates. As certificate lifespans shorten, renewal churn becomes a scaling problem that drives labour cost, outage risk, and governance pressure.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org