Notifications
Clear all
Topic starter
25/06/2026 2:59 pm
TL;DR: Post-quantum cryptography will move from roadmap item to deployed control, AI-driven phishing will surge, and manual certificate management is becoming unsustainable as shorter lifespans and automation pressures increase, according to DigiCert’s 2025 predictions. The governing issue is no longer awareness but whether identity and trust programmes can operationalise crypto-agility, provenance, and lifecycle control fast enough.
NHIMG editorial — based on content published by DigiCert: 10 ways AI, quantum and trust will shape the year ahead
By the numbers:
- Nearly 25% of enterprises manage their thousands of certificates manually.
- 23.53% of respondents said certificates are managed via manual effort.
Questions worth separating out
Q: How should security teams reduce risk from short-lived certificates and crypto-agility pressure?
A: They should treat certificates as governed identities with owners, expiry monitoring, and automated renewal paths.
Q: Why do AI-generated phishing attacks change human identity controls?
A: They reduce the value of message inspection as a control because attackers can now generate persuasive, context-aware lures at scale.
Q: What should organisations do when digital trust depends on content authenticity as well as identity?
A: They should treat provenance metadata, signature validation, and certificate trust as a single verification chain.
Practitioner guidance
- Inventory certificate-owned dependencies Map where certificates, keys, and trust anchors live across applications, HSMs, and operational workflows so you know which systems depend on manual renewal or policy exceptions.
- Move renewal out of spreadsheets Replace human-managed certificate tracking with automated discovery, expiry monitoring, and owner-based alerting so lifecycle actions happen before service disruption becomes likely.
- Adopt phishing-resistant verification paths Prioritise controls that reduce reliance on user judgement, including stronger authentication and explicit verification for high-risk requests, approvals, and account recovery.
What's in the full article
DigiCert's full blog covers the operational detail this post intentionally leaves for the source:
- Predictive rationale for each 2025 trend, including the certificate lifecycle and digital trust assumptions behind them.
- Specific discussion of PQC adoption drivers across hardware security modules, applications, and compliance planning.
- Additional context on C2PA, private PKI, and automated certificate management as trust programme components.
- The vendor's own perspective on vendor consolidation and digital trust operations that this post has intentionally not unpacked.
👉 Read DigiCert's 10 predictions for AI, quantum and digital trust in 2025 →
AI, quantum and trust: what identity teams should prepare for?
Explore further
25/06/2026 4:15 pm
Manual trust administration is the new identity debt. When certificate management still depends on spreadsheets, renewal calendars, and human follow-up, organisations are carrying hidden operational risk into shorter certificate lifetimes and more frequent policy changes. That debt now affects web PKI, workload trust, and any programme that depends on timely cryptographic lifecycle actions. The practical conclusion is that trust governance cannot scale on manual exception handling.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how remediation delays extend exposure windows in identity governance programmes.
A question worth separating out:
Q: Who should own post-quantum cryptography planning in an identity programme?
A: Ownership should sit with the teams responsible for cryptographic lifecycle, platform architecture, and risk governance together, not with security in isolation. PQC affects applications, hardware, compliance obligations, and renewal processes, so it needs a cross-functional migration register and clear accountability.
👉 Read our full editorial: AI, quantum and trust predictions expose certificate governance gaps
