Notifications
Clear all
Topic starter
24/06/2026 11:16 pm
TL;DR: Enterprise cryptography is moving from quiet infrastructure to a governed trust system as certificate lifecycles, legacy cryptography, cloud sprawl, and quantum-safe planning converge, according to Keyfactor. Manual discovery, fragmented PKI, and weak lifecycle control are now operational risks, not background hygiene.
NHIMG editorial — based on content published by Keyfactor: 6 Brutal Truths Every Leader Must Face About Enterprise Cryptography
Questions worth separating out
Q: How should security teams govern cryptographic assets across cloud and DevOps environments?
A: Security teams should treat cryptographic assets as governed trust dependencies, not isolated technical objects.
Q: Why do manual certificate processes fail as cryptographic estates grow?
A: Manual processes fail because certificate volumes, dependencies, and expiry events grow faster than human review cycles.
Q: What do organisations get wrong about quantum-safe cryptography planning?
A: Many organisations treat quantum-safe planning as a future algorithm choice rather than a migration programme.
Practitioner guidance
- Build a cryptographic bill of materials Map every certificate, key, signing service, algorithm, and dependency across cloud, DevOps, and legacy systems.
- Automate renewal and revocation workflows Replace spreadsheet-driven tracking with policy-based renewal, rotation, and revocation that can operate across heterogeneous environments.
- Separate algorithm strength from migration readiness Test whether applications and platforms can switch cryptographic primitives without code redesign or prolonged outage risk.
What's in the full article
Keyfactor's full blog covers the operational detail this post intentionally leaves for the source:
- The article's full breakdown of the IBM Consulting and Keyfactor partnership model, including how governance and tooling responsibilities are split.
- The specific cryptographic modernization path described for discovery, inventory, risk scoring, and automated lifecycle control.
- The discussion of quantum-safe readiness, including dual-stack planning and migration sequencing for enterprise environments.
- The examples of how centralized PKI, signing, and observability are positioned across cloud, DevOps, and on-prem systems.
👉 Read Keyfactor's analysis of enterprise cryptography modernization and quantum risk →
Enterprise cryptography governance and quantum risk: are controls ready?
Explore further
25/06/2026 8:02 am
Cryptographic trust debt is the right name for this problem. Enterprises are accumulating a hidden backlog of certificates, keys, algorithms, and dependencies that still function but are no longer governed with precision. That debt shows up first as invisible ownership gaps and then as renewal failures, audit friction, and delayed modernization. The practitioner conclusion is simple: if trust assets cannot be inventoried and assigned lifecycle control, they are already operational debt.
A few things that frame the scale:
- 57% of organisations lack a complete inventory of their machine identities, according to The Critical Gaps in Machine Identity Management report.
- Only 38% have automated certificate lifecycle management in place, which explains why renewal failures and hidden dependencies remain common.
A question worth separating out:
Q: Who should own cryptography governance when certificates support machine identities?
A: Ownership should sit with identity, platform, and security governance together, because certificates and keys are now part of machine identity control. If no one owns the lifecycle, expiring trust assets remain active, renewal logic becomes ad hoc, and audit evidence fragments. The accountable team is the one that can prove inventory, rotation, and retirement are continuously managed.
👉 Read our full editorial: Enterprise cryptography governance is colliding with quantum risk
