Notifications
Clear all
Topic starter
04/06/2026 6:47 pm
TL;DR: Certificate automation is changing the economics of PKI, with Forrester customer interviews cited by Keyfactor showing one retail team managing more than 10x certificate growth while keeping fewer than five internal resources, and the study modeling up to a 95% reduction in certificate-related incidents and 356% ROI over three years. The governance shift is bigger than efficiency: certificate lifecycle control becomes a resilience and identity-scale problem, not a staffing problem.
NHIMG editorial — based on content published by Keyfactor: What Forrester Found When They Interviewed 5 Keyfactor Customers
By the numbers:
- One retail team said its certificate usage increased more than 10 times while its headcount stayed pretty steady.
Questions worth separating out
Q: What breaks when certificate lifecycle management is still manual?
A: Manual certificate management breaks at the point where expiry, ownership, and renewal do not line up.
Q: Why do large certificate estates create governance risk for IAM teams?
A: Large certificate estates create governance risk because each certificate is a non-human credential with its own validity window, dependency set, and owner.
Q: How do security teams know if PKI automation is working?
A: PKI automation is working when certificate renewals happen without emergency intervention, outages decline, and infrastructure overhead falls as certificate volume rises.
Practitioner guidance
- Consolidate certificate ownership into one lifecycle view Map all certificate authorities, renewal flows, and application owners into a single inventory so no certificate sits outside a governed renewal path.
- Automate renewal before expiry becomes an incident Set renewal triggers well ahead of certificate expiration and test whether dependent services can tolerate replacement without manual intervention.
- Reduce CA server sprawl and patch burden Review whether each CA server still has a justified role, then retire duplicate infrastructure and centralise patching where trust policy allows.
What's in the full article
Keyfactor's full blog covers the operational detail this post intentionally leaves for the source:
- Customer-by-customer TEI interview excerpts that show how certificate automation changed team workload.
- The Forrester modelling behind the 65% to 95% infrastructure cost reduction over three years.
- Breakdowns of incident reduction and labour savings by operational activity.
- The post's underlying customer quotes and ROI framing that support the financial model.
👉 Read Keyfactor's analysis of Forrester customer interviews on PKI automation →
PKI automation and certificate sprawl: what IAM teams need to know?
Explore further
04/06/2026 7:00 pm
Certificate lifecycle is now an NHI governance problem, not a back-office maintenance task. The article shows that certificate volume can grow by an order of magnitude without headcount growth when lifecycle controls are automated. That shifts PKI from an admin burden to an identity governance discipline. Teams that still separate certificates from broader NHI oversight are missing the operational reality that machine credentials create the same lifecycle risk pattern as other non-human identities.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: What should organisations do as certificate lifecycles get shorter?
A: Organisations should move from ad hoc renewal to governed lifecycle automation before shorter validity windows become mandatory. That means central visibility, dependency mapping, and testing replacement workflows under real service conditions. If the estate cannot renew cleanly today, shorter certificate lifetimes will turn a maintenance issue into a systemic risk.
👉 Read our full editorial: PKI automation changes certificate governance beyond staffing and cost
