Notifications
Clear all
Topic starter
06/06/2026 11:23 am
TL;DR: Certificate lifecycles are shrinking by over 90% as the industry moves toward a 47-day renewal cycle, making manual trust management a growing outage risk for enterprise applications and cloud services, according to Palo Alto Networks. The real issue is that cryptographic trust no longer stays stable long enough for spreadsheet-era governance to work.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- Palo Alto Networks says certificate lifetimes are shrinking by over 90% as enterprises move toward a mandatory 47-day certificate renewal cycle.
- Only 38% have automated certificate lifecycle management in place.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
Questions worth separating out
Q: How should security teams manage certificate lifecycle automation in cloud environments?
A: They should treat certificate lifecycle automation as a governance control, not just an operations convenience.
Q: When does certificate lifecycle management become a security risk instead of a reliability task?
A: It becomes a security risk when certificates are short-lived, ownership is unclear, or revocation can affect many services at once.
Q: What do teams get wrong about certificate visibility and shadow trust assets?
A: Teams often assume their certificate inventory is complete because a primary tool reports healthy coverage.
Practitioner guidance
- Inventory every certificate and owner Build a continuously refreshed certificate inventory that includes application owner, expiry, renewal source, and enforcement point.
- Automate renewal before the renewal window closes Move certificate renewal off spreadsheet workflows and into policy-driven automation that can trigger replacement well before the expiry threshold.
- Tie trust changes to enforcement points Ensure certificate revocation, replacement, and trust-authority changes are reflected where traffic is actually allowed or blocked.
What's in the full announcement
Palo Alto Networks's full product announcement covers the operational detail this post intentionally leaves for the source:
- The exact way NGTS combines certificate lifecycle management with network enforcement across services and applications.
- The vendor's description of how integrated machine identity intelligence is used to close ownership and visibility gaps.
- The specific product messaging around post-quantum readiness and faster renewal cycles.
- The named benefits and positioning language that implementation teams may need when evaluating the source announcement.
👉 Read Palo Alto Networks's announcement on automated certificate lifecycle management →
Certificate lifecycle automation for NHI governance: what changes now?
Explore further
06/06/2026 12:09 pm
Certificate lifecycle automation is now an NHI governance problem disguised as network resilience. The article is really about whether enterprises can still govern trust objects that expire faster than their manual processes can track. Once certificate renewal cycles compress, lifecycle management behaves like high-volume non-human identity administration, with discovery, ownership, and revocation all becoming time-sensitive control points. Practitioners should read this as a governance shift, not a feature discussion.
A few things that frame the scale:
- Only 38% have automated certificate lifecycle management in place, according to The Critical Gaps in Machine Identity Management report.
- Manual processes still dominate: 61% rely on spreadsheets or manual tracking for machine identity management.
A question worth separating out:
Q: Who is accountable when certificate expiry causes an outage?
A: Accountability should sit with the team that owns lifecycle policy, the team that operates the trust enforcement layer, and the application owners who consume the certificates. If those responsibilities are split without a clear control owner, the organisation will discover the gap only when the service stops working.
👉 Read our full editorial: Certificate lifecycle automation and digital trust resilience in NHI
