Topic starter
24/06/2026 11:12 pm
TL;DR: The breach left more than 150 million Americans exposed after an expired certificate on a network device disrupted scanning, according to DigiCert. Centralised certificate visibility matters because missed ownership can let security controls fail without warning.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Lessons from the Equifax data breach”.
By the numbers:
- The breach lasted 76 days while attackers stole personally identifiable information from multiple databases.
- The stolen information affected more than 150 million Americans.
- DigiCert says the company paid $575 million in FTC fines alone.
Key questions
Q: Why do expired or misissued certificates create more than an availability problem?
A: Because a certificate is a trust assertion, not just a connectivity setting.
Q: How should teams prioritise certificate lifecycle management over manual administration?
A: Teams should prioritise lifecycle management when certificate populations are too large for spreadsheets and ad hoc reminders.
Q: What breaks when certificate visibility is missing in a large enterprise?
A: When certificate visibility is missing, teams lose reliable ownership, renewal timing and dependency mapping.
Practitioner guidance
- Establish one certificate inventory Create a single authoritative register for all certificates across business units, devices and services.
- Map certificates to dependent controls Identify which security functions rely on each certificate, especially scanning, monitoring and service authentication.
- Replace manual renewal workflows Move away from alert-by-email and spreadsheet-driven maintenance for enterprise certificate estates.
Bottom line: The Equifax case shows that certificate expiration can become a governance failure when organisations cannot see or own their trust inventory.
Glossary terms: Certificate Visibility, Certificate Lifecycle Management, Machine Identity, pnPKI
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
25/06/2026 7:57 am
Certificate visibility is a governance control, not an operations detail. The Equifax case shows that once certificate inventory is fragmented, the organisation loses the ability to govern expiration, ownership and dependency risk. The real failure was not the missed renewal alone, but the inability to see the certificate in time to preserve a security control. Practitioners should treat certificate visibility as part of identity governance, not as a back-office PKI chore.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when a certificate expires and enables a breach?
A: Accountability should sit with the team that owns certificate governance, not only with the administrator who notices the expiry. In mature programmes, PKI, identity governance, and the business system owner all share responsibility for inventory, renewal, and risk acceptance. If ownership is unclear, the control model has already failed.
👉 Read our full editorial: Equifax shows why certificate visibility is a governance control