Topic starter
24/06/2026 11:12 pm
TL;DR: Equifax’s 76-day breach showed how an expired digital certificate on a network device can disable vulnerability scanning, delay detection, and contribute to massive PII exposure, according to DigiCert’s analysis. The lesson is that certificate lifecycle management is not housekeeping; it is a control for visibility, continuity, and breach containment.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Lessons from the Equifax data breach”.
By the numbers:
- The breach lasted 76 days while attackers stole personally identifiable information from multiple databases.
- The stolen information affected more than 150 million Americans.
- DigiCert says the company paid $575 million in FTC fines alone.
Key questions
Q: What breaks when certificate visibility is missing in a large enterprise?
A: When certificate visibility is missing, teams lose reliable ownership, renewal timing and dependency mapping.
Q: Why do expired or misissued certificates create more than an availability problem?
A: Because a certificate is a trust assertion, not just a connectivity setting.
Q: How should teams prioritise certificate lifecycle management over manual administration?
A: Teams should prioritise lifecycle management when certificate populations are too large for spreadsheets and ad hoc reminders.
Practitioner guidance
- Establish one certificate inventory Create a single authoritative register for all certificates across business units, devices and services.
- Map certificates to dependent controls Identify which security functions rely on each certificate, especially scanning, monitoring and service authentication.
- Replace manual renewal workflows Move away from alert-by-email and spreadsheet-driven maintenance for enterprise certificate estates.
Bottom line: The Equifax case shows that certificate expiration can become a governance failure when organisations cannot see or own their trust inventory.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:57 am
Certificate visibility is a governance control, not an operations detail. The Equifax case shows that once certificate inventory is fragmented, the organisation loses the ability to govern expiration, ownership and dependency risk. The real failure was not the missed renewal alone, but the inability to see the certificate in time to preserve a security control. Practitioners should treat certificate visibility as part of identity governance, not as a back-office PKI chore.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when a certificate expires and enables a breach?
A: Accountability should sit with the team that owns certificate governance, not only with the administrator who notices the expiry. In mature programmes, PKI, identity governance, and the business system owner all share responsibility for inventory, renewal, and risk acceptance. If ownership is unclear, the control model has already failed.
👉 Read our full editorial: Equifax shows why certificate visibility is a governance control