Notifications
Clear all
Topic starter
06/06/2026 2:20 am
TL;DR: Cryptographic risk is becoming harder to govern as certificate lifespans shorten, environments fragment, and quantum resilience planning moves onto the agenda, according to Keyfactor. The identity lesson is that cryptography now behaves like an enterprise trust layer, so visibility, ownership, and lifecycle control matter as much as algorithm choice.
NHIMG editorial — based on content published by Keyfactor: How Keyfactor Enables Quantum Resilience with Microsoft Technologies
By the numbers:
- 69% of organisations now have more machine identities than human ones.
- 57% of organisations lack a complete inventory of their machine identities.
- 61% rely on spreadsheets or manual tracking for machine identity management.
Questions worth separating out
Q: How should security teams govern certificate lifecycle risk in hybrid environments?
A: Security teams should treat certificate lifecycle as a governed identity process, not an ad hoc infrastructure task.
Q: Why do cryptographic assets become a governance problem at enterprise scale?
A: Cryptographic assets become a governance problem because they are widely distributed, often undocumented, and tightly coupled to identity and trust.
Q: What breaks when cryptographic ownership is unclear?
A: When ownership is unclear, renewal, remediation, and migration stall because no one is accountable for action.
Practitioner guidance
- Inventory cryptographic dependencies end to end Map certificates, keys, algorithms, and the services that depend on them across cloud, endpoint, and application layers so ownership is explicit.
- Tie cryptographic assets to named owners Assign business and technical ownership to every cryptographic object so renewal, replacement, and retirement decisions do not rely on tribal knowledge.
- Automate certificate lifecycle workflows Replace spreadsheet-based tracking with automated issuance, renewal, and retirement workflows for assets that support identity, device, and workload trust.
What's in the full article
Keyfactor's full article covers the operational detail this post intentionally leaves for the source:
- How its cryptographic discovery model maps certificates, keys, and dependencies across Microsoft environments
- Which Microsoft services and integrations are used to surface cryptographic assets at scale
- How the solution supports policy-driven governance for certificate lifecycle and compliance
- What the article says about post-quantum readiness and cryptographic agility in practice
👉 Read Keyfactor's analysis of cryptographic posture management with Microsoft →
Cryptographic posture management: what IAM teams need to govern?
Explore further
06/06/2026 3:57 am
Cryptographic posture management is now part of identity governance, not a separate infrastructure hygiene exercise. The article's core argument is that cryptographic assets underpin identity, device, cloud, and operations trust at scale, which makes ownership and lifecycle control the real governance problem. That aligns with NHI governance patterns: hidden credentials, unclear custodianship, and manual tracking all create blind spots. Practitioners should treat cryptographic posture as a governed trust inventory, not a one-off technical clean-up.
A few things that frame the scale:
- 57% of organisations lack a complete inventory of their machine identities, according to The Critical Gaps in Machine Identity Management report.
- Manual tracking remains the norm for 61% of organisations, which is why cryptographic inventories and certificate governance so often lag behind reality.
A question worth separating out:
Q: Who is accountable for cryptographic posture management in a zero trust programme?
A: Accountability should sit with the teams that own the systems relying on cryptography, backed by identity, security operations, and infrastructure governance. Zero trust depends on trusted certificates, keys, and device identities, so cryptographic posture cannot be left outside the control model. It must be part of the same governance chain that manages access and trust.
👉 Read our full editorial: Cryptographic posture management is now an identity governance issue
