Topic starter
25/06/2026 2:41 pm
TL;DR: AI-directed intrusion workflows can enumerate systems, harvest credentials, and move laterally at machine speed, which is why Keyfactor argues PKI and x.509 certificates are now foundational for infrastructure defence. Passwords and MFA still protect people at the login screen, but they do not govern internal machine-to-machine trust or autonomous attack behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Beyond Passwords: How PKI Secures Your Infrastructure from AI-Driven Attacks”.
Key questions
Q: What fails when AI-driven attackers can reason over internal credentials at machine speed?
A: Review-based controls fail first because the attacker can discover and map access paths faster than human governance cycles can react.
Q: Why is MFA not a complete control for non-human identities?
A: MFA is built for interactive human authentication, while non-human identities usually authenticate with certificates, tokens, keys, or federated workload trust.
Q: What breaks if internal services still rely on shared secrets?
A: Shared secrets create a large reuse surface, so one exposed token can open multiple systems or paths.
Practitioner guidance
- Define a machine identity inventory Catalogue certificates, service accounts, API keys, bearer tokens, and other workload credentials by owner, environment, and expiry status.
- Move service-to-service calls to mTLS Require mutual TLS for internal service communication so that workloads authenticate with certificates instead of reusable shared secrets.
- Separate authentication from authorization Use PKI to prove identity and OAuth only to govern permissions, so a stolen token does not become a full trust bypass.
Bottom line: AI-directed intrusion workflows expose a structural gap between human login controls and the machine-to-machine trust used by infrastructure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:47 pm
PKI is becoming the minimum viable trust layer for machine identities: When internal systems authenticate each other through shared secrets, the attacker only has to find one reusable credential to open multiple paths. Certificates shift that burden because identity is verified cryptographically, not inferred from possession of a copied secret. For practitioners, the implication is that workload identity governance now sits on the same critical path as perimeter authentication.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should teams prioritise PKI over password hardening for infrastructure defence?
A: Yes, when the main risk is machine-to-machine trust rather than human login abuse. Password hardening helps at the edge, but PKI and workload-bound certificates govern the identity layer that AI-driven attackers actually exploit inside distributed infrastructure.
👉 Read our full editorial: PKI and workload identities are now mandatory for AI-driven attacks