Notifications
Clear all
Topic starter
11/07/2026 8:41 pm
TL;DR: A major international services company used certificate-based credential management to secure engineer access to customer systems while reducing disruption, improving auditability, and automating certificate distribution and revocation according to Intercede. The case reinforces that lifecycle-managed credentials, not soft certificates or manual handoffs, are what make non-human access governable at scale.
NHIMG editorial — based on content published by Intercede: Major International Services Company Transforms Authentication with MyID CMS
By the numbers:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: What breaks when engineer certificates are not lifecycle-managed?
A: When engineer certificates are not lifecycle-managed, access can outlive the approval that justified it.
Q: Why do certificate-based access models improve accountability for customer-system access?
A: Certificate-based access improves accountability because each credential can be tied to a managed identity, an approval state, and an audit trail.
Q: How should organisations reduce disruption when tightening certificate governance?
A: They should preserve existing devices and access patterns where possible, then add lifecycle control around them.
Practitioner guidance
- Map engineer certificates to current authorisation state Tie each certificate to an active customer-system entitlement, and revoke access when the authorisation window closes or the task changes.
- Replace soft certificates with managed smart-card workflows Use managed hardware-backed certificates where possible so access remains traceable and less likely to drift across endpoints, shared stores, or unmanaged copies.
- Automate certificate revocation as a lifecycle event Trigger revocation from the same identity process that issues or updates credentials, so offboarding and role change do not depend on manual follow-up.
What's in the full article
Intercede's full case study covers the operational detail this post intentionally leaves for the source:
- How MyID CMS handles smart-card updates on-site and remotely without forcing a hardware replacement programme
- The credential distribution and revocation workflow used to keep engineer access aligned to current authorisation
- The implementation approach that preserved existing expenditure while reducing disruption for engineers and customers
- The business and financial outcomes associated with a single-pane-of-glass credential management model
👉 Read Intercede's case study on certificate lifecycle control for engineer authentication →
Certificate lifecycle control for engineer access: what changes for IAM teams?
Explore further
11/07/2026 9:09 pm
Certificate lifecycle, not authentication alone, is the control plane for engineer access. This case shows that access to customer systems becomes governable only when credential issuance, update, and revocation are managed as one lifecycle. The underlying problem is not whether engineers can authenticate, but whether the credential still represents active authorisation at the moment of use. Practitioners should read this as a lifecycle governance case, not a device story.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when certificate access is no longer current?
A: Accountability sits with the teams that own credential lifecycle, authorisation scope, and audit evidence. If a certificate remains active after access should have ended, the failure is usually governance, not authentication. For regulated or customer-facing access, that accountability should be explicit across IAM, PAM, and operational support functions.
👉 Read our full editorial: Certificate lifecycle control for customer-system authentication
