Topic starter
24/10/2026 8:49 pm
TL;DR: Device identity breaks down when certificates are portable, Smallstep argues, because a credential that moves off the device can no longer prove the device is present. Zero Trust decisions become harder to trust when logs show valid authentication but the original device may be absent.
Editorial analysis by NHI Mgmt Group, based on content published by Smallstep: “Your Device Identity Is Probably a Liability”.
Key questions
Q: Why do long-lived device certificates create more risk than they remove?
A: Long-lived certificates extend the compromise window and make revocation less effective because attackers can keep using a valid credential long after the device changes state.
Q: How can security teams tell whether device identity is actually working?
A: The best signal is not perfect recognition, but stable performance across collision, division, and persistence scenarios.
Q: What breaks when device identity is portable?
A: When a device credential can be copied or replayed, access logs still show a valid authentication while the original device may be absent.
Practitioner guidance
- Audit certificate portability Identify where device certificates live in exportable software keystores, shared volumes, or unmanaged renewal paths, then classify those cases as portable identity rather than trusted device identity.
- Bind keys to hardware Require TPM or secure enclave storage for private keys so credentials cannot be copied and replayed from another host.
- Shorten credential lifetimes Move device certificates from months or years to hours or days so compromise windows collapse quickly and expired credentials stop authorising access.
Bottom line: Device identity fails when certificates are portable, because a credential that can move away from the device can no longer prove the device is present.
Glossary terms: Device Identity, Persistent Credential, Hardware-Bound Key, Certificate Lifecycle Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Portable device identity is a governance failure, not just a technical misconfiguration: When certificates can be copied, the organisation is not governing identity, it is merely inventorying cryptographic objects. That creates a gap between what compliance sees and what the access plane actually enforces. The practitioner conclusion is simple: if identity can move, the control is not device identity.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: What is the difference between certificate management and machine identity management?
A: Certificate management focuses on discovery, renewal, monitoring, and revocation for certificates. Machine identity management is broader because it includes the credential, the owning workload, the trust path, the policy, and the lifecycle controls that keep non-human access governable. Organisations need the broader model when certificates are only one part of the access chain.
👉 Read our full editorial: Device identity remains a liability when certificates are portable
This post was modified 6 days ago by NHI Mgmt Group