Topic starter
25/06/2026 10:33 pm
TL;DR: Certificate-related outages hit 86% of organisations in the past year, with 31% experiencing them at least quarterly and 10% seeing weekly disruption, as Keyfactor’s Digital Trust Digest: The Automation Edition finds, with visibility and automation gaps driving operational risk. The real problem is not certificate expiry alone, but governance built on incomplete inventory, weak ownership, and partial automation.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Keyfactor Research Reveals Digital Certificate Outages a Weekly Reality for 1 in 10 Enterprises”.
By the numbers:
- An overwhelming 86% of companies suffered at least one outage and subsequent disruption due to expired or mismanaged digital certificates within the past year.
- Nearly one-third of companies, 31%, reported certificate outages at least once a quarter.
- 10% reported a certificate outage every single week.
Key questions
Q: What breaks when certificate ownership is not clearly assigned?
A: When ownership is unclear, renewal becomes inconsistent, orphaned certificates persist, and no one can prove which services still rely on outdated trust.
Q: Why do certificate outages keep happening even when some automation is in place?
A: Partial automation leaves manual gaps between discovery, approval, renewal, and deployment, so the organisation still depends on humans for the steps most likely to break.
Q: How should security teams measure whether certificate governance is actually working?
A: Use operational signals, not policy statements.
Practitioner guidance
- Map the full certificate estate Build a complete inventory of certificates, the services they protect, and the owners responsible for each lifecycle event.
- Assign accountable owners Tie every certificate to a named business or technical owner with renewal, revocation, and escalation responsibility.
- Automate renewal end to end Connect discovery, approval, renewal, deployment, and verification so automation covers the full path rather than only the easiest renewals.
Bottom line: Certificate outages now reflect a machine identity governance gap, not just a renewal problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:07 pm
Certificate outages are an identity governance failure before they are an infrastructure failure. When teams do not know where certificates live, who owns them, or which services depend on them, expiry becomes a production event instead of a managed renewal. This is a machine identity problem because the certificate is the credential and the outage is the symptom. The practitioner conclusion is that governance must start with inventory and ownership, not renewal workflows.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- An unplanned outage in a cloud environment costs an average of $9,000 per minute, per the Uptime Institute’s 2023 Global Data Center Survey.
A question worth separating out:
Q: How should teams manage certificate renewals when lifecycles keep shrinking?
A: Teams should move from calendar-based renewal to continuous lifecycle orchestration. That means tracking certificate state, owning the deployment path, and automating verification after renewal. Shrinking lifecycles make delayed approvals and missed notifications operational risks, so the control objective is uninterrupted service continuity, not just timely renewal.
👉 Read our full editorial: Certificate outages expose the governance gap in machine identity management