Topic starter
06/11/2026 6:55 pm
TL;DR: AI agents are driving certificate sprawl and faster turnover across machine identities, according to AppViewX's analysis of the identity estate. Practitioners need continuous discovery, automated renewal and central policy control before validity windows and ownership gaps create blind spots.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “How to Secure SSL Certificates Against AI Risk”.
By the numbers:
- Machine identities already outnumber human identities by roughly 50 to 1 across most enterprises.
Key questions
Q: Why do short-lived certificates matter for machine identity governance?
A: Short-lived certificates matter because they are time-bound non-human credentials that define how systems prove identity to each other.
Q: When does certificate automation reduce risk rather than add it?
A: Automation reduces risk when issuance, renewal, and monitoring are tied to policy and role boundaries.
Q: How should teams inventory machine certificates in hybrid environments?
A: Inventory machine certificates by binding each certificate to its owning workload, service account, or device, then record issuer, subject, serial number, key location, expiry, and renewal path across on-premises and cloud platforms.
Practitioner guidance
- Build a complete certificate inventory Include public, private and multi-cloud certificates, plus keys embedded in workloads, pipelines and automated agents.
- Automate issuance and renewal workflows Replace human renewal queues with policy-driven automation so short-lived certificates are reissued before service trust breaks.
- Assign accountable owners to every credential Require an owner, expiry policy and revocation path for each certificate so emergency rotation does not stall during incident response.
Bottom line: AI-driven identity growth turns certificate management into a continuous governance problem rather than a periodic renewal task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Certificate governance has moved from periodic hygiene to continuous identity control. AI agents and short-lived workloads create and retire credentials at a pace that breaks assumptions built around scheduled renewal. The governance problem is no longer whether certificates are issued correctly once, but whether the estate can stay visible and owned as identities multiply. Practitioners should treat certificate management as an always-on identity lifecycle discipline.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between crypto-agility and certificate rotation?
A: Certificate rotation replaces one certificate or secret with another on a schedule, while crypto-agility is the broader ability to change cryptographic algorithms and trust mechanisms without redesigning the system. Rotation is one control inside a wider readiness model. Practitioners need both, because algorithm changes fail when systems cannot adapt quickly.
👉 Read our full editorial: AI agents turn certificate governance into a continuous-control problem