Notifications
Clear all
Topic starter
25/06/2026 2:39 pm
TL;DR: IoT devices are arriving faster than organisations can inventory, authenticate, and update them, leaving machine identities untracked, misconfigured, or expired and creating outages, compliance pressure, and attack paths, according to Keyfactor. The core problem is not device count alone, but the assumption that manual PKI and fragmented visibility can still govern trust at fleet scale.
NHIMG editorial — based on content published by Keyfactor: IoT Security Solutions: Automated Protection in an Interconnected World
By the numbers:
- With a more than 40% surge in IoT, BYO mobile, and other devices being used in company networks, only an automated tool can manage the sheer volume of certificates needed to keep an organization’s network secure.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: How should security teams govern IoT device certificates at scale?
A: Security teams should govern IoT device certificates with a single lifecycle process for issuance, renewal, revocation, and retirement.
Q: Why do IoT fleets create more machine identity risk than traditional endpoints?
A: IoT fleets create more machine identity risk because devices often stay in service for years while their certificates, firmware, and trust assumptions age much faster.
Q: What breaks when certificate management is still manual in IoT environments?
A: Manual certificate management breaks when device counts and renewal events outgrow human tracking.
Practitioner guidance
- Unify device and certificate inventory Build one authoritative view of every IoT device, certificate, CA, and renewal state across cloud, edge, and legacy environments.
- Automate certificate renewal and revocation Replace spreadsheet-based renewal handling with lifecycle automation that renews, rotates, and revokes certificates before expiry.
- Plan for crypto-agility across fleets Design re-issuance workflows that let you update certificate algorithms and trust settings across long-lived devices without manual rebuilds.
What's in the full article
Keyfactor's full blog covers the operational detail this post intentionally leaves for the source:
- How the vendor recommends structuring automated discovery across devices, certificates, and issuing authorities.
- Operational guidance on certificate renewal and revocation workflows for long-lived IoT fleets.
- Implementation considerations for hybrid PKI models across cloud, edge, and embedded environments.
- How the article connects IoT trust automation to future cryptographic change and fleet re-issuance.
👉 Read Keyfactor's analysis of IoT security solutions and machine identity trust →
IoT device trust at scale: what IAM teams need to fix?
Explore further
25/06/2026 3:46 pm
IoT security is really machine identity governance at device scale. The article is right to move the conversation away from device count alone, because the core problem is lifecycle control over certificates, issuers, and revocation state. Once fleets stretch across cloud, edge, and embedded environments, the challenge is not whether a device exists, but whether its identity is still trusted, current, and visible. Practitioners should treat IoT as part of the broader non-human identity estate.
A few things that frame the scale:
- With a more than 40% surge in IoT, BYO mobile, and other devices being used in company networks, only an automated tool can manage the sheer volume of certificates needed to keep an organization’s network secure, according to The State of Secrets in AppSec.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
A question worth separating out:
Q: How do organisations reduce outage risk from expiring IoT certificates?
A: Organisations reduce outage risk by monitoring certificate lifetimes continuously, automating replacement well before expiry, and tying renewals to authoritative device inventory. That approach prevents the hidden failure mode where a device is still deployed but its trust anchor has already lapsed.
👉 Read our full editorial: IoT security solutions expose the machine identity trust gap
