Topic starter
25/06/2026 2:39 pm
TL;DR: IoT devices are arriving faster than organisations can inventory, authenticate, and update them, leaving machine identities untracked, misconfigured, or expired and creating outages, compliance pressure, and attack paths, according to Keyfactor. The core problem is not device count alone, but the assumption that manual PKI and fragmented visibility can still govern trust at fleet scale.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “IoT Security Solutions: Automated Protection in an Interconnected World”.
By the numbers:
- There is a more than 40% surge in IoT, BYO mobile, and other devices being used in company networks.
Key questions
Q: What breaks when bots and IoT devices are left out of identity governance?
A: When bots and IoT devices are excluded from identity governance, organisations lose visibility into non-human access, approvals, and privilege scope.
A: PKI alone does not prevent outages if certificate ownership, renewal, and monitoring are fragmented.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Build a unified device identity inventory Track every IoT certificate, device owner, and lifecycle state across cloud, edge, and legacy environments so trust gaps are visible before renewal or incident time.
- Automate certificate renewal and revocation Replace spreadsheet-driven expiry monitoring with automated issuance, renewal, and revocation for every device identity that can affect uptime or trust.
- Map devices to business-critical services Prioritise certificates attached to production lines, healthcare systems, connected vehicles, and other uptime-sensitive services where expiry becomes operational impact.
Bottom line: IoT security fails when organisations cannot govern the machine identities attached to every connected device.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:46 pm
IoT trust has become an identity lifecycle problem, not a device count problem. The operational failure is not that organisations own too many devices, but that they cannot reliably govern the identities attached to them. When certificates, ownership, and renewal state are fragmented, the programme loses the ability to say what is trusted, by whom, and for how long. Practitioners should treat fleet trust as a governed lifecycle rather than an inventory exercise.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern trust for IoT devices across edge and cloud environments?
A: Treat every device as a governed identity with an owner, a certificate lifecycle, and a revocation path. Mutual authentication should be required before any device can influence operations, and trust must extend from onboarding through retirement. In mixed OT and cloud environments, identity assurance is the control that keeps device data and commands reliable.
👉 Read our full editorial: IoT security solutions expose the machine identity trust gap