Topic starter
25/06/2026 3:00 pm
TL;DR: 54% of enterprise respondents lacked policy enforcement and remediation for keys and certificates, while another 54% did not know how many they had, where they were, or how they were used, according to DigiCert citing Ponemon Institute data. That combination turns certificate sprawl into a governance failure, not just an operational one.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Securing Enterprise Keys and Certificates Should Be a Priority”.
By the numbers:
- 54% of enterprise respondents admit to having a lack of policy enforcement and remediation for keys and certificates.
- 54% of security professionals say they do not know how many keys and certificates they have, where they are located, or how they are used.
- More than 20 manual steps are required to update a single certificate in the replacement process described in the article.
Key questions
Q: What breaks when organisations do not know where all their keys are?
A: When organisations cannot locate all their keys, they lose the ability to govern them consistently.
Q: Why do unmanaged certificates create more than an outage risk?
A: Because a certificate is tied to a private key that proves identity, unmanaged certificates can enable impersonation, decryption, or fraudulent trust relationships.
Q: How should security teams measure whether certificate governance is actually working?
A: Use operational signals, not policy statements.
Practitioner guidance
- Establish a complete certificate inventory Catalogue every private key and certificate, record where it is deployed, and identify the application, service, or platform that depends on it.
- Assign explicit ownership for each credential Tie every certificate and key to a named system owner so policy enforcement and remediation do not stop at discovery.
- Automate remediation for unknown or expired entries Create workflows that revoke, replace, or quarantine credentials when inventory data is missing, stale, or inconsistent.
Bottom line: The core risk is not just certificate sprawl, but the inability to govern machine credentials that underpin trust across services and applications.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:17 pm
Certificate inventory is the control that determines whether governance exists at all: a team cannot enforce policy, scope remediation, or prove accountability for keys and certificates it cannot count. The article shows that visibility is not an operational nicety but the prerequisite for any credible governance model. Practitioners should treat unknown inventory as a control failure, not a reporting gap.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: What should teams do when certificate replacement requires many manual steps?
A: Treat the process as an operational risk, not a maintenance detail. Long replacement chains increase the chance of delay, partial rollout, and inconsistent trust states across applications. The immediate response is to standardise the workflow so replacement becomes repeatable before a real compromise forces it.
👉 Read our full editorial: Enterprise key and certificate governance still fails without inventory