Topic starter
01/07/2026 1:59 am
TL;DR: Legacy PKI deployments built for a few internal applications are being stretched across cloud workloads, DevOps pipelines, IoT devices, and machine identities, with one survey finding only 47% of companies have enough staff dedicated to PKI, according to Keyfactor. PKI modernization is no longer just infrastructure refresh, it is governance for certificate sprawl, ownership, automation, and crypto-agility.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “5 Reasons to Modernize Your PKI”.
By the numbers:
- According to Keyfactor, only 47% of companies have enough staff dedicated to their PKI.
- According to Keyfactor, root CA certificates can have a lifespan of up to 25 years.
- According to Keyfactor, some customers achieved a 95% reduction in PKI infrastructure costs.
Key questions
Q: What breaks when legacy PKI is stretched across modern cloud and remote access use cases?
A: Legacy PKI tends to break in three places: scale, visibility, and operational simplicity.
Q: Why does certificate sprawl increase operational risk?
A: Certificate sprawl increases risk because every additional certificate adds another trust object that can expire, duplicate, or go unowned.
Q: How should teams decide whether PKI needs modernization?
A: Teams should modernize PKI when certificate volume, renewal frequency, or hybrid complexity outgrows the current operating model.
Practitioner guidance
- Establish a single certificate ownership model Assign a named owner for every CA, certificate policy, and renewal workflow so responsibility does not drift between infrastructure, security, and application teams.
- Inventory shadow CAs and unmanaged certificates Discover certificate authorities created outside central governance, then reconcile them against the authoritative inventory used for policy, renewal, and revocation.
- Automate renewal and revocation workflows Move high-volume certificate operations out of spreadsheets and manual reminders, especially for workloads that issue and rotate certificates continuously.
Bottom line: Legacy PKI no longer matches the scale and operating model of cloud, IoT, and DevOps-heavy environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
01/07/2026 2:17 am
PKI modernization is now a machine identity governance problem: the centre of gravity has moved from certificate issuance to lifecycle control across identities that outnumber human users and change faster than legacy CA processes can follow. This is not just infrastructure refresh. It is governance over certificate ownership, policy consistency, and trust boundaries across cloud, DevOps, and IoT estates, and practitioners should treat PKI as part of NHI operating model design.
A few things that frame the scale:
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
A question worth separating out:
Q: What should organizations prioritize first in a PKI modernization programme?
A: They should start with ownership and inventory before technology refresh. If teams do not know which CAs exist, who owns them, and which certificates depend on them, automation will only accelerate unmanaged complexity. The first job is to establish authoritative control over the current trust estate.
👉 Read our full editorial: PKI modernization is now a machine identity governance problem
This post was modified 1 day ago by NHI Mgmt Group