Notifications
Clear all
Topic starter
01/07/2026 1:59 am
TL;DR: Legacy PKI deployments built for a few internal applications are being stretched across cloud workloads, DevOps pipelines, IoT devices, and machine identities, with one survey finding only 47% of companies have enough staff dedicated to PKI, according to Keyfactor. PKI modernization is no longer just infrastructure refresh, it is governance for certificate sprawl, ownership, automation, and crypto-agility.
NHIMG editorial — based on content published by Keyfactor: 5 Reasons to Modernize Your PKI
By the numbers:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
- The same report found that 48% of organizations cite cloud-based services as a driver for PKI deployment.
Questions worth separating out
Q: How should security teams modernize PKI without breaking existing workloads?
A: Start by identifying the certificate flows that are already business-critical, then add a modern PKI layer that can run alongside legacy systems.
Q: Why do legacy PKI environments create machine identity risk?
A: Legacy PKI often fails because it was designed for fewer systems, slower change, and more manual administration.
Q: What do teams get wrong about certificate automation?
A: They often automate issuance but leave discovery, ownership, renewal, and revocation fragmented.
Practitioner guidance
- Inventory every certificate authority and issuer Build a complete register of internal, cloud, and team-owned CAs, then tie each one to a named owner, renewal process, and policy set.
- Automate certificate lifecycle operations Move discovery, issuance, renewal, and revocation out of manual tracking and into a governed workflow that covers every CA in scope.
- Consolidate fragmented CA estates Reduce the number of separate PKI stacks by defining a central governance model for policy, escalation, and exception handling.
What's in the full article
Keyfactor's full blog covers the operational detail this post intentionally leaves for the source:
- The article's five-reason structure with the deployment and governance rationale behind each modernization driver.
- Specific protocol examples such as ACME, EST, SCEP, and CMP for teams evaluating certificate automation options.
- The cost and scaling arguments behind PKI consolidation, including the Forrester-based savings claim.
- The post's guidance on crypto-agility and post-quantum preparation, which helps teams plan the next phase of modernisation.
👉 Read Keyfactor's blog on why PKI modernization matters for machine identity governance →
Legacy PKI and machine identity sprawl: what teams need now?
Explore further
01/07/2026 2:17 am
PKI modernization has become machine identity governance, not just infrastructure replacement. The article is right to frame modernization as a strategic shift because certificate systems now sit behind cloud workloads, DevOps pipelines, and IoT estates. That means the real issue is whether identity teams can maintain control over issuance, renewal, ownership, and revocation at scale. Practitioners should stop treating PKI as a background utility and manage it as part of the broader non-human identity programme.
A few things that frame the scale:
- 53% of organisations have experienced a security incident directly related to machine identity management failures, according to The Critical Gaps in Machine Identity Management report.
- Only 38% have automated certificate lifecycle management in place, which shows how much of the market still relies on manual control paths.
A question worth separating out:
Q: What is the difference between PKI modernization and PKI as a service?
A: PKI modernization is the broader governance and architecture shift to make certificate infrastructure flexible, scalable, and automatable. PKI as a service is one deployment model inside that shift, useful when organisations want to reduce internal maintenance burden without giving up lifecycle control or policy oversight.
👉 Read our full editorial: PKI modernization is now a machine identity governance problem
