Notifications
Clear all
Topic starter
12/07/2026 12:22 pm
TL;DR: Machine identity management has become a core security issue, according to GlobalSign, because organisations now rely on certificates, trust chains, and PKI to govern non-human access across infrastructure, applications, and connected systems. The underlying challenge is that identity programmes still treat machine trust as a static setup, even though renewal, revocation, and lifecycle control are now continuous operational requirements.
NHIMG editorial — based on content published by GlobalSign: Gestion des accès et des identités de machines, le rôle essentiel de la PKI
Questions worth separating out
Q: How should teams govern certificates as part of machine identity management?
A: Treat certificates as machine identities with owners, lifecycle states, and policy controls.
Q: Why do machine identities challenge zero trust architectures?
A: Because zero trust depends on continuous verification, while many machine identities are issued once and then trusted for far too long.
Q: What breaks when certificate renewal is managed manually?
A: Manual renewal breaks consistency, especially when large numbers of services, devices, and applications depend on the same trust pattern.
Practitioner guidance
- Inventory all machine certificates and owners Create a complete register of certificates, issuing authorities, renewal dates, and service owners so no machine identity exists without accountable stewardship.
- Automate renewal and revocation workflows Move renewal, replacement, and revocation into controlled automation with exception handling for critical systems and clear escalation before expiry or compromise.
- Tie PKI to IAM governance records Link certificates to asset inventory, service ownership, and access policy so machine identities are visible in the same governance process used for other identities.
What's in the full article
GlobalSign's full blog post covers the operational detail this post intentionally leaves for the source:
- How certificate automation is used across machine identity estates to reduce renewal failure and operational drift
- The article's framing of PKI as a business trust layer, not only a technical encryption mechanism
- The specific reasons machine identity management is becoming harder as certificate volumes and renewal pressure increase
- Practical examples of why organisations must align certificate lifecycle control with broader identity governance
👉 Read GlobalSign's post on machine identity management and PKI →
Machine identity management: what GlobalSign’s PKI post means for teams?
Explore further
12/07/2026 12:35 pm
Machine identity governance is now inseparable from PKI operations. The article reflects a broader shift in which certificates are not just transport-layer artefacts but governed identities with owners, lifecycles, and access consequences. That means IAM programmes must stop treating PKI as a separate technical silo. The practitioner implication is clear: if a certificate cannot be assigned, reviewed, and retired, it is not governed.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: What is the difference between certificate encryption and certificate governance?
A: Encryption protects data in transit or at rest, while governance controls who can issue, use, rotate and revoke certificates. A certificate can be technically strong and still create risk if ownership is unclear or the lifecycle is unmanaged. Governance is what keeps trust from becoming sprawl.
👉 Read our full editorial: Machine identity management and PKI are now operational priorities
