Notifications
Clear all
Topic starter
11/07/2026 8:26 pm
TL;DR: Automation is increasingly being used by cybercriminals to improve phishing and other scams, while the same pattern is now being applied to PKI certificate management to reduce manual error, improve scalability, and support compliance, according to GlobalSign. The underlying issue is not automation itself but whether certificate and identity processes can remain visible, governed, and revocable when lifecycles move faster than spreadsheets and manual checks can track.
NHIMG editorial — based on content published by GlobalSign: automation in PKI certificate management and business security
By the numbers:
- MGM Resorts suffered at least $100 million in damage earlier this year.
Questions worth separating out
Q: How should security teams automate PKI certificate management without losing control?
A: Security teams should automate routine certificate issuance, renewal, and inventory updates under explicit policy.
Q: Why do expired or orphaned certificates create identity risk?
A: Expired or orphaned certificates create identity risk because they represent trust that no longer matches business intent.
Q: What do organisations get wrong about certificate automation?
A: They often treat automation as the end state rather than the control mechanism.
Practitioner guidance
- Inventory certificates as governed identities Create a live inventory of certificates, owners, systems, expiry dates, and revocation paths.
- Automate renewal with exception handling Use policy-based automation to renew routine certificates, but define explicit exception handling for high-risk, external-facing, or regulated services.
- Tie offboarding to certificate revocation When systems, vendors, or staff are removed, revoke related certificates as part of the same offboarding workflow.
What's in the full article
GlobalSign's full article covers the operational detail this post intentionally leaves for the source:
- The article's discussion of why automation is being adopted in PKI environments and where manual processes break down.
- A vendor-oriented explanation of the practical benefits and trade-offs of automating certificate workflows.
- The article's walkthrough of considerations for choosing an automated certificate management approach.
- The accompanying video reference and practical prompts around implementation choices for security teams.
👉 Read GlobalSign's analysis of automation in PKI certificate management →
PKI certificate automation: what it means for identity teams?
Explore further
11/07/2026 8:55 pm
Certificate automation is really lifecycle governance for machine trust. The article treats automation as an efficiency improvement, but the deeper identity issue is that certificates are credentials with expiry, renewal, and revocation obligations. When those obligations are managed manually, the organisation is already accepting unmanaged trust drift. Practitioners should read PKI automation as a governance control, not a tooling convenience.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly trust drift becomes invisible once identity sprawl grows.
A question worth separating out:
Q: What should teams do when a certificate is nearing expiry?
A: Teams should trigger the renewal path based on ownership and service dependency, not on informal reminders. If the certificate supports external trust or critical infrastructure, renewal should be verified before expiry and tied to a documented fallback if the service cannot tolerate interruption.
👉 Read our full editorial: Automation in PKI certificate management and identity risk
