What happens when organisations rely on PGP without usable key management?

PGP’s Security Value Depends on the Key Lifecycle

PGP only delivers confidentiality and authenticity when the organisation can reliably create, distribute, verify, rotate, and revoke keys. Without usable key management, the cryptography does not disappear, but the control becomes too awkward for people to follow consistently. That shifts the real security outcome from protected messages to inconsistent adoption, missed verification, and fragile recovery when keys are lost or replaced. The NIST Cybersecurity Framework 2.0 is useful here because the issue is not the algorithm itself but the operational control environment around it.

In practice, many security teams encounter PGP weakness first as user workarounds, not as a formal cryptographic failure.

How PGP Breaks Down in Day-to-Day Use

Usable key management is what turns PGP from a theoretical capability into a dependable operating control. Users need a clear way to obtain the right public keys, validate that they belong to the right people or systems, and recover access when a private key is lost or a device is replaced. They also need predictable processes for revocation, replacement, and archival, otherwise old keys linger, trust assumptions become stale, and encrypted content becomes harder to open over time.

The practical failure mode is usually friction. If key setup takes too long, users stop encrypting sensitive mail. If key verification is unclear, they may trust the wrong key or ignore signature checks altogether. If recovery is poorly designed, an organisation can lose access to encrypted records or force staff to bypass the control to keep business moving. PGP then becomes unevenly applied across teams, partners, and message flows, which reduces both confidentiality and authenticity.

• Key discovery must be simple enough that users can find and trust the correct key without guesswork.
• Revocation and replacement must be fast enough to limit exposure when a key is compromised or retired.
• Recovery must preserve access to business-critical encrypted data without relying on informal workarounds.
• Verification must be routine, because signatures add little value if recipients never check them.

Where this guidance breaks down is in organisations that expect ad hoc, human-managed key handling to scale across large user populations or mixed external relationships.

Where PGP Management Most Commonly Fails

Tighter encryption adoption often increases administrative overhead, so organisations must balance confidentiality against the effort required to keep trust material current.

One common edge case is a mixed environment where some users encrypt routinely and others do not. That creates partial protection, but it also introduces false confidence because the organisation may treat PGP as “in place” even when coverage is inconsistent. Another edge case is long-lived encrypted archives: if key escrow, recovery, or succession planning is weak, the organisation may preserve unreadable data rather than durable protection. There is also a guidance-versus-consensus issue around key discovery: some teams prefer centralised directories, while others favour decentralised trust models, but there is no universal consensus that one approach works equally well for every operating model.

PGP also becomes less reliable when signatures are treated as decorative rather than operational. A signature that nobody checks does not materially improve trust, especially in workflows where impersonation, spoofed requests, or email-borne fraud are realistic concerns. The strongest design is the one that makes correct behaviour the easiest behaviour, not the one that assumes every user will manage keys manually forever.

If the organisation cannot maintain key ownership, rotation, and recovery with minimal ambiguity, PGP will usually degrade into selective use rather than a dependable security control.

Risk and Threat Considerations

The main risk is control erosion: when key management is unusable, the organisation gets a cryptographic scheme that exists on paper but is bypassed in practice. That creates confidentiality gaps, weakens authenticity checks, and can leave encrypted content inaccessible when keys are lost, revoked, or replaced.

Failure mechanism: Operational friction pushes users toward unencrypted channels, stale keys, skipped verification, and informal recovery methods. An attacker does not need to break PGP if the organisation already trains users to ignore the control or accepts ambiguous trust relationships.

Impact: Sensitive messages may travel unprotected, spoofed or altered communications may be trusted, and important encrypted data may become unrecoverable or dependent on manual exception handling.

Practitioner Guidance

What to prioritise: Treat key ownership, verification, rotation, revocation, and recovery as the actual control, not a back-office detail. If those functions are not usable for ordinary staff, the encryption layer will not sustain broad adoption.

What to verify: Confirm that a new employee, partner, or device can be brought into the key process without manual ambiguity, and that a lost key does not force the business into insecure workarounds. Also verify that signature checking is part of the workflow, not an optional extra that depends on memory.

Practitioner takeaway: PGP succeeds only when the organisation can operate trust material at the same pace as the business; otherwise the control quietly collapses into partial coverage, exceptions, and misplaced confidence.

Related resources from NHI Mgmt Group

• What happens when organisations rely on two-factor authentication without stronger password and access policies?
• What breaks when organisations rely on encryption without strong key management and access controls?
• What happens when organisations try to enforce access policy without a unified identity view?
• What happens when organisations rely on policy assumptions instead of testing MFA across all critical systems?