CyberArk Finds Legacy PKI Security Disrupts 56% of Organizations

CyberArk released results from a new report, Trends in PKI Security: A Global Study of Trends, Challenges & Business Impact. Conducted by the Ponemon Institute, the study surveyed nearly 2,000 IT and security professionals worldwide and found that legacy (public key infrastructure) PKI systems are the top obstacle to secure certificate management, contributing to security breaches in 60% of organizations.

PKI is a system for creating and managing digital certificates that verify the identities of users and devices. Modern identity demands, driven by the rise of machine and workload identities across cloud native and zero trust environments, have resulted in unprecedented certificate growth and complexity.

Legacy PKI systems and rapid certificate growth are hidden cost drivers

The report shows that PKI remains essential for secure digital identity, but legacy systems with fragmented approaches and manual, human-led processes can’t keep up with today’s certificate needs. Without a modern, automated approach, the gap between certificate demand and organizational capacity will only widen, leaving organizations facing resource constraints and increased operational costs.

34% of organizations cite legacy PKI costs and risks as the top barrier to secure PKI.
On average, organizations oversee more than 114,000 internal certificates but have only four full-time staff dedicated to PKI management.
63% are forced to outsource PKI management due to resource and expertise shortages.

Manual processes amplify security risks

Manual tracking and renewal processes are both inefficient and potentially risky for organizations, causing costly services disruption and security exploits.

56% have suffered unplanned outages due to expired certificates or configuration errors.
60% experienced security exploits as a result of weak cryptography.
58% suffered third-party certificate authority (CA) compromises.
43% experienced server private key theft.

“The rapid expansion of machine identities has completely changed the PKI operating model. The complexity of managing an increasing number of certificates is compounded by legacy systems, manual processes and resource constraints,” said Kurt Sand, GM of Machine Identity Security at CyberArk. “As certificate volumes grow and certificate lifespans continue to shrink, the financial and operational impact of unmanaged PKI will escalate rapidly. Now is the time for organizations to automate and modernize their PKI to reduce operational burdens and improve their overall security posture.”

Unified visibility and automation boost PKI effectiveness

The report finds that overall confidence in compliance and security is low. Organizations investing in automation and unified visibility see reduced operational burdens, fewer outages and better levels of PKI compliance.

Only 46% of organizations are highly confident that their PKI can meet compliance requirements, and less than half (48%) are certain that their PKI is effective against cyberattacks or internal threats.
Organizations with high confidence in their PKI compliance are more likely to have unified visibility into their certificate inventory (75% vs. 47% overall). Most (61%) of these organizations have adopted AI as part of their PKI strategy, against 50% of the overall sample.

“PKI is critically important to ensuring trust, security and privacy in digital communications. However, as shown in the research, organizations lack confidence in the ability of PKI to protect against security threats and keep up with their growing devices and workload demand,” said Dr. Larry Ponemon, chairman and founder of Ponemon Institute. “To increase PKI’s effectiveness, I believe more companies will be adopting AI to reduce operational burdens and have stronger security outcomes.”

To download the full Trends in PKI Security: A Global Study of Trends, Challenges & Business Impact report and access additional study findings, visit the website here.

CyberArk Unveils AI Identity Security with Advanced Privilege Controls