Definition
Machine identity management is the set of capabilities that discover, issue, renew, rotate, monitor, and revoke the cryptographic identities, certificates and keys, used by machines, workloads, and cryptographic processes across an enterprise. It is the framing preferred by Gartner, by PKI-anchored vendors, and by organisations whose NHI problem is primarily a certificate problem.
In our taxonomy, machine identity management is the cryptographic subset of NHI. The broader NHI umbrella includes OAuth tokens, SaaS integrations, service accounts, and AI agents that machine identity management does not naturally cover. See NHI vs. machine identity for the vocabulary argument.
What falls under machine identity management
- TLS certificates for public-facing web services, private internal services, and load balancers
- mTLS certificates for service-to-service authentication in microservice meshes
- Code-signing certificates used to sign binaries, containers, and packages
- S/MIME and document-signing certificates
- SSH keys and SSH certificates
- IoT device certificates and device-identity attestations
- Cryptographic key pairs used for API signing, JWT signing, and similar
- PKI infrastructure itself, root CAs, issuing CAs, and their key material
The certificate lifecycle
Certificates follow a defined lifecycle that is longer-established than most other NHI primitives. The stages:
- Issuance. A certificate is issued by a Certificate Authority (CA), public (e.g. Let's Encrypt, DigiCert, Sectigo) or private (an internal PKI).
- Deployment. The certificate is installed on the relying machine or workload.
- Operation. The certificate is used to authenticate the machine. Monitoring tracks its validity.
- Renewal. Before expiry, the certificate is renewed and the new certificate deployed.
- Revocation. If the certificate's private key is compromised or the associated machine is retired, the certificate is revoked (published to a CRL or OCSP responder).
The typical failure points: certificates expire unexpectedly because renewal was manual and forgotten; certificates are over-provisioned because scope was broadened for convenience; revocation is rarely operationally effective because clients often do not check revocation status aggressively.
Key management
Machine identity management is tightly coupled with key management, the practice of generating, storing, rotating, and destroying the cryptographic keys underneath certificates and signing operations.
The tooling categories involved:
- Hardware security modules (HSMs), hardware devices that hold private keys and perform cryptographic operations without exposing the key. Vendors: Thales, Entrust, AWS CloudHSM, Azure Dedicated HSM.
- Cloud key management services (KMS), AWS KMS, Google Cloud KMS, Azure Key Vault. Cloud-native key storage and cryptographic operations.
- Certificate lifecycle management (CLM) platforms, Venafi (CyberArk), Keyfactor, AppViewX, DigiCert CertCentral, Sectigo Certificate Manager, GlobalSign. Issue, renew, revoke at scale.
- Short-lived certificate issuers, HashiCorp Vault, Smallstep, cert-manager in Kubernetes, Boundary.
Expiry outages, the cost of getting it wrong
Expired certificates cause outages. Some famous examples:
- Microsoft Teams expired certificate (2020), caused multi-hour global Teams outage.
- Microsoft Stadia (2021), Spotify (2021), LinkedIn multiple years, all high-visibility outages traced to expired certificates.
- Cisco, Tesla, and dozens of other vendors have had product outages attributed to certificate expiry during shipped-software windows.
The pattern is identical: a certificate was issued, it had an expiry date, nobody set up effective monitoring and renewal, the date arrived, and the product broke. Machine identity management exists to prevent this.
Vendor landscape
The commercial category is mature. In broad strokes:
- Incumbents: Venafi (acquired by CyberArk in 2024 for $1.54B; CyberArk subsequently acquired by Palo Alto Networks, deal closed February 2026), Keyfactor, DigiCert, Sectigo, AppViewX.
- Open-source and CNCF: HashiCorp Vault (acquired by IBM, 2024), cert-manager (CNCF Graduated), Smallstep.
- Cloud-native: AWS Certificate Manager, AWS Private CA, Google Certificate Authority Service, Azure Key Vault certificates.
- Emerging: spiffe.io / SPIRE for workload-bound certificates in the Kubernetes and service-mesh world, arguably a generational shift in how machine identity is issued and renewed.
Our vendor coverage of this space is in the vendor hub, including profiles of HashiCorp Vault and CyberArk/Venafi.
Post-quantum readiness
The field has a forward-looking concern: post-quantum cryptography (PQC). NIST standardised the first three post-quantum algorithms, ML-KEM (CRYSTALS-Kyber), ML-DSA (CRYSTALS-Dilithium), and SLH-DSA (SPHINCS+), in FIPS 203, 204, and 205 in August 2024. Organisations with significant PKI footprints have begun inventorying their cryptographic dependencies in preparation for algorithm transition.
For most organisations, post-quantum readiness is not yet an operational priority in 2026, but awareness of the inventory question (which certificates use which algorithms, where are they) is prudent. Most machine identity management vendors have begun shipping PQC-aware capabilities.
Frequently asked questions
What is machine identity management?
Machine identity management is the discipline of issuing, tracking, rotating and revoking the cryptographic credentials that machines use to authenticate: TLS certificates, SSH keys, code-signing keys and the private key material behind them. It grew out of PKI operations and is the term preferred by Gartner and by the certificate-lifecycle vendors, where newer specialised vendors tend to use non-human identity as the umbrella.
What is the difference between machine identity management and NHI governance?
Largely one of origin and emphasis rather than substance. Machine identity management centres on cryptographic credentials and certificate lifecycle; NHI governance centres on the identity, its owner and its permissions, across a broader set including API keys, OAuth tokens and AI agents. The two overlap heavily and are converging, which is why we treat certificate lifecycle and NHI governance as one programme rather than two.
Why is centralising machine identity difficult?
Because issuance is distributed by design. Certificates come from public CAs, internal PKI, service meshes, cloud providers and individual application teams, and each path was established to solve a local problem. Centralisation usually fails when attempted as a consolidation of issuers; it succeeds more often as a consolidation of visibility, with a single inventory across issuers and a common expiry and ownership model.
How does PKI relate to non-human identity?
PKI is one issuance mechanism for non-human identities, and historically the most rigorous. A certificate is a credential a machine presents to prove identity, which is the defining property of an NHI. The reason PKI has been treated as a separate discipline is organisational rather than technical, and shortening certificate lifetimes is collapsing that separation.
Is machine identity management becoming more urgent?
Yes, for a specific and dated reason. CA/Browser Forum ballot SC-081v3 reduces maximum public TLS certificate lifetimes to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. That is roughly an eightfold increase in renewal frequency, and any process that survives today because a person performs it annually does not survive at all.
Where does your programme actually sit?
Reading about NHI governance and measuring your own position are different exercises. The free maturity assessment scores you across discovery, ownership, credential control and evidence in about ten minutes, in your browser, and produces a written report.