Visibility, automation, and crypto agility for the era of 47-day certificates and quantum readiness.
Enterprises are running into four pressures at once. Public certificate lifespans are shrinking toward a 47-day validity. A post-quantum cryptography transition is already underway, with new algorithms and hard deadlines attached. Machine identities (such as workloads, containers, IoT devices, and services), which now outnumber human identities by 109:1, are multiplying faster than any team can track by hand. And when a certificate authority is compromised or distrusted, every certificate it issued has to be replaced at once.
Together, these four pressures are hitting simultaneously on network and enterprise infrastructure that was never built for this pace. Certificate expiry, which used to be a calendar reminder, is now a leading cause of outages, handled by teams that are small and already stretched thin.
Getting through this takes three things working together: visibility into every certificate you hold, automation that keeps pace with renewal cycles, and the crypto agility to change algorithms without breaking production. And Palo Alto Networks introduced Next-Generation Trust Security (NGTS), a network-native platform that helps address these four pressures under a single control framework.
Certificate lifecycle management is no longer optional
Shrinking certificate lifespans, machine-identity sprawl, and post-quantum deadlines are pushing enterprises toward crypto-agile PKI infrastructure.
Why Certificate Risk Is Scaling
The scale of this problem is easy to underestimate until you look at what enterprises are actually running. A PKI modernization report by the Ponemon Institute (commissioned by CyberArk, a Palo Alto Networks company), shows how widespread the problem is:
What the Ponemon Data Shows
- Organizations manage an average of 114,000+ internal certificates.
- 56% have experienced an outage caused by certificate expiration or misconfiguration.
- The average PKI team has about 4 people.
- 53% still rely on manual or ad-hoc PKI assessment methods.
- 48% say they cannot locate all of their certificates.
- 52% cannot replace certificates fast enough when they need to.
- 58% have experienced a CA compromise incident, and 52% say they can’t respond to CA events effectively.
- 34% cite legacy PKI cost and risk as the top barrier to security.
Put together, a six-figure certificate estate is often managed by a four-person team, using manual processes, without a complete view of what they actually own. That’s not a staffing gap you hire your way out of. It’s a structural mismatch between how certificates are managed and how fast they now need to move.
Four Pressures Ticking at Once
Certificate risk is scaling because the ground underneath it is shifting all at once. Four separate changes are converging on the same certificate estate, and each one raises the cost of managing it manually.
47-Day Readiness
The CA/Browser Forum’s Ballot SC-081v3, passed in April 2025, locked in a phased reduction of public TLS certificate lifespans, dropping them incrementally from the old 398-day maximum to just 47 days from March 2029. Domain-validation reuse windows shrink on the same schedule.
The official rollout schedule operates on the following key dates:
- March 15, 2026 (in effect now): Maximum certificate lifespan is reduced to 200 days.
- March 15, 2027: Maximum certificate lifespan drops further to 100 days.
- March 15, 2029: Final implementation caps the maximum TLS certificate lifetime at 47 days.
Each phase multiplies how often a certificate has to be found, validated, and replaced. This rapid renewal cycle makes Certificate Lifecycle Management (CLM) automation essential.
Quantum Readiness
NIST finalized its first post-quantum cryptography standards, FIPS 203, 204, and 205, in August 2024. Federal guidance under CNSA 2.0 has attached firm migration timelines on top of them. The urgency here isn’t about waiting for quantum computers to arrive. Encrypted traffic captured today can be stored and decrypted later, once the computing power exists, a pattern known as harvest-now-decrypt-later. That means the risk clock started the moment the data was captured, not when quantum computing becomes operational. What enterprises need well before that point is the ability to inventory every cryptographic dependency they have and re-issue at scale. That’s crypto agility.
Machine-Identity Sprawl
Workloads, containers, Kubernetes clusters, services, and devices all need their own identity, and each one depends on a certificate. This population has grown past anything a person can track manually, and it keeps growing.
CA Distrust and Trust-Chain Events
When a certificate authority is compromised or distrusted, every certificate it issued needs to be replaced on a compressed timeline, often industry-wide and all at once. Most organizations don’t have a structural way to respond to that kind of event today, which is why CA-neutral orchestration matters.
Four different pressures, but they land on the same three capabilities. You can’t manage certificates you can’t see. Renewal velocity is now faster than manual processes can absorb. And the algorithms supporting everything are due to change. Visibility, automation, and crypto agility aren’t three separate problems. They’re one problem with three parts, and they need a place to run together.
This is the gap that Palo Alto Networks aims to close with Next-Generation Trust Security (NGTS). Rather than adding another standalone tool to track certificates, NGTS puts certificate governance directly into the network control plane.
What Is NGTS and Where It Sits
NGTS is Palo Alto Networks’ enterprise certificate lifecycle management and modern PKI capability, delivered through Strata Cloud Manager, the same control plane that already manages firewalls, remote-access gateways, inspection services, and SASE connectivity. Certificate visibility and policy enforcement run alongside network enforcement instead of sitting off to the side in a separate system.
That placement is the point. Most certificate outages trace back to a blind spot: nobody had visibility into a certificate until it had already expired and taken something down. When the system enforcing traffic and the system governing certificates share the same plane, that blind spot closes. The certificates most likely to cause an outage are the ones touching the network’s estate, and those are exactly the ones NGTS can now see and govern from a single place.
The Four NGTS Capability Pillars
Underneath the platform are four specific capabilities, and each one maps directly to one of the pressures already covered: visibility, automation, modern PKI, and crypto agility. Here’s what each one actually does.
Enterprise Visibility — See Every Certificate
NGTS builds a unified inventory of public and private certificates across firewalls, remote-access gateways, workloads, Kubernetes clusters, and internal systems. Ownership, expiry, issuing authority, and policy status all live in one authoritative view, instead of scattered across teams and spreadsheets.
Lifecycle Automation — Absorb the Velocity
Certificate lifecycle workflows from issuance, renewal, deployment, and rotation, to validation are automated from end to end, eliminating manual tracking and emergency renewals. This enables teams to absorb renewal acceleration and prevent certificate outages.
Modern Private PKI — Retire the Legacy CA
NGTS offers SaaS-based private PKI with flexible root and intermediate hierarchy design, standards-based enrollment through ACME, EST, and SCEP, and high availability across regions. Hardware-bound CA maintenance goes away, and key operations stay secure without the infrastructure overhead that came with running it in-house.
Crypto Transition — Change Algorithms Without Breaking the Network
NGTS identifies where cryptographic dependencies actually sit and coordinates large-scale re-issuance across public and private domains. That’s what algorithm deprecation and post-quantum migration require, and it’s designed to happen without destabilizing the control plane it runs on.
What Sets NGTS Apart
Most enterprises already run some combination of certificate tooling, and each approach handles part of the job well. The gaps show up in what’s left uncovered.
1 Standalone CLM Tools
These handle renewal workflows well, but they operate outside network enforcement and offer limited PKI architecture or post-quantum support. Certificate governance stays separate from the systems actually enforcing traffic.
2 Legacy Enterprise PKI
Hardware-bound CA hierarchies centralize issuance, but they’re costly and slow to re-issue at scale. That’s a real problem when a distrust event or algorithm change forces a large re-issuance on a tight timeline.
3 Cloud-Native Issuers
These work well within the specific workloads or clusters they were built for, but that coverage doesn’t extend outward. Governance stays fragmented across the rest of the enterprise.
4 Public CAs
Public CAs issue and validate certificates, which is exactly what they’re designed to do. What they don’t do is manage deployment or provide internal lifecycle governance once a certificate is issued.
Each of these covers part of the problem well. What none of them do on their own is unify public and private trust under one model, align lifecycle execution with network enforcement, integrate multiple CAs without dependency on any single one, and coordinate CA transitions and post-quantum readiness as they come. That’s the gap NGTS is built to close, not by replacing these tools outright, but by bridging the gaps between them.
NGTS Synergy Thesis: Firewalls Meet Machine Identity
NGTS brings together two disciplines that grew up apart: network enforcement and machine identity management. Understanding where each one came from is what makes the payoff of combining them clear.
Two Decades on Separate Tracks
Network security teams have spent the last twenty years building enforcement and visibility at the perimeter and across the fabric. They know what’s talking to what, where traffic flows, and when something looks wrong. Machine identity grew up somewhere else entirely, inside PKI and certificate infrastructure, often with no direct line into the network team’s view of the estate.
That split made sense when certificates changed once a year and network enforcement was a separate discipline. It stops making sense once certificate expiry becomes a network availability problem, which is exactly what’s happening now.
What Closing the Gap Actually Gets You
The certificates most likely to cause an outage are the ones touching the network estate: firewalls, remote-access gateways, inspection points, SASE connectivity. Those are also the certificates that, until now, sat furthest from the team with the clearest picture of network health.
NGTS puts governance over those certificates in the same place they’re enforced. It means the certificate about to take down a remote-access gateway is visible to the same system managing that gateway, before it expires, not after. That is what complete enterprise visibility means in practice.
Where Accutive Security Fits
Making that synergy real in a live environment takes someone fluent in both worlds. Network teams understand enforcement. PKI teams understand certificate lifecycle discipline. Few teams sit comfortably in both.
Accutive Security works at that intersection deliberately. We understand how a network control plane behaves under load and how a certificate lifecycle actually gets managed day to day, and we translate between the two so the synergy NGTS is built for shows up in practice, not just in the architecture diagram.
Continuity Through the Transition: Accutive Security’s Partnership
A Capability With a Longer History Than Its Current Name
NGTS didn’t appear from nothing. The technology underneath it traces back to Venafi, the company that pioneered machine identity management well before “machine identity” was a category anyone else was naming. CyberArk closed its acquisition of Venafi on October 1, 2024. Palo Alto Networks then closed its acquisition of CyberArk on February 11, 2026. Two ownership changes in under two years, and through both of them, the underlying discipline, how certificates get discovered, governed, and renewed at scale, stayed the same. What changed was the platform it now runs inside.
Accutive Security’s Role Across That Arc
Accutive Security has been a certificate-management and PKI implementation partner across that entire lineage, Venafi through CyberArk through Palo Alto Networks. That continuity wasn’t automatic. It came from staying hands-on with the technology through each transition, rather than treating a rebrand as a reason to start over.
What That Means for You
Vendor consolidation is disruptive by nature. Names change, support structures shift, and the people who knew the platform under its old name aren’t always the people supporting it under the new one. Working with Accutive Security means working with a team that knew this platform before NGTS was its name, and will still know it as it continues to evolve. That continuity is what de-risks adoption during exactly the kind of consolidation the market is going through right now.
Conclusion
The pressures behind all of this, shrinking certificate lifespans, the post-quantum transition, machine identity sprawl, and CA trust-chain events, aren’t slowing down, and Palo Alto Networks built NGTS to answer them from inside the network control plane where certificate risk actually shows up. The capability is there. What decides whether it works in your environment is execution.
That’s where Accutive Security comes in. We’ve implemented this technology across its entire lineage, and we know how to make the synergy between network enforcement and certificate governance real in a live environment.
See how Accutive Security operationalizes NGTS in your environment
Talk to our experts now.
Leave a Reply