New Research Shows That Legacy PKI Puts Digital Identities at Risk, With 56% of Organizations Experiencing Services Disruption

Key Terms

public key infrastructure technical

A public key infrastructure (PKI) is the system of digital keys, certificates and trusted procedures that proves who is on the other end of an electronic interaction and encrypts the data they exchange. Think of it as a verified digital mailroom and set of padlocks: one key is shared publicly to lock messages and a matching secret key unlocks them, which helps prevent fraud, supports secure transactions, regulatory compliance and preserves investor trust in a company’s digital operations.

pki technical

PKI (Public Key Infrastructure) is a system that creates and manages digital “keys” and electronic certificates to prove identities and secure online communications, like a bank vault and ID card for data. For investors, PKI matters because it helps prevent fraud, ensures that financial documents and trading instructions are genuine, and reduces regulatory and operational risk tied to hacked accounts or tampered disclosures.

cryptography technical

Cryptography is the set of techniques that use math-based codes to keep information private, verify identities, and ensure data cannot be altered—think of it as digital locks and sealed envelopes for information. It matters to investors because it underpins the security of online transactions, protects customer and company data, and affects the reliability and regulatory risk of digital services and assets; weak cryptography can undermine value and trust.

certificate authority (ca) technical

A certificate authority is a trusted organization that issues and signs digital IDs (certificates) used to verify the identity of websites, apps, and electronic documents—like a digital notary or passport that confirms who you're dealing with online. Investors care because these certificates enable secure, encrypted communications and help prevent fraud or spoofed sites; a compromised or mismanaged authority can cause data breaches, trading interruptions, regulatory fines, and loss of market confidence.

zero trust technical

Zero trust is a security approach that assumes no one, whether inside or outside an organization, should be automatically trusted. Instead, every access request is carefully verified before being granted, much like checking ID at every door rather than trusting someone just because they are known. For investors, it emphasizes the importance of protecting digital assets and data from potential breaches, reducing overall risk.

• Public key infrastructure (PKI) security is under pressure from growing numbers of machine and workload identities
• Legacy and manual PKI approaches drive up costs and risk
• Over half of organizations hit by unplanned outages due to expired certificates
• 60% experienced exploits as a result of weak cryptography

NEWTON, Mass. & PETACH TIKVA, Israel--(BUSINESS WIRE)-- CyberArk (NASDAQ: CYBR), the global leader in identity security, today announced the findings of a new report: Trends in PKI Security: A Global Study of Trends, Challenges & Business Impact. Conducted by Ponemon Institute, a leading independent research firm, the CyberArk-commissioned research analyzes perspectives from nearly 2,000 IT and security practitioners globally on the state of public key infrastructure (PKI) security. It reveals that outdated PKI systems are the leading barrier to secure certificate management, fueling security exploits in 60% of organizations.

PKI is a system for creating and managing digital certificates that verify the identities of users and devices. Modern identity demands – driven by the rise of machine and workload identities across cloud native and zero trust environments – have resulted in unprecedented certificate growth and complexity.

Legacy PKI systems and rapid certificate growth are hidden cost drivers
The report shows that PKI remains essential for secure digital identity, but legacy systems with fragmented approaches and manual, human-led processes can’t keep up with today’s certificate needs. Without a modern, automated approach, the gap between certificate demand and organizational capacity will only widen, leaving organizations facing resource constraints and increased operational costs.

• 34% of organizations cite legacy PKI costs and risks as the top barrier to secure PKI.
• On average, organizations oversee more than 114,000 internal certificates but have only four full-time staff dedicated to PKI management.
• 63% are forced to outsource PKI management due to resource and expertise shortages.

Manual processes amplify security risks
Manual tracking and renewal processes are both inefficient and potentially risky for organizations, causing costly services disruption and security exploits.

• 56% have suffered unplanned outages due to expired certificates or configuration errors.
• 60% experienced security exploits as a result of weak cryptography.
• 58% suffered third-party certificate authority (CA) compromises.
• 43% experienced server private key theft.

“The rapid expansion of machine identities has completely changed the PKI operating model. The complexity of managing an increasing number of certificates is compounded by legacy systems, manual processes and resource constraints,” said Kurt Sand, GM of Machine Identity Security at CyberArk. “As certificate volumes grow and certificate lifespans continue to shrink, the financial and operational impact of unmanaged PKI will escalate rapidly. Now is the time for organizations to automate and modernize their PKI to reduce operational burdens and improve their overall security posture.”

Unified visibility and automation boost PKI effectiveness
The report finds that overall confidence in compliance and security is low. Organizations investing in automation and unified visibility see reduced operational burdens, fewer outages and better levels of PKI compliance.

• Only 46% of organizations are highly confident that their PKI can meet compliance requirements, and less than half (48%) are certain that their PKI is effective against cyberattacks or internal threats.
• Organizations with high confidence in their PKI compliance are more likely to have unified visibility into their certificate inventory (75% vs. 47% overall). Most (61%) of these organizations have adopted AI as part of their PKI strategy, against 50% of the overall sample.

“PKI is critically important to ensuring trust, security and privacy in digital communications. However, as shown in the research, organizations lack confidence in the ability of PKI to protect against security threats and keep up with their growing devices and workload demand,” said Dr. Larry Ponemon, chairman and founder of Ponemon Institute. “To increase PKI’s effectiveness, I believe more companies will be adopting AI to reduce operational burdens and have stronger security outcomes.”

To download the full report and access additional study findings, visit https://www.cyberark.com/resources/analyst-reports/ponemon-institute-trends-in-pki-security-a-global-study-of-trends-challenges-business-impact.

Additional Resources:

• Blog post
• Infographic
• “PKI Under Pressure: What Ponemon’s New Global Research Reveals for 2026” webinar (February 3, 2026, 2:00pm ET)

About CyberArk
CyberArk (NASDAQ: CYBR) is the global leader in identity security, trusted by organizations around the world to secure human and machine identities in the modern enterprise. CyberArk’s AI-powered Identity Security Platform applies intelligent privilege controls to every identity with continuous threat prevention, detection and response across the identity lifecycle. With CyberArk, organizations can reduce operational and security risks by enabling zero trust and least privilege with complete visibility, empowering all users and identities, including workforce, IT, developers and machines, to securely access any resource, located anywhere, from everywhere. Learn more at cyberark.com.

Copyright © 2026 CyberArk Software. All Rights Reserved. All other brand names, product names, or trademarks belong to their respective holders.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260121485978/en/

Investor Relations:

Kelsey Turcotte

CyberArk

617-558-2132

ir@cyberark.com



Media:

Rachel Gardner

CyberArk

603-531-7229

press@cyberark.com

Source: CyberArk