The ITRADE Dispatch Issue #11 · October 7th, 2026 (Full)

On the morning of December 6, 2018, smartphones across the United Kingdom and Japan stopped loading data. O2, the UK's second-largest mobile network, and SoftBank in Japan lost 4G service for most of the day. Ericsson, which supplied core network software to both carriers, traced the failure to expired certificates in that software (Reuters; Ofcom). The cause was internal. A credential that one machine used to prove its identity to another reached its end date, and the systems that depended on it stopped trusting each other.

Eight years later, that failure mode is routine. CyberArk's 2025 State of Machine Identity Security Report, a survey of more than 1,200 security leaders, found that 72% of organizations had at least one certificate-related outage in the past year, and 45% now see them weekly, up from 12% in 2022. Half linked a security incident or breach to a compromised machine identity, with API keys and TLS certificates at the top of the list.

Why this belongs on every leadership agenda

A machine identity is any credential that lets software, a device or a service authenticate without a person: TLS certificates, API keys, service accounts, tokens, SSH keys. CyberArk's 2025 Identity Security Landscape counts 82 of them for every human in the average organization. A hospital's EHR exchanging results with its lab, a law firm's document platform feeding e-billing, a carrier's routing system pulling from a customer's warehouse API, a utility's metering platform: all of them run on these credentials.

Three forces are now converging on that inventory.

1. Certificate lifespans are shrinking on a fixed schedule. In April 2025 the CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for public TLS certificates, approved Ballot SC-081. Maximum validity fell from 398 days to 200 days in March 2026. It drops to 100 days in March 2027 and to 47 days in March 2029, when domain validation data can be reused for only 10 days. An organization that renews a few hundred certificates once a year by hand will be renewing each of them about eight times a year.

2. Quantum-safe cryptography has a deadline. NIST published its first three post-quantum standards (FIPS 203, 204 and 205) in August 2024. Its draft transition plan, NIST IR 8547, proposes deprecating today's RSA and elliptic-curve algorithms at the 112-bit security level after 2030 and disallowing them after 2035. Every certificate, key and embedded device has to be found before it can be migrated.

3. AI agents are multiplying the inventory. Gartner predicts that 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5% in 2025. Each agent that books, buys, queries or approves on someone's behalf needs credentials. OWASP's 2025 Non-Human Identities Top 10 ranks improper offboarding first: identities that stay active and exploitable after the service they supported is retired.

The pattern across sectors

Verizon's 2025 Data Breach Investigations Report found that breaches involving a third party doubled to 30%, and that the median time to remediate secrets leaked in a public GitHub repository was 94 days. Healthcare, legal, logistics and finance systems exchange data with partners all day, so the credential that fails or leaks may sit in a vendor's environment.

Manual management carries a measurable cost. Keyfactor's 2024 PKI & Digital Trust Report found organizations averaged three outages from expired certificates over 24 months, each taking about 2.6 hours to identify and 2.7 hours to fix. Teams tracking certificates in spreadsheets or homegrown tools were more likely to have three or more.

What to do Monday morning

Bianca architects the systems most leaders buy in pieces - talent, technology, and security, designed to work as one.