Why it matters now: Every PLC, HMI, and SCADA node on an industrial network depends on digital certificates for secure authentication. Yet the framework managing those certificates — Public Key Infrastructure (PKI) — is buckling under the weight of AI-driven expansion, post-quantum cryptography (PQC) mandates, and certificate lifecycles shrinking to as little as 45 days. A landmark 2026 market study from HID Global confirms what OT security engineers have long feared: the automation gap is no longer a back-office inconvenience — it is an existential risk to industrial uptime.
Analyst Insight: In IT environments, an expired certificate might interrupt a web service. In an OT environment, an expired certificate on a PLC-to-PLC communication channel can halt a production line, trigger safety system faults, or isolate a substation. The blast radius is measured in revenue per minute, not page-load latency.
The 52% Statistic That Should Alarm Every Plant Manager
HID Global's 2026 market study, PKI in the Age of AI and Automation, surveyed 300 IT and security leaders across the United States and Europe. The headline finding: 52% of respondents cited the lack of automation or tooling as one of the single biggest challenges to effective PKI management.
This is not a marginal concern. Organizations in the survey reported experiencing, on average, one PKI-related incident per quarter — outages, expired certificates, or authentication failures that disrupt operations. For industrial enterprises where PLC-driven processes run 24/7, even one quarterly incident represents unacceptable risk.
Key Survey Data: HID 2026 PKI Market Study at a Glance
-
67% of organizations are already automating certificate renewals — yet incidents persist.
-
61% plan to invest in PKI automation within the next 24 months.
-
39% actively track their full certificate inventory — meaning the majority lack complete visibility.
-
34% cite AI agent certificates as a top-three emerging trend; 16% are already issuing them.
-
Average: 1 PKI-related outage or incident per quarter per organization surveyed.
- Post-quantum cryptography (PQC) readiness remains critically low across all sectors.
Source: HID Global, "PKI in the Age of AI and Automation," March 2026; n=300 IT and security leaders, US & Europe.
The Industrial Dimension: Why PLCs Are in the Crosshairs
Industrial control systems (ICS) and PLC environments operate under a fundamentally different paradigm from enterprise IT. A PLC managing a chemical batch process, a turbine governor, or a water treatment stage cannot simply "reboot and retry" when a certificate expires. The convergence of three forces makes this particularly dangerous right now.
Shrinking Certificate Lifecycles Meet Decade-Spanning Industrial Hardware
The industry trend is accelerating toward 90-day — and in some cases 45-day — certificate validity periods, driven by browser root programs and compliance frameworks. Yet PLCs and industrial controllers routinely remain in service for 10 to 20 years. Without automation, manual rotation of certificates across hundreds or thousands of OT endpoints becomes mathematically impossible to sustain.
Market Trend: The 45-day certificate lifecycle, already adopted by Apple's root program, is expected to become an industry norm within 2–3 years. For an OT network with 5,000 devices, that translates to roughly 40 certificate renewals every single day — an impossible workload without automated certificate lifecycle management (CLM).
IEC 62443 Compliance Depends on PKI — But the Standard Doesn't Automate Itself
IEC 62443, the international standard for IACS security, mandates strong authentication (Foundational Requirement 1 — FR1) across zones and conduits. PKI is the primary mechanism for delivering this at scale. Yet the 2024 revision of IEC 62443-2-1 introduces maturity models and security program elements that implicitly require automated, auditable certificate management. Organizations relying on spreadsheets and manual processes will find compliance increasingly out of reach.
AI Agents Arrive on the Factory Floor
The HID study reveals that 16% of enterprises are already issuing digital certificates for AI agents — software entities that autonomously interact with systems, including industrial control loops. As predictive maintenance AI, autonomous quality-inspection agents, and digital twin orchestrators proliferate in manufacturing, each agent requires a verifiable machine identity. In a PLC context, an AI agent issuing control commands without a trusted certificate is a vector for catastrophic process manipulation.
Post-Quantum Cryptography: The Slow-Motion Crisis for OT
Post-quantum cryptography readiness was flagged in the HID study as "critically low" across respondents. For industrial operators, the implications are especially severe. Unlike IT servers that can be patched or replaced in 3–5 year refresh cycles, industrial PLCs and field devices often operate on firmware that cannot support the new NIST-standardized PQC algorithms (CRYSTALS-Kyber, CRYSTALS-Dilithium, et al.) without hardware replacement.
The migration to quantum-safe certificates will require a cryptographic inventory across every device in the OT estate — a task that is impossible without automation. Organizations that have not automated their PKI today will find the PQC migration window, expected between 2028 and 2033, catastrophically compressed.
PQC Timeline: What Industrial Operators Need to Know
-
2024: NIST publishes final PQC standards (FIPS 203, 204, 205).
-
2025–2027: Early adopters begin hybrid (classical + PQC) certificate deployments.
-
2028–2030: Browser root programs and regulatory bodies begin mandating PQC-only certificates.
-
2030–2033: Quantum computing expected to reach cryptographically relevant scale; "harvest now, decrypt later" attacks become actionable.
-
OT Impact: Industrial devices deployed today with 15-year lifecycles will be in service during the PQC-mandatory window. Certificate agility is non-negotiable.
Automation Is the Bridge — But 61% Are Still Planning, Not Doing
The HID study offers a glimmer of optimism: 67% of organizations are already automating certificate renewals, and 61% plan to invest in PKI automation within the next two years. However, the gap between "planning to invest" and "operationally deployed" is where industrial risk accumulates.
For OT and PLC environments, effective PKI automation means more than auto-renewal. It requires:
-
Complete device discovery and cryptographic inventory across IT/OT boundaries.
-
Protocol-aware certificate provisioning that supports industrial protocols (Modbus/TLS, OPC UA, EtherNet/IP with CIP Security, PROFINET).
-
Offline and air-gapped issuance for isolated industrial zones.
-
Integration with ICS asset management platforms and SIEM/SOAR for unified visibility.
Analyst Insight: The industrial sector has a narrowing window — estimated at 18 to 24 months — to deploy automated PKI before the combined pressure of 45-day certificate lifecycles, AI agent proliferation, and PQC migration deadlines makes manual management indefensible. Organizations that treat PKI automation as an IT-only initiative, without OT operations at the table, will face the steepest remediation costs.
Frequently Asked Questions
What makes PKI automation different in OT vs. IT environments?
OT environments feature legacy devices with long lifecycles, air-gapped or segmented networks, real-time deterministic communication requirements, and safety-critical processes. PKI automation in OT must support industrial protocols (OPC UA, Modbus/TLS, EtherNet/IP), handle offline certificate issuance for isolated zones, and integrate with ICS-specific asset inventories — all without disrupting production. IT-centric PKI tools often lack these capabilities.
How does certificate expiry directly threaten PLC operations?
When a TLS certificate on a PLC or SCADA interface expires, secure communication channels fail. Depending on the system architecture, this can block data exchange between controllers and supervisors, prevent operators from acknowledging alarms, or — in safety-instrumented systems — force a fail-safe shutdown. Unlike IT services that can gracefully degrade, industrial processes often lack graceful fallback modes for authentication failures.
Is PKI automation required for IEC 62443 compliance?
While IEC 62443 does not explicitly mandate PKI automation, its Foundational Requirements (particularly FR1 — Identification and Authentication Control, and FR3 — System Integrity) are practically unachievable at scale without automated certificate lifecycle management. The 2024 revision of IEC 62443-2-1 introduces maturity-based security program elements that further incentivize automated, auditable identity management across IACS environments.
What should industrial operators prioritize first?
Begin with a complete cryptographic inventory: discover every certificate deployed across your OT estate, including those embedded in PLC firmware, HMI panels, engineering workstations, and IIoT gateways. From there, map certificate expiry timelines against planned maintenance windows, and deploy automated renewal for the most critical (and most frequently expiring) certificates first. Engage OT engineers alongside IT security teams — PKI automation in industrial environments is a joint operational discipline, not solely an IT project.
