Developed in the 1970s, the first evolution of public key infrastructure (PKI) was designed for users and websites. There was one certificate per account and no way to truly verify the identity of whoever held the key.
Roughly fifty years later, PKI has become a complex system of network infrastructure that keeps the web and private systems secure. The explosion of new browsers, users, and over the past five decades has meant an ever-growing web of PKI solutions.
And now we’re looking at the next leap in PKI evolution as quantum threats loom and AI agents take up a larger slice of network traffic. These challenges demand cloud-based solutions that pair automated security with human-in-the-loop oversight, integrate quantum-safe algorithms and move at agentic speed and scale. As we celebrate 50 years of PKI, here are our top predictions for the future of PKI and trends to watch.
True AI Agent Security Depends on PKI
“It’s very hard to predict what’s coming next [in agentic AI] and how agents are going to solve a specific problem. Organizations relying exclusively on a static security rule set and outdated enforcement mechanisms will increasingly struggle as capabilities evolve. You need to have dynamic security controls, or else they’re going to be bypassed by the next AI agent.”
Ron F. Del Rosario, Co-Founder of the OWASP Agentic Security Initiative (ASI)
With the scope and speed of AI agents, it’s increasingly difficult to maintain traditional human-in-the-loop procedures. So how can you manage non-human identities in a way that works with your existing infrastructure and keeps your organizational resources secure without impeding core tasks?
That’s where PKI can help. The future of PKI depends on the ability of PKI for AI agents to accommodate this scale.
By 2030, it’s estimated that more than half of all enterprises will operate at least 500 AI agents. That’s on top of all the users, managed devices, and BYODs that also pass through your authentication and identity management systems.
Modern enterprises need advanced PKI tools with certificate lifecycle management (CLM) to manage human and non-human identities together. That means hardware-bound, certificate-based authentication for humans and devices, ephemeral SPIFFE Verifiable Identity Documents (SVIDs) for agents, and active tracking and revocation for everything.
Learn more about agentic security in our interview with OWASP ASI co-founder Ron F. Del Rosario.
As we look to the future, perhaps the most important function of modern PKI is its adherence to post-quantum cryptography (PQC) standards.
Quantum Readiness Requires PKI to Evolve
“PKI and certificates using digital signatures [are] certainly going to be challenging. We haven't yet come up with the best way to completely [use PQC signatures for] this. …
“One of the challenges for this is because the algorithm we selected, ML-DSA, that most people are going to be using, its signature sizes are a lot larger than what we're used to. So whereas RSA and ECC were a couple hundred bytes, ML-DSA is over 2,000 bytes, so that increased signature size is going to throw a wrench into some of the protocols and applications, particularly when you look at certificate chains and in PKI. …
“It's a very much active area that people are working on to figure out how we're going to use these PQC signatures with our certificates in PKI in a sensible way.”
Dustin Moody, Mathematician for the Cryptographic Research Group at the National Institute of Standards and Technology (NIST)
In 2025, ABI Research estimated that only 2% of PKI solutions offered PQC algorithm support. By 2030, ABI expects that to triple — but some experts say Q-Day could arrive as early as 2029. If that happens, and ABI’s predictions hold, 94% of PKI solutions may still be unprepared when modern cryptographic standards break.
Even if Q-Day arrives after 2030, PQC preparedness matters now. In August 2024, NIST established three standards for quantum-safe authentication, intended for immediate adoption. And hackers have already begun to collect sensitive encrypted data for future decryption with Harvest Now, Decrypt Later attacks. Without quantum-resistant algorithms, basic PKI can’t fully protect your organization or its data.
Quantum readiness requires cryptographic agility, also known as crypto-agility: a system’s ability to exchange outdated encryption algorithms for quantum-resistant algorithms without downtime or disruption. This requires careful analysis of existing cryptographic standards and identification of any new tools required to support the transition.
Explore more tips for PKI quantum readiness in our interview with NIST mathematician Dustin Moody.
Crypto-agility is essential for the future of PKI. But as the validity period of certificates for both human and non-human identities decreases, organizations must prepare for a higher volume of certificates than ever before.
Certificate Lifespans Will Continue to Shrink
“A lot of the risk [of key theft in PKI] can be mitigated by lifecycle. Shorter key lifespan certainly decreases the risk of a subverted key, but it doesn’t decrease the systematic risk of the incentive misalignment that’s endemic to the PKI ecosystem. So I think you need some customization that is risk aware and task aware.”
L. Jean Camp, Bank of America Distinguished Professor in Cyber Analytics at the University of North Carolina at Charlotte
Shorter certificate lifespans help combat multiple security issues, from intercepted traffic to leaked credentials and even malicious intent by untrustworthy certificate authorities (CAs), as Camp references above.
The April 2025 passing of CA/Browser Forum’s Ballot SC-081v3 was intended to improve certificate reliability and reduce those risks. Now, all public TLS certificates issued since March 2026 must expire in 200 days or less. By March 2027, the window shrinks to 100 days — and by March 2029, to just 47 days.
Short-lived certificates like these help protect user and device identities. But a single AI agent may spin up and complete its useful life within a matter of minutes; a rogue agent can wreak havoc with a 47-day certificate. That’s why X.509-SVIDs are critical for agentic AI: truly ephemeral certificates lasting just 5-15 minutes.
But successful CLM that meets the 47-day mandate — not to mention minutes-long agentic SVIDs — isn’t realistic for organizations still managing on-premise PKI servers. With 56% of organizations already experiencing unplanned outages from certificate errors, agentic scale will break manual PKI.
The transition to cloud PKI is no longer optional, but it doesn’t have to be difficult. Cloud-based managed PKIs can stand up in hours, work with proprietary and open-source services, and even support Active Directory (AD) in the cloud.
Learn more about PKI trustworthiness and lifecycle management in our interview with UNC cyber analytics professor L. Jean Camp.
Prepare Now for the Future of PKI
Any transition — whether infrastructure, tools, or processes — begins with a thorough audit of your existing PKI. Will it accommodate your growing workforce and agentic fleet? Is it quantum-ready? Can it handle rotation at scale without outages?
JoinNow Dynamic PKI is built to protect organizations now and into the future. Our managed PKI reduces the demand of in-house lifecycle management, issues PQC-ready certificates, and manages human and non-human identities together in the same infrastructure.
Schedule a demo to see how SecureW2 can help prepare your organization for the future of PKI.
