In financial services, trust is more than a buzzword. Trust is the invisible infrastructure that supports everything from microlending and remittance to SWIFT transactions between multinational banks. But as digital ecosystems multiply and compliance mandates tighten, trust must evolve from a passive promise into a strategic, scalable foundation.
Die Sicherheitsverantwortlichen von heute müssen sich mit dieser Entwicklung auseinandersetzen - und zwar in Echtzeit.
Whether you’re enabling instant transactions, onboarding fintech partners, or integrating post-M&A systems, your ability to move fast depends on an often-overlooked layer: the public key infrastructure (PKI) that underpins digital trust.
This blog explores how the largest financial institutions are treating trust as a launchpad (not a liability!) and why doing so requires visibility, control, and post-quantum readiness at scale.
Die Infrastruktur des Vertrauens bricht zusammen
Früher war Vertrauen einfach: Schutz des Netzes, Authentifizierung des Nutzers, Verschlüsselung des Kanals. Heute wird von Vertrauen erwartet, dass es das ist:
- Continuous (available 24/7/365)
- Ubiquitous (in every API, cloud, app, and transaction)
- Provable (to auditors, regulators, and boards)
But legacy PKI systems weren’t built for this scale or scrutiny. They’re fragmented across cloud silos, tangled in manual processes, and vulnerable to one very human weakness: negligence, and its symptom, expiration.
In January 2024, the UK’s CHAPS real-time settlement system halted due to a single expired TLS certificate, disrupting high-value payments across one of the world’s most vital financial markets. A month later, it happened again. Microsoft 365 suffered a similar fate in June — taking down collaboration systems used across the industry.
These weren’t exotic zero-days. They were avoidable failures in trust governance.
From the outside, it looks like bad luck. But security leaders know better: these incidents reflect deeper issues in visibility, ownership, and resilience.
Warum Vertrauen scheitert
Jeder digitale Dienst ist auf Vertrauen angewiesen. Doch hinter den Kulissen verlassen sich viele Finanzinstitute auf:
- Siloed certificate management across DevOps, app teams, and cloud units
- Outdated tools bolted onto decades-old CA hierarchies
- Manual renewals that can’t scale with the speed of cloud-native development
Kurz gesagt, die Instrumente, die gestern Vertrauen geschaffen haben, können es morgen nicht mehr aufrechterhalten.
In der Zwischenzeit beschleunigt sich die FinServ-Innovation:
- Sofortige Zahlungen und Echtzeit-Abwicklung
- KI-gestützte Betrugserkennung und Identitätsprüfung
- Konsolidierung durch Fusionen und Übernahmen und Konvergenz der Plattformen
- Cloud-first-Initiativen mit Zero-Trust-Architekturen
- High-throughput applications demanded by customers
Jede dieser Maßnahmen führt zu neuen kryptografischen Abhängigkeiten. Aber die meisten Teams verwalten das Vertrauen immer noch wie im Jahr 2008.
Von Pflastern zur Widerstandsfähigkeit von Unternehmen
So how are leaders turning trust into a launchpad? Let’s look at what real institutions are doing.
🏦 M&T Bank: Skalierung des Vertrauens über hybride Umgebungen hinweg
Die M&T Bank musste nach einer großen technologischen Umstellung die kryptografische Governance sowohl in der alten Infrastruktur als auch auf modernen Plattformen vereinheitlichen. Mit Keyfactor haben sie gewonnen:
- Centralized visibility over all digital certificates
- Automated lifecycle management across cloud and on-prem
- Improved resilience against service outages from expired or misconfigured certs
Trust became a strategic enabler for secure DevOps and API modernization. This case study shows how Keyfactor has become a critical component in M&T’s security infrastructure.
💸 EQ Bank: Stärkung der Fintech-Innovation mit PKI
EQ Bank, one of Canada’s most digitally advanced banks, adopted a cloud-native trust infrastructure to support its rapid innovation cycles. They needed scalable certificate issuance to support everything from mTLS between microservices to digital onboarding.
Mit einem flexiblen, CA-agnostischen Ansatz hat die EQ Bank dies erreicht:
- Crypto-agility with support for hybrid classical + PQC certs
- Self-service automation for development teams
- Proactive controls to prevent outages and reduce support costs
For EQ, PKI was part of the product delivery engine. This case study demonstrates that, since running with Keyfactor Command, EQ Bank has not experienced a single certificate-related outage.
Die Macht der Interoperabilität
Wie vermeiden diese Organisationen also die "Rip and Replace"-Falle?
They use interoperable, CA-agnostic PKI solutions that:
- Work across legacy and modern environments
- Support multiple certificate authorities, public or private
- Integration mit Cloud-Plattformen, DevOps-Pipelines und Sicherheitstools
- Enable visibility and control from a single pane of glass
This flexibility is crucial, especially during M&A events or platform transitions. It allows institutions to modernize without breaking what works today.
Der Wechsel von Vertrauen zu Vertrauensmanagement
The biggest change? Forward-thinking banks are no longer treating PKI as background infrastructure. They’re putting it under governance — just like capital reserves, vendor risk, or insider threat controls.
It’s been argued that trust without governance is no trust at all. A patchwork of tools is not enough. Indeed, from the The Security Leader’s Digital Trust Playbook: Financial Services Edition:
"Man kann kein digitales Vertrauen in großem Umfang schaffen, ohne PKI als kritische Infrastruktur zu behandeln. Sie muss verwaltet, beobachtet, automatisiert und für Veränderungen ausgelegt sein.
And increasingly, it must also be ready for post-quantum threats.
Der kommende kryptografische Wandel
Die Auswahl von Post-Quantum-Algorithmen durch das NIST hat einen weltweiten Wandel eingeleitet. Von den Finanzinstituten wird erwartet, dass sie:
- Inventory where quantum-vulnerable algorithms are in use (RSA, ECC)
- Prepare systems for hybrid certificates (classical + PQC)
- Demonstrate crypto-agility to regulators before 2030
The real deadline isn’t when quantum computers arrive – it’s when regulators start asking if you’re ready. So what can you do now?
- Get a full inventory of your certificates and keys across all environments
- Establish ownership and lifecycle policy across teams and toolchains
- Adopt crypto-agility principles that allow you to swap algorithms easily
- Integrate PKI into your business strategy — not just your IT stack
With the right foundation, trust becomes a strategic advantage, one that accelerates transformation.
Nächste Schritte: Sichtbarkeit & PQC-Readiness
In Part 2 of this series, we’ll walk through a hypothetical quantum breach scenario, examine what crypto-agility really requires, and share a simple checklist to start your post-quantum readiness journey. (Spoiler: It’s not just about new algorithms…it’s about visibility, governance, and proving that your infrastructure is built for the next frontier…so stay tuned for part 2 in this new blog series!)
📥 Want the full roadmap now?
Curious what preparation looks like? Download The Security Leader’s Digital Trust Playbook: Financial Services Edition today. Have questions for our security team? Reach out here with any questions — we’re here to help!
Die Quelle abonnieren
Stay secure with Keyfactor's monthly newsletter, packed with expert insights and practical steps for quantum-readiness.
