PKI & MACHINE IDENTITIES SURVEY

FinServ Identity and Access Management Trends and Strategies

Pulse and Keyfactor surveyed 100 IT and security leaders in the financial sector to discover trends in identity and access management (IAM), and where machine identities fit into their overall IAM strategy.

Scroll for key takeaways

100% of tech leaders in finance consider digital certificates important to IAM strategy, but FinServs lack maturity in key and certificate management.

The majority of respondents (77%) believe the use of digital certificates is moderately to very important to their identity and access management (IAM) strategy.

Digital Certificates and IAM
Maturity of Enterprise Strategy for Key and Certificate Management

But when it comes to their enterprise-wide strategy for key and certificate management, half of tech leaders in finance (50%) believe their strategy is not yet fully mature. None of these respondents would consider their key and certificate management strategy very mature.

Tech leaders struggle to pass internal audits and comply with regulations around PKI and digital certificate management.

94% of respondents have failed one or more internal audits related to PKI and digital certificate management in the last two years, where nearly half (49%) experienced three or four failures.

Failed Internal Audits
Key and Certificate Management Regulations

Tech leaders agree PCI DSS is the most difficult regulation to comply with.

FinServs are relying on traditional and emerging PKI use cases to secure functions despite a lack of confidence in teams to comply with internal security policy.

The majority of respondents consider financial transactions (77%) a potential use case for Public Key Infrastructure (PKI), followed by web server infrastructure (59%) and end-user smart card authentication (58%).

Secure PKI Use Cases
Code Signing Usage

Over half of respondents (55%) will use code signing to secure centralized server, container repo or end user package and update management in the next year, while 10% already do.

But the efficacy of security measures like PKI requires compliance with internal security policy. Currently, only 6% of tech leaders are very confident that their application and development teams are conforming to internal security policy.

Internal Security Policies

Cybersecurity infrastructure is increasingly cloud-based but not likely to become 100% cloud-based for most.

Cybersecurity Cloud Infrastructure

92% of respondents will move up to 75% of their cybersecurity infrastructure to the cloud in the next year.

The top three barriers to moving to the cloud are complexity of migration (67%), compatibility issues (66%), and regulatory compliance (61%).

Barriers of Moving Cybersecurity Infrastructure to the Cloud

Respondent Breakdown

Regional Respondents PKI Survey

Find out how the Keyfactor platform can modernize your PKI, prevent
certificate outages, accelerate DevOps security, and more.