By Andy Cooper
The UK’s digital infrastructure is facing a pivotal moment. With the rapid emergence of quantum computing, a spike in cyberattacks, and growing scepticism around digital governance, trust is under threat. While public discourse tends to focus on surface-level threats – data breaches, ransomware, AI misuse – there is a deeper, more systemic concern that rarely garners the attention it warrants: the resilience of public key infrastructure (PKI).
PKI is the cryptographic foundation upon which nearly every secure digital interaction is built. It authenticates users, devices, and systems. It protects sensitive data in transit. It validates software, certifies web domains, and underpins the integrity of critical infrastructure. It also forms the basis of employee identity systems through smart cards and authorisation tokens – an area of increasing importance given the rise of hybrid working and access controls. Beyond enterprise use, PKI is at the core of digital identity schemes, including initiatives such as digital driving licences.
However, despite its importance, PKI is frequently neglected in cybersecurity strategies. Its very invisibility, working silently behind the scenes, is part of the problem. This neglect is not benign; it introduces serious risks to the stability and trustworthiness of systems and premises.
Systemic weaknesses in the UK’s digital trust fabric
Too often, PKI implementations within both the public and private sectors are outdated, misconfigured or poorly governed. These are not theoretical risks. Real-world assessments of PKI deployments routinely expose glaring vulnerabilities. In many cases, private keys – arguably the most sensitive cryptographic assets – are not securely stored in hardware security modules, but instead languish on general-purpose servers, exposed to compromise.
Meanwhile, many systems continue to rely on obsolete cryptographic algorithms such as SHA-1 or short RSA key lengths, despite clear deprecation guidance. Compounding this, certificate lifecycle management is often unmanaged and inconsistent. Expired or unrevoked certificates circulate unnoticed until they cause service outages or security failures.
Certificate authorities (CAs), the cornerstone of trust within PKI systems, are frequently misconfigured or granted overly broad permissions, while governance documentation is either lacking or outdated. And in far too many cases, organizations have no effective means of certificate revocation or misuse detection – rendering them unable to respond quickly when compromise occurs.
Each of these weaknesses is significant. Together, they form a dangerous fault line running through the heart of our digital infrastructure.
The vital role of the PKI health check
There’s a common misconception that a PKI health check is merely a routine audit. In truth, it should be treated as a strategic evaluation and an integral part of risk management and governance, with direct implications for operational resilience, risk management, and regulatory compliance. A meaningful health check should help put an organization on the right path to be cyber secure and should map all trust relationships across networks and applications, evaluating not just what cryptographic tools are in place, but how they are governed, maintained, and tested under pressure.
Crucially, it must also assess readiness for the post-quantum era. The cryptographic algorithms that underpin today’s PKI – including RSA and ECC – are expected to be rendered obsolete by quantum computing. This is not science fiction and, in response, global standards bodies including NIST have published migration guidelines and timelines for adopting post-quantum cryptography (PQC). Organizations that fail to prepare now risk being blindsided later, as hackers collect sensitive data now and process it for use when the capability exists in the near future.
Despite this urgency, fewer than half of the respondents in recent Thales research said they were actively assessing their encryption strategies or implementing cryptographic agility. Crypto-agility – the ability to swap out cryptographic algorithms without downtime or disruption – should be a core feature of modern PKI architecture. Yet most systems in use today are static, brittle, and ill-equipped to handle such change.
Designing resilience into the architecture
Cyber resilience cannot be retrofitted. It must be architected from the ground up. This is particularly true when it comes to the principles of ‘secure by design’, which are now being codified into national policy through forthcoming legislation such as the UK’s Cyber Security and Resilience Bill. For digital public services to be truly resilient, PKI must be embedded not as an afterthought, but as a foundational layer for identity and access management.
This also aligns with the ambitions of the UK Data Act, which places a strong emphasis on responsible use of customer data and digital trust. PKI plays a pivotal role in ensuring both authenticity and integrity in how this data is managed, stored, and accessed.
A first step for many organizations must be to map their PKI landscape. Many simply don’t have an accurate inventory of what cryptographic assets they hold or how they’re being used. Upgrades should follow, aligning with guidance from the National Cyber Security Centre (NCSC) and NIST to adopt PQC-ready systems. Automated certificate discovery and lifecycle management processes are increasingly essential to reduce reliance on manual oversight – particularly in cloud-native environments where certificate renewal cycles are fast and frequent.
Finally, organizations must have an internal cryptographic capability. While outsourcing has its place, few teams retain the in-house expertise required to govern PKI effectively. Upskilling staff on key custodianship, CA management and algorithm lifecycle planning is now critical to maintaining long-term integrity.
The evolving threat landscape targets trust itself
PKI is no longer just a privacy or authentication tool; it has become a prime target for sophisticated adversaries. Nation-state actors are increasingly focused on compromising the trust fabric itself – manipulating certificate chains, stealing keys, and injecting rogue credentials. Successful compromises allow attackers to spoof trusted services, insert themselves into encrypted communications and maintain persistent access to critical infrastructure. The consequences are not only technical – they are reputational and political.
The risk from ransomware gangs is also evolving. These actors are now exploiting misconfigured certificates and vulnerable credential systems to move laterally through networks, evade detection, and extract data. And then there is quantum computing, the looming threat that adds an entirely new layer of urgency. Quantum algorithms like Shor’s pose an existential risk to classical cryptography. While estimates vary, the threat is no longer hypothetical. Organizations must begin migration planning today.
Fragmented key management is a further risk multiplier. According to the 2025 Data Threat Report, many organizations use five or more key managers and data discovery tools. This fragmentation not only complicates oversight but increases the likelihood of blind spots and inconsistent protections.
Reclaiming trust through strategic investment
The UK’s Public Accounts Committee has warned that national cybersecurity capabilities are not keeping pace with the threats they face. While flashy technologies may dominate public and political conversations, real resilience begins with the basics. And PKI is as basic and vital as it gets.
This isn’t about compliance checklists or technological novelty. It’s about safeguarding the integrity of public services. Without functioning PKI, secure identities cannot be established, data confidentiality cannot be assured and system availability becomes vulnerable to disruption. In effect, the digital state loses its credibility.
Investing in PKI health and agility is not a cost but a multiplier. It enables secure service delivery, supports digital sovereignty and prepares the nation for quantum disruption. In collaboration with HSBC and InfoSec Global, we’ve explored how organizations can build this resilience through a robust cryptographic inventory. The resulting blueprint outlines ten strategic principles that should underpin any national or enterprise approach. These include automation at scale, cryptographic agility planning, prioritised risk mitigation, supplier cryptography oversight, contextual metadata capture, and the creation of a trusted ‘golden source’ – to turn cryptographic complexity into actionable, long-term security goals.
Rebuilding trust in digital government will take time, but it begins with recognising that PKI is not a silent utility, but the very heartbeat of cybersecurity.
The author
Andy Cooper, is Product Line Manager, Thales
