Labor Savings On New Certificate Provisioning

Evidence and data. Across the interviewees’ organizations, manual certificate provisioning across different teams required a significant amount of time. Provisioning tasks included certificate signing request generation, CA interaction, approval, and certificate retrieval. Keyfactor streamlined many of these processes, reducing manual labor and providing a common solution for certificate provisioning across the organizations’ disparate teams.

• Despite a tenfold increase in certificate provisioning after adopting Keyfactor, the interviewee at the retailer noted that fewer than five internal resources now focus on work related to certificates, which is fewer than before Keyfactor, as most of their organization’s required certificates can be provisioned on a self-service basis by the teams that need them.

• “My best people were essentially functioning as systems admins,” explained the interviewee at the telecommunications organization, as manual provisioning and renewals represented an inordinate percentage of their working hours. These personnel now focus on automating certificates on Keyfactor rather than managing them. “The future is bright, as we’re looking to have a significant percentage of our certificates fully automated on Keyfactor in 2026,” concluded the interviewee. “Every [phase] is hundreds of certificates we don’t need to manage anymore.”

• The SVP and director of security and network infrastructure at the bank explained that before working with Keyfactor, certificate management did not add value to the business. Keyfactor enabled personnel who manually managed certificates to focus on strategic integration work with the bank’s business applications.

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• The composite organization has 400,000 certificates (both private and public).

• The number of certificates the composite requires increases annually, by 8% in Year 1, 10% in Year 2, and 12% in Year 3.

• Before Keyfactor, the composite manually provisioned 15% of its required certificates due to solution or process limitations.

• Manual certificate provisioning took 90 minutes on average before Keyfactor. With Keyfactor, the composite reduces provisioning to 2 minutes on average.

• The average fully burdened hourly rate for personnel who manually manage certificates is $75.

Risks. This benefit will vary among organizations based on:

• The number of new certificates an organization must provision annually.

• The extent to which an organization must manually provision new certificates.

• The specifics of these manual processes related to the potential for savings with Keyfactor automation.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.5 million.

Labor Savings On Certificate Renewals

Evidence and data. Interviewees explained that Keyfactor automated certificate renewals across their environments, reducing the number of hours spent on manual renewals across several teams and reducing the likelihood of outages.

• The interviewee at the software organization stated that Keyfactor enabled them to consolidate PKI and certificate management from multiple teams to one team while supporting the business (e.g., through certification deployment and especially renewals) at the speed it required. The interviewee also noted: “Keyfactor has definitely allowed us to streamline certificate processes for internal customers. We have a defined pipeline, so those who need it can connect to EJBCA to get their certificates. It also helps us ensure policy adherence around certificate type requirements for specific customers and the validity of certificates. We’ve been able to manage all of this much more consistently and with fewer resources now.”

• A “self-service” feature for certificates across the retail organization enabled by Keyfactor allowed teams to automate their own certificates, including one-click renewals that were previously (and inconsistently) managed manually across these teams.

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• The composite organization has 400,000 certificates (both private and public).

• Most certificates require renewal at least once a year, some more frequently. As such, the composite must renew 105% of the certificates across its estate annually.

• The composite must manually renew 15% of the certificates that require it before Keyfactor.

• It took 25 minutes to renew a certificate on average before Keyfactor. This decreases to 1 minute on average using Keyfactor’s one-click and automated renewal features.

• The average fully burdened hourly rate for personnel manually managing certificates is $75.

Risks. This benefit will vary among organizations based on:

• The number of new certificates that require annual renewal by an organization.

• The specifics for manual renewal processes related to the potential for efficiency gains with Keyfactor.

• The extent to which new and existing certificates renewals are already automated.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $4.3 million.

Labor Savings On Certificate Deployment

Evidence and data. Interviewees explained that before Keyfactor, certificates still required manual deployment (e.g., installation, binding, testing) after provisioning or renewal, which added labor. With Keyfactor, interviewees’ organizations could fully automate deployment, requiring just an approval (i.e., zero-touch) for renewed certificates and significantly reducing time for newly provisioned certificates.

• The interviewee at the bank noted that certificate deployment was historically the most manual, labor-intensive process across their organization, often requiring staff to work weekends to avoid bottlenecks to business agility. After deploying Keyfactor, automated certificate management (including deployment) reduced the time required to deploy certificates. The interviewee concluded, “Keyfactor has brought hope to many application teams since they no longer have to manage certificates [manually] as they had been doing for so long before.”

• Automating certificate deployment on Keyfactor allowed the software organization to consolidate its deployment effort that many individuals previously managed onto one platform, a benefit highlighted by several interviewees. The interviewee at the software organization summarized: “We were managing certificates across multiple systems across multiple teams. Consolidation to one platform definitely has reduced the amount of manual work.”

• The interviewee at the retail organization said that navigating certificate deployment complexities was challenging amid growth. They explained that automated deployment on Keyfactor (in addition to provisioning and renewal) freed up the personnel who were historically responsible for these tasks, allowing them to work on more personally satisfying work that affected business results. The interviewee concluded: “Now [internal certificate engineers] don’t spend their entire day on rudimentary operational stuff. They’re able to take on more challenging, growth-related jobs that drive more job satisfaction.”

• Certificate deployment and installation at the telecommunications organization was not only time consuming for internal staff but it was also sometimes inaccurate when managed manually. The interviewee explained: “Even when people manually renewed their certificates, they wouldn’t get them installed correctly. They would miss a spot or [dependency] and we’d get an outage. Keyfactor will more and more become a tool for the end-to-end automation of certificates where we can take some human intervention out.”

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• With Keyfactor, the composite can fully automate 15% to 25% of its newly provisioned and newly renewed certificates via automated deployment in Years 1 to 3, respectively.

• Historically, newly provisioned certificates required 70 minutes on average to deploy manually. Automated deployment on Keyfactor reduces this process to 15 minutes on average.

• Historically, newly renewed certificates required 15 minutes on average to redeploy manually. Keyfactor reduces this process to 1 minute on average using zero-touch or one-click approval.

• The average fully burdened hourly rate for personnel manually managing certificates is $75.

Risks. This benefit will vary among organizations based on:

• An organization’s specific certificate deployment requirements related to the number of certificates/frequency of deployment across its estate.

• An organization’s previous manual deployment processes related to the potential for efficiency gains with Keyfactor.

• The extent to which new and existing certificate deployment is already automated.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.7 million.

Reduction Of Unplanned Certificate-Related Incidents

Evidence and data. Interviewees explained that certificates across their organizations were less likely to expire due to their use of Keyfactor products and related process improvements. This reduced the likelihood of consequential internal or external incidents or outages that could affect internal productivity or external customers alike. Interviewees spoke about what these improvements meant for their organizations.

• The interviewee at the retailer explained that expired certificates were common before using Keyfactor. These certificate outages ranged in impact from minor internal disruptions to significant customer-facing outages. After implementing Keyfactor, their organization faced just one such outage in several years. This resulted in “significant savings,” according to the interviewee.

• Interviewees said that gaining visibility into their organization’s entire certificate estate was a main driver in reducing certificate-related incidents. At the telecommunications organization, the interviewee noted that Keyfactor allowed them to put processes around certificate renewals that greatly increased visibility into which certificates were set to expire. The interviewee explained the impact of some of these incidents: “While most of the incidents were often not a big deal, we also have had outages where people would go into [retail stores] and couldn’t order a new [product] because of a certificate outage. Then that starts costing us hundreds of thousands per hour or more.”

• Interviewees also noted that incorrect certificate deployment was a factor in certificate-related incidents; automating certificate deployment and installation using Keyfactor further reduced the likelihood of such incidents.

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• Between 18 and 22 internal and customer-facing certificate-related incidents (e.g., expiration, outages, downtime) occur annually. These incidents increase year-over-year as the certificate estate becomes more complex.

• The frequency of these incidents decreases by 85% to 95% (in Years 1 to 3, respectively) with the Keyfactor solution and the related certificate management process improvements it enables.

• Based on the interviews, the average cost of a certificate-related incident is $100,000, which includes lost employee productivity, customer disruption, and lost revenue.

Risks. This benefit will vary among organizations based on:

• An organization’s previous processes for certificate management related to the number of pre-Keyfactor certificate-related incidents (and therefore the potential for improvement with Keyfactor).

• An organization’s business and industry related to the cost of a certificate-related incident.

• The skill and capacity of an organization’s personnel working on Keyfactor/certificate lifecycle management processes.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $3.6 million.

Avoided Infrastructure And Maintenance Costs

Evidence and data. By adopting Keyfactor, several interviewees described their organizations’ ability to reduce physical and virtual PKI infrastructure related to certificates, including (but not limited to) CA servers, HSMs, database servers, related network infrastructure, and licensing and software assurance costs.

• By adopting Keyfactor for their private PKI, the interviewee at the telecommunications organization spoke to dramatic cost savings resulting from retired infrastructure and management. They retired nearly all of their 80 to 100 servers and firewalls that required ongoing management and maintenance.

• Despite a 10-times growth in certificates at the retail organization, working with Keyfactor on a hybrid on-premises/SaaS PKI solution allowed it to retire infrastructure previously associated with certificates, eliminate personnel management and maintenance, and reduce travel to and from on-premises data centers.

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• The average annual cost related to PKI infrastructure (including hardware, virtualization, software licenses, and assurance) is $300,000.

• Two PKI engineer FTEs are responsible for infrastructure management-related activities.

• One-and-a-half IT FTEs are responsible for PKI infrastructure maintenance.

• The average fully burdened annual salary for PKI engineers is $187,000.

• The average fully burdened annual salary for IT resources is $165,000.

Risks. This benefit will vary among organizations based on:

• An organization’s certificate estate related to the PKI infrastructure required to support it.

• The specific breakdown of an organization’s PKI infrastructure (e.g., on-premises, virtualized, owned, leased).

• The skill and capacity of an organization’s personnel resources who support this infrastructure.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.4 million.

Improved Organizational Security Posture From Improved Certificate Environment Visibility

Evidence and data. Keyfactor provided complete visibility into the certificate landscape for the interviewees’ organizations. Previously unknown or rogue certificates were accounted for and shadow IT related to certificates disappeared. This improved the organizations’ security postures, resulting in fewer attack vectors and reducing the likelihood of costly data breaches.

• Interviewees cited newfound visibility into their organizations’ certificate estates as the biggest driver of security posture, as it provided potential insights into unknown vulnerabilities.

• They also noted that full visibility into certificate estates greatly supported compliance or audit efforts, especially in highly regulated industries such as banking.

• The SVP at the bank noted that visibility into their certificate lifecycles with Keyfactor would ultimately help them prioritize their efforts. They explained: “Automating and having visibility into a [certificate] lifecycle is central to security posture. It’s about understanding not only where we have certificates, but what the algorithms that we’re using are and being able to see what that brings from a risk perspective. For example, our web banking servers, those are externally facing, so those are the ones we must materially address first. As we look at the journey to post-quantum readiness, it really decreases the operational risk to have assurance that we know where and how certificates exist.”

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• The cumulative cost of security incidents for the composite organization is $5.1 million, based on Forrester’s 2025 Security Survey.²

• The likelihood of the composite organization experiencing one or more security incidents annually is 68%.³

• Keyfactor may address 5% of the composite organization’s security incident vectors, resulting in an average annualized risk exposure addressable with Keyfactor of $96,837.

• Keyfactor and the related process improvements reduce the organization’s average annual risk exposure via these vectors by 50% annually, based on reduction of shadow IT and key certificate expirations.

Risks. This benefit will vary among organizations based on:

• An organization’s baseline security posture.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $126K.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Savings on public certificate labor and CA costs. With more visibility into their organizations’ certificate environments with Keyfactor, interviewees explained that they could privately issue certificates that they publicly issued before, saving on both CA costs and the manual labor required to manage the process. The interviewee at the telecommunications organization noted that they previously used expensive public certificates instead of private certificates because they were fully managed and would not require manual effort. With Keyfactor, replacing these public certificates with trusted, fully automated private certificates is an ongoing effort. The interviewee summarized: “We had a lot of interfaces that use public certificates that could utilize our trusted routes that we have [internally], and then we can issue them at a much cheaper cost. We also can expand the lifecycle of those certificates because they’re privately trusted.”

• Improved PKI availability and performance. Interviewees explained that moving to Keyfactor from owned/managed PKI infrastructures reduced infrastructure-related challenges and resulted in benefits from higher availability, performance, and the ability to support the business.

• Increased post-quantum readiness. Interviewees stressed that adopting Keyfactor aligned with post-quantum cryptography initiatives at their organizations, futureproofing the transition to new, quantum-ready Federal Information Processing Standards. The cybersecurity product director at the bank noted that using Keyfactor will allow them to demonstrate post-quantum readiness to industry regulators and result in significant audit preparation time savings. The interviewee at the retailer summarized, “We see Keyfactor as a partner we can lean on while navigating all of the post-quantum challenges ahead.”

• Improved productivity for other staff. Interviewees noted productivity improvements for staff beyond those managing the certificate lifecycle and related PKI infrastructure. Several interviewees explained that the certificate estate visibility delivered by Keyfactor significantly decreased the work required by auditors to prepare for compliance reviews, notably at the telecommunications organization, where auditors are now an estimated 30% more efficient.

• Improved visibility into the certificate estate. Prior to Keyfactor, interviewees’ certificate estates (and the related management) were often fragmented across several teams. With centralized management on Keyfactor, single pane of glass visibility delivered full discoverability, eliminated blind spots, created the potential for process improvements, and provided insight across all certificates, which significantly supported compliance and audit initiatives. The cybersecurity product director at the banking organization explained that Keyfactor is now seen as the “the encyclopedia for certificates,” allowing for single search that can check any certificate across the organization, including who owns it, who deployed it, and when it expires.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Keyfactor and later realize additional uses and business opportunities, including:

• Preparedness for 47-day TLS certificates and other renewal frequency changes. Keyfactor allows organizations to renew certificates with a one-click approval or zero-touch provisioning, reducing the time required to manually renew and install (as quantified in Benefit B). As renewal frequency requirements for certificates continues to increase (notably a 47-day renewal cycle for public TLS certificates), interviewees expressed optimism in knowing that their Keyfactor certificate landscape would support these evolving requirements and continue to deliver productivity value.

• Ability to support business initiatives through faster certificate growth. Several interviewees explained that Keyfactor accelerated their certificate management from provisioning to deployment, increasing the speed with which they deploy certificates to support new business initiatives. The interviewee at the software organization also explained that reducing the manual work required by consolidating on Keyfactor also reduced dependencies across their organization, resulting in faster certificate deployment and ultimately faster progress for the business. At the telecommunications organization, provisioning and deploying a new certificate could take weeks prior to Keyfactor.

• Ability to deploy in new regions and configurations. Keyfactor supports on-premises, fully SaaS, and hybrid deployments, giving organizations the flexibility to deploy to their specific needs and requirements across new and existing regions.

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).