Capital

The Vendor Behind Your Certificates Just Raised $1B

Keyfactor took over 1 billion dollars from Summit Partners on July 6. The real story is that certificate management just became board-level infrastructure.

CapitalBy Servola Tech Desk2026-07-134 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

The Vendor Behind Your Certificates Just Raised $1B

Key takeaways

Keyfactor, which secures certificates for half of the largest banks in the US and Europe and more than 40 percent of the Fortune 100, took over 1 billion dollars from Summit Partners on July 6, and the money is a bet that machine-identity management has crossed from an IT chore into board-level infrastructure.
Two deadlines are forcing the change at once: public TLS certificate lifespans are being cut from 398 days toward 47 days by 2029, and the migration to post-quantum cryptography will eventually reissue nearly every certificate an organisation holds.
Manual tracking does not survive either deadline. A company that renews certificates from a spreadsheet is one missed date away from an outage that takes down a checkout page, an API, or a login at the worst possible hour.
Inventory every certificate you own and automate its renewal before March 2027, when the lifespan cap drops to 100 days - not after an expired certificate has already cost you a night of downtime.

What a billion dollars is actually buying

An expired certificate does not care how large your company is. When one lapses on a payment gateway at two in the morning, the checkout page simply stops trusting itself, cards get declined, and the first anyone hears of it is a spike in abandoned carts. The unglamorous work of making sure that never happens is what Summit Partners just valued at more than a billion dollars.

On July 6 Keyfactor announced a strategic growth investment of over 1 billion dollars led by Summit Partners, with existing backers Insight Partners and Sixth Street Growth keeping significant stakes. The company issues and manages billions of machine identities each year for more than 2,500 customers, and its reach is telling: it secures certificates for half of the largest banks in the US and Europe, 80 percent of leading US retailers, and over 40 percent of the Fortune 100. The stated use of the money is product, geographic expansion, and acquisitions.

Private equity does not write billion-dollar cheques for housekeeping. The size of this round is the signal, not the logo on it: certificate and machine-identity management has quietly moved from a task a systems administrator handled between other jobs into a capitalised infrastructure category with its own budget line. The market has decided this is where enterprise trust is bought, and it has priced it accordingly.

Why certificates became a board problem

The first force is arithmetic. The CA/Browser Forum, the body that sets the rules browsers enforce, voted to cut the maximum life of a public TLS certificate from 398 days to 200 in March 2026, to 100 in March 2027, and to 47 by March 2029. A certificate that lives 47 days must be replaced roughly eight times a year. Multiply that by the thousands of certificates a mid-sized enterprise runs across its sites, APIs, and internal services, and manual renewal stops being tedious and starts being impossible.

The second force is quantum. NIST finalised its post-quantum encryption standards in 2024 and set a path toward retiring today's RSA and elliptic-curve algorithms around 2030. In practice that means nearly every certificate an organisation holds will have to be reissued with quantum-safe cryptography, and the encrypted traffic being copied and stored today can be decrypted later once the hardware arrives. The clock on that migration is already running whether or not it is on anyone's roadmap.

The third force is scale. Every AI agent, container, workload, and service now needs its own identity to prove what it is before it is trusted, and the count of these machine identities has raced far past the number of human ones. Trust that used to be granted by a person logging in is now granted thousands of times a second by software, and each grant rests on a certificate that has to be valid, current, and accounted for.

What an operator should do before the clock runs out

Start with an inventory, because the certificates that cause outages are the ones nobody knew existed - the one a contractor installed two years ago, the one buried in a load balancer, the one on an internal service that quietly became load-bearing. You cannot automate what you cannot see, so the first project is finding every certificate you own and when it expires. Only then does automated issuance and renewal earn its keep.

In Europe this is no longer optional hygiene. NIS2 makes certificate and cryptographic discipline part of a company's security obligations, and eIDAS governs the qualified certificates that underpin cross-border trust. The billion-dollar round is the market saying the bill for machine identity comes due either way - on a schedule you plan and control, or during the outage that plans it for you.

Frequently asked questions

What did Keyfactor raise and from whom?

On July 6, 2026 Keyfactor announced a strategic growth investment of more than 1 billion dollars led by Summit Partners. Existing investors Insight Partners and Sixth Street Growth keep significant ownership. The company says the money will fund product development, geographic expansion, and acquisitions.

Why are certificate lifespans shrinking to 47 days?

The CA/Browser Forum voted to cut the maximum validity of public TLS certificates in stages - 200 days from March 2026, 100 from March 2027, and 47 by March 2029. Shorter lives limit the damage a stolen certificate can do and force organisations to automate renewal rather than rely on manual tracking.

What should a mid-sized European company do first?

Build a complete inventory of every certificate it holds and note the expiry dates, including the forgotten ones on internal services and appliances. Then automate issuance and renewal so no human has to remember a date. Under NIS2 this is part of a security obligation, not an optional improvement.

The number that will travel is the billion dollars, but the message underneath it is plainer: the era of managing certificates by hand is being capitalised out of existence, and the operators who wait will meet that fact during an outage rather than on their own terms.

KeyfactorSummit PartnersMachine identityCertificate lifecyclePost-quantum cryptographyTLS certificatesPKI

A Carrier Just Bought the Glue Between Your Clouds

Lumen completed a 475 million dollar acquisition of Alkira, the network-as-a-service control plane that stitches multi-cloud traffic together. The neutral layer enterprises used to connect AWS, Azure and Google now sits inside a carrier's roadmap and pricing. Here is what changes for anyone whose fabric runs through it.

2 min read

Capital

Amazon Borrowed $25 Billion for AI Capacity

Amazon raised at least $25 billion in an eight-tranche bond sale to help fund a roughly $200 billion capex year for AI. The order book was pared and Amazon paid up to fill it. For anyone whose stack runs on AWS, the build-out is now financed with debt, and that is both a commitment and a warning.

3 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.