Keyfactor
PKI automation: short-lived certificates and crypto-agility at machine scale. Group: Machine identity & certificates.
Compiled from published analyses — principally the Aembit vendor guide and the 2026 NHI tools survey — and the vendor's own materials. Date verified: 18 August 2026. Not a hands-on assessment; capabilities and pricing move monthly and corrections are welcome via comms.
What it does
Keyfactor automates PKI: certificate lifecycle at machine scale, short-lived certificates, and crypto-agility. The certificate half of machine identity — the layer a future agent-key registry (see this site's PKI section) would sit beside.
Key capabilities
- PKI and certificate lifecycle automation
- Short-lived certificates
- Crypto-agility
Which part of the question it answers
The machine-identity/certificates layer of the 2026 survey's map, alongside CyberArk's Venafi line.
And for rented agents?
Certificates attest workloads you enrol — the run-your-own population again. The rented-agent key problem is the registry question, not the CA question.
Pricing
Not published; enterprise sales. Open-source EJBCA community edition exists.