ASSA ABLOY has agreed to sell HID’s public key infrastructure business to Vista Equity Partners. The agreement, announced on 16 October 2026, covers a unit that generated more than $58 million in sales during 2025, with completion expected in the fourth quarter subject to customary closing conditions. Read as a mid-market carve-out, the deal looks unremarkable. Read as a transfer of a certificate authority estate that issues and validates trust for devices, workloads and connected infrastructure, it becomes one of the more consequential machine identity transactions of the year.
PKI is the substrate of non-human identity. Certificates bind a key pair to an entity, a purpose and a lifetime, and that binding is what allows a device, a service or a workload to prove what it is without a password. When a new owner takes control of a certificate authority hierarchy, they inherit the issuance policies, the registration authorities, the hardware security modules and, critically, the customer dependencies built on top of all of it.
The governance gap sits behind the certificate
Most organisations do not have a machine identity problem in the cryptographic sense. They have an inventory problem. Certificates are issued by teams, by platforms, by appliances and increasingly by agents, and the record of what exists, who owns it, what it is trusted for and when it expires is frequently incomplete. Certificate lifetime is shrinking industry-wide, which turns that missing inventory into a rolling operational risk rather than a theoretical one. A distributed PKI business that changes hands intensifies the question: every certificate in the estate now depends on a policy decision made by an owner the customer never selected.
Three diligence questions every customer should ask
First, continuity of the hierarchy. Buyers and sellers can transfer a business cleanly, but trust anchors move slowly. Customers should establish whether root and intermediate hierarchies, cross-signing arrangements and trust store inclusions survive the transaction unchanged, and what notice period applies if they do not. Second, custody of keys. HSM ownership, key ceremony records and the split-knowledge arrangements around root keys are the difference between a managed service and a single point of failure. Third, roadmap on algorithms and lifetimes. With post-quantum migration and shorter maximum validity periods both in view, the new owner’s investment plan determines whether the estate can be re-issued at the pace regulators and browsers will demand.
Trust infrastructure as an asset class
The commercial signal here is that private capital now treats certificate authority and PKI operations as durable, recurring, infrastructure-grade revenue. That is a bet on the direction of machine identity: as more workloads authenticate to each other, the number of certificates under management grows faster than headcount, and the operational burden of running that safely exceeds what most enterprises want to staff internally. Buyers are effectively underwriting outsourcing of non-human identity control.
What changes for security teams
For CISOs, the practical work is unglamorous and urgent. Produce a complete certificate inventory, mapped to owners and business services. Identify every dependency on the transferring authority, including embedded devices with certificates that cannot be rotated in the field. Verify contract assignability and termination rights. Then schedule the re-issuance path for anything that cannot follow the transaction cleanly. The deal closes in a quarter. The certificates will outlive the announcement by years.