DigiCert’s Vision for the Future with Amit Sinha | RSAC Conference 2025

Welcome back to Techstrong tv. This is Lisa Martin coming to you live from the show floor at RSAC in San Francisco when there's about 45,000 fs. This is Techstrong TV's, 10th year of covering this massive event in cybersecurity.

We're having great conversations yesterday today, which you know, that you've been watching with leading cybersecurity experts. Happy to see one of my old colleagues, Amit Sena here, the CEO of DigiCert. It's so great to see you again.

Great to see you too, Lisa. Yeah, we talked about a year ago, and I'm excited to be back here. I am too.

I'm gonna brag on you for a minute. Okay. I did some LinkedIn stalking, the author of 50 patents, 34 issued 16 pending, 25 published journal and conference papers, three book chapters, four thesis, dozens of white papers.

How do you find the time to do all this and lead a company That was in the past? I had good mentors, good teammates. Right.

And, uh, hey, it's a team that makes it happen. Ultimately. Absolutely.

A good, uh, being surrounded by a great team is everything. But you've been featured on C-N-B-C-C-N-N, here you are with us. What is going on at Digit?

Give me kind of the rundown since we last spoke. Well, Since we last spoke a lot has happened in the industry. Lisa.

Yes. Um, you know, dig, as you know, is a global leader in digital trust. And digital trust is foundational infrastructure that makes sure that all our digital interactions are secure, they're trustworthy, they are private.

Right. Um, and this whole industry is going through a massive renaissance. Right?

Yeah. Um, lemme give you a few areas where this change is happening. Just two weeks ago, uh, the browser forum passed a new mandate, which now requires digital certificates, which is kind of the underpinning of all this, uh, trust fabric.

Uh, the validity of those certificates will go down from 398 days, just over a year to now. 47 days. It's like eight x reduction.

So think about your passport if it start, you know, instead of a five year validity, if it was expiring every 47 days. Yeah. I mean, I'll be crazy, right?

Yeah. Now it's safe because if someone stole it or, uh, or if it was out in the wild, you don't have to worry about exposure. But what that means is the industry now needs fail safe automation, right?

Yes. Uh, because all of the, you know, think of all the websites, the apps, the software machines, Which only just proliferating exploding, Right? Yes.

And we haven't even gone to AI agents and we'll get there. Yes. With all of these non-human identities, you know, using PKI, you need, uh, you need a system that can centrally govern it and provide fail, save automation, right?

Uh, so that's a huge change that's happening. And we're talking to many customers about how do I get command and control over millions of these cryptographic assets that might be within an organization, and they provide you secure communication and authenticated devices. Uh, so that's one huge change.

Yeah. Um, and writing on top of that is this whole quantum thing, right? Yeah.

So the math that secures all the trust fabric is based on these, uh, classical algorithms that are now vulnerable to quantum computers. And we've known this for a while. Mm-hmm.

But what has happened is since we spoke just this earlier this year, Amazon, Microsoft, Google, they're all coming up with their bigger, better, faster versions of their quantum chips. Yeah. And, uh, I think, you know, we're gonna have a chat GPT like moment where one day we'll wake up and say, wow, these quantum computers are here, and all of our trust fabric based on these math problems that we deemed were secure is suddenly broken.

Right. Wow. So that's a huge, you know, um, um, uh, thing that's happening in the industry Yeah.

Where people are preparing for, uh, post quantum cryptography and those standards exist today. It's just work needs to happen to Right. Go through this upgrade cycle And how quickly with, based on the acceleration, I mean, and chat.

GPT was born, what, a couple years ago, two and a half years ago, and it just catalyzed this revolution. I mean, AI is not a new concept. It's been around for a long time.

Exactly. And, but once it was launched, every company had a, what's our AI story? Yeah.

We have to have an AI story. Yeah. But the good guys have access to the tools, the bad actors have access to the tools.

It's like fighting fire with fire. Exactly. Exactly.

How do you, how do you conceptually explain digital trust to customers and what does that mean for, for them to be able to deliver the brand value that they expect that they have to deliver? Yeah. So Lisa, digital Trust, again, is foundational infrastructure, right?

Yeah. How do you know you're talking to the Right, right. Bank website, not a fake one.

How do I know that my app to app communication is secure and private? You know, you sign digital documents. How do you know that the deed on that PDF DocuSign is going to be not tampered with and hold up in a court of law 10 years from now?

Right? Right. Uh, how do you know that the software update you got on your iPhone really came from Apple?

Right? All of this is based on the same PKI, the same cryptography, right? Yeah.

And so that's foundational infrastructure and, and DigiCert, you know, 90% of Fortune 500 use DigiCert, uh, to, uh, to get to that, uh, trust fabric that I talk about As that fabric undergoes changes and upgrades. How, how do you keep up? I mean, the, just the, the speed with which things are going is mind boggling.

Exactly. For organizations that might not have the digital trust fabric or the visibility to understand where are all of our vulnerabilities A hundred percent. And how Do you keep up with, with the changes to the fabric?

Yeah. So, So again, step one, you need a system and you need automation, right? Yeah.

So I talk to half a dozen customers every week. Nice. And these conversations are happening where, look, even going from 398 days to 47 days, right?

Uh, now you need fail safe automation. Uh, what does that mean? That means, well, I need to be able to validate in an automatic way.

Yeah. What do I need for validation? First, I need to be able to prove that I control this domain or this machine.

So my DNS and my PKI need to work together. Right. Otherwise, what's gonna happen is that two things.

You won't have automation. So you'll have humans in the loop, and then it'll lead to outages, it'll lead to exposure because you weren't able to update, uh, you know, the PKI on a particular machine because the person was away on vacation or, you know, something else happened. So you need, uh, these two core systems.

I call that electricity and water on the internet, you know, PKI and DNS Yeah. Work together. Yeah.

And what DigiCert one does is gives you a single platform to fully manage and automate these two foundational pieces of digital trust. Right. So now imagine millions of machines, so many domains to manage.

com Yes. Amazon really controls it. Oh, it's 46 days.

Let's go ahead and update the cert and repeat that for millions of private machines that you might have internally. So that's kind of a huge thing that's happening in the industry. And, you know, DigiCert's leading, uh, the way with lots and lots of our customers with a change in, uh, in, uh, in standards.

And that actually prepares you for post quantum cryptography as well. Okay. Because what is post quantum?

It's just new math. Yeah. So think about, you know, back to your passport example, now there's a better passport.

Right. More tamper proof. Yeah.

You know, but the underlying process hasn't changed. Right. You still need to validate, you still need to manage and automate.

Uh, But the automation is Critical. That's the, that's the part that we are driving to. Yes.

And DigiCert one now supports all the post quantum standards that have been approved by nist Okay. As a fall last year. So You're already getting ahead of the curve Here.

So we are already ahead of the curve, and we have many customers who are, you know, leading the way. Yeah. And, you know, we do a survey where we go through the grief cycles, right?

'cause this is once in a third year upgrade. And two years ago when I used to talk about post quantum cryptography, most people would say, Hey, that's a problem out there down the road. And now, you know, you have CSOs and CXO saying, what's our quantum strategy?

Uh, are we prepared? Do we have, you know, an inventory of all our assets? Do we know what, what are our crown jewels?

And what do we need to upgrade first? So the conversation has gone from what's quantum to what can we do about it? So getting proactive, A hundred percent, That's outstanding.

Because I, I always think in cybersecurity, are we always behind? Will we ever be able to be proactive with just how quickly things are transpiring and how the risk surface just continues to expand amorphously? Yeah.

And we have more data, more software, more apps. That train isn't slowing down anytime soon. It isn't.

And like, look, when you start adding things like AI agents, right? I mean, uh, customers are asking, well, you can, you know, you're helping us manage software and devices and machines. Now here's an AI agent.

This is a, you know, is it software? Is it a machine? Is it, you know, how long will it last?

Right? How will it be managed? How will it be managed?

So one of the foundational principles in security is to separate identity and authorization from the capabilities of the underlying software or agent. Right? Okay.

Yeah. So think about it this way, Lisa. I mean, a year from now, I might have six agents working for me.

Mm-hmm. You know, maybe I have a Zoom avatar that shows up. Right?

Maybe there's an agent approving expense reports or doing mundane things, but maybe I have an agent that's negotiating a contract. What do I need? I need a kill switch on the agent.

I need, I need an audit log of what are the things that it, it did, because ultimately it's acting on my behalf. And so I need to be able to, you know, first have a tam proof identity. I need to have a tam proof record of what it did.

Right. Right. And if I don't like something, I need a kill switch to be able to say, you're no longer authorized to do that.

Right. Right. What's all that?

That's back to again, PKI, right. How do I authorize, you know, we know how to authorize a machine. We know how to say this is authentic software.

Uh, you know, there are lifetimes associated with it where you can go and say, well, after 47 days, it's no longer valid. Right? Right.

So we're bringing similar concepts now to AI agent trust. Right. Ah, where, where you can say, look, these agents are very powerful, but identity access Yes.

Authorization is, is, you know, is in my control. Right? Yes.

Versus saying, you know, this agent goes rogue and does whatever. It's Right. Right.

Well, the agentic AI explosion, uh, just another example of this catalyst in every industry and every vertical, I talk a lot with chief marketing officers, um, and everyone is embracing agentic ai. It's part of their KPIs as integrated marketing organizations. So we're just gonna see that continue to explode, but being able to, you put the right word control, get control over it.

Is that a possibility? Because it proliferating so fast? Well, look, again, you know, you need to combat AI with ai.

We hear that theme over and over again. Yes. Yes, we do.

Um, but, you know, we need to learn from, from things in the past and be proactive and apply it. Right. The examples I gave about separating identity and access from, uh, and being able to govern it in a way Right, right.

Uh, is very, the governance critical is very, very, very crucial. It's not a nice to have anymore for organizations, right? Yeah.

It's table stakes. Yeah. And I kind of like your proactive angle, right?

We have customers who are very proactive. Uh, in fact, just a couple of weeks ago I was with Zoom and, uh, you know, uh, we work, we work with, uh, AMI, who's the president of Zoom, uh, and his team. And you know, it's a great example of a, of a company and a customer that's, uh, very proactive about these things, things.

So let me give you, you know, three, four simple examples. Yeah. Um, we talked about post quantum cryptography.

Mm-hmm. You know, zoom, uh, workspace now supports end-to-end quantum safe encryption. So they're, you know, already ahead of the curve, right?

Yeah. Uh, zoom, uh, when Zoom clients talk to Zoom servers, they use dig PKI to kinda secure, uh, that communication. Um, now other things too, like the industry is moving to 47 day certs, you know, Zoom's already rotating these certs now on a six month basis.

Right? Okay. Uh, their code signing certificates are being rotated on a monthly basis, and they're able to, you know, do majority of their digital trust infrastructure on a fully automated basis, you know, with, with integrations and, and, uh, and platform support from DigiCert.

So that's a great example of a, you know, customer who's being proactive. Yeah. Who's, uh, uh, who's ahead of the curve.

And that's what you need in a, in, in the security industry today. Absolutely. And like I said, it's not a nice to have anymore.

It's essential. Absolutely not. But so many organizations I think, struggle.

And you probably see this in all of your customer conversations. Where do we start there? It's so overwhelming.

But knowing that there is a way with Dig Cert, for example, to enable organizations across industries, across verticals, to become proactive with something that's coming is enlightening. Yeah. I'm so glad that you shared that story.

Last question for you. I think I saw that DigiCert is on the track to reach a billion a rrr. That is true.

Congratulations. Thank you. You, what's next?

What can we expect next from DigiCert? Look, We just want to deliver awesome services and an awesome platform for our customers. I think in the next four years, uh, PKI and Digital Trust is going to go through massive renaissance, right?

Uh, with Quantum, with the things that we talked about. Uh, you're right. Many customers say, where do we start?

Yeah. And, uh, you know, I'm doing Trust Summits now. Uh, we've hit three cities.

We're gonna go to four more in the next month or so. Excellent. And, uh, we're just, uh, you know, going and helping customers understand, start their TKI modernization journey.

Yeah. Get prepared for quantum safety. You know, figure out how do we bring digital trust in a, in the real world with AI agents, right?

Those are all things. So, you know, we're very excited and, uh, uh, look, a billion dollars is, is is just a milestone. Right?

That's a big milestone. Uh, but, uh, it's not like it, uh, you know, you the race finishes there, right? No.

We just want to continue to grow and Absolutely. And Serve our customer and continue to be proactive. I'm, it's so great to have you back on Text Strong tv.

I enjoy, I always enjoy our conversations, but thank you for sharing what's going on with Digital Trust, why it's so foundational, how the fabric is changing, but how you're helping organizations actually get ahead of the curve. Really appreciate your insights. Thank you, Lisa.

I always enjoy our conversation. Likewise. For, I'm Lisa Martin.

You're watching Techstrong TV Live from day two of RSAC. Come to you from San Francisco. We'll be back with our next guest, so stick around.