Skip to content
Start with Identity
Join free
Machine Identity

Venafi (now Palo Alto Networks)

Founded 2000Salt Lake City, UT, USAAcquired by CyberArk (closed 2024-10-01); CyberArk acquired by Palo Alto Networks (closed 2026-02-11); SaaS now sold as Next-Generation Trust SecurityScore 4.4/5Evaluated 2026-11-05Website ↗

Capability scores

Methodology →
Authentication
2.0
SSO & Federation
2.0
Authorization
4.0
Lifecycle & Provisioning
4.5
MFA & Passwordless
2.0
Governance & Audit
4.5
Developer Experience
3.5
Deployment Flexibility
4.0
Pricing Transparency
2.5
Support & Ecosystem
4.5

Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.

Overview

Venafi is the long-time reference platform for enterprise machine identity management, covering TLS certificates, code-signing keys and SSH credentials, and in 2026 it is a Palo Alto Networks product line rather than a standalone brand. CyberArk bought it from Thoma Bravo for about 1.54 billion dollars, closing on 1 October 2024, and Palo Alto Networks completed its acquisition of CyberArk on 11 February 2026, relaunching that portfolio as Idira on 12 May 2026.

The product names have moved twice, and venafi.com now redirects to Palo Alto's Certificate Manager page (checked 2026-11-05). That page states that Next-Generation Trust Security (NGTS) is the evolution of the SaaS offering previously known as Venafi TLS Protect and then CyberArk Certificate Manager SaaS. NGTS is embedded in Strata Cloud Manager (datasheet, September 2026). The self-hosted products continue as Certificate Manager, Self-Hosted on the Trust Protection Foundation, plus Code Sign Manager and SSH Manager, which Palo Alto says are still receiving investment, including integrations with PAN-OS, Panorama and Strata Cloud Manager.

What it is good at

Certificate lifecycle management at enterprise scale is the core strength: discovering, issuing, renewing and revoking certificates across sprawling estates, from any certificate authority, with policy over which CAs, key types and lengths are allowed. Code-signing and SSH key governance are mature and rarer among competitors. That depth matters more each year, because CA/Browser Forum ballot SC-081 shrinks public TLS validity from 398 days to 47 days between March 2026 and March 2029, which turns manual renewal into an outage generator. NGTS adds SaaS private PKI and pushes renewed certificates straight to Palo Alto firewalls, remote access gateways and SASE.

Where it falls short

It is operationally heavy and aimed at scale. NGTS has a documented floor of 2,000 certificate instances, so an organization with a few hundred certificates is buying more platform than it needs; ACME tooling or Smallstep may suffice. The rebrand also creates real roadmap risk: the SaaS product now lives inside a network security console, and buyers who do not run Palo Alto firewalls should ask how much investment the non-Palo Alto integrations get. Human authentication, SSO and MFA are out of scope. We found no 2025-2026 CVE brief for these products in our catalog.

Pricing

Quote-based; no list prices published (checked 2026-11-05). NGTS is activated with prepurchased Secure-Flex credits: minimum 2,000 Secure Certificate Instances in steps of 200, at 55.5 credits per 100 instances, with the credit price itself quoted. Self-hosted products are quoted separately. Model it against outage cost with the TCO calculator.

Best for, and who should look elsewhere

Choose it for enterprise certificate, code-signing and SSH governance, especially in a Palo Alto Networks or Idira estate. Compare Keyfactor (Keyfactor vs Venafi) and AppViewX for vendor-neutral lifecycle management, and HashiCorp Vault or SPIFFE/SPIRE for short-lived workload credentials. See the certificate lifecycle management guide.

Bottom line

Still the deepest certificate and machine-credential governance platform for large enterprises, now sold by Palo Alto Networks as Next-Generation Trust Security, and a heavy, credit-licensed buy for small certificate estates.

Venafi (now Palo Alto Networks): frequently asked questions

What is Venafi called now?
The Venafi brand is gone. Palo Alto Networks says its SaaS certificate lifecycle product, previously Venafi TLS Protect and then CyberArk Certificate Manager SaaS, is now Next-Generation Trust Security (NGTS), and that CyberArk Certificate Manager web pages redirect to NGTS resources. NGTS runs inside Strata Cloud Manager. The self-hosted line continues as Certificate Manager, Self-Hosted, built on the Trust Protection Foundation, alongside Code Sign Manager, Self-Hosted and SSH Manager, Self-Hosted. Existing customers keep their current product and support channels unless their account team says otherwise (checked 2026-11-05).
Who owns Venafi in 2026?
Palo Alto Networks. CyberArk bought Venafi from Thoma Bravo in a deal that closed on 1 October 2024, for about 1 billion dollars in cash plus about 540 million dollars in shares. Palo Alto Networks then completed its acquisition of CyberArk on 11 February 2026 and relaunched the CyberArk portfolio as Idira on 12 May 2026. Venafi came along with CyberArk, so the certificate products are now sold by Palo Alto Networks, and the SaaS product sits in its network security portfolio as Next-Generation Trust Security.
How much does Venafi cost?
There are no list prices. Next-Generation Trust Security is activated with prepurchased Palo Alto Networks Secure-Flex credits: the documented minimum is 2,000 Secure Certificate Instances, added in increments of 200, consuming 55.5 credits per 100 instances. Palo Alto does not publish what a credit costs, so the dollar figure is a quote. Self-hosted Certificate Manager, Code Sign Manager and SSH Manager are also quote-based. Ask how renewals and credit rates change at your next term, since the licensing unit moved with the product (checked 2026-11-05).
What should I check in a Venafi certificate lifecycle management evaluation?
Start with the product you would actually buy: SaaS NGTS inside Strata Cloud Manager, or self-hosted Certificate Manager on the Trust Protection Foundation, because roadmap and integrations differ. Then test discovery across your real estate, CA-neutral issuance from both public and private CAs, and automated renewal at volume, since the CA/Browser Forum ballot SC-081 cuts public TLS certificate validity from 398 days to 47 days in steps from March 2026 to March 2029. Finally, confirm how Secure-Flex credits map to your certificate count.
What are the best Venafi alternatives?
Keyfactor is the closest like-for-like certificate lifecycle and PKI platform and stays independent of a network security vendor. AppViewX focuses on automation for network and application teams. DigiCert and Sectigo bundle lifecycle tooling with their public CAs. Smallstep suits developer-led private PKI and ACME. HashiCorp Vault fits teams that want short-lived certificates issued programmatically from a PKI engine rather than broad estate governance. Choose by whether the problem is governing an existing certificate estate or issuing new short-lived ones.

Venafi (now Palo Alto Networks) comparisons

More Machine Identity vendors

All Machine Identity →
Last reviewed By SWI Community TeamSuggest a correctionHow we research

By SWI Community Team · Last evaluated 2026-11-05

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.