AppViewX adds hybrid PQC certificates and an MCP server as machine identities hit a 144-to-1 ratio over humans

Machine identities now outnumber human identities by 144 to 1, up sharply from a 92-to-1 ratio in the first half of 2024, according to research cited by GlobeNewswire. That growth, driven largely by the proliferation of AI agents embedded in enterprise infrastructure, landed at the center of AppViewX's Summer 2026 product release, announced July 22. The company shipped two capabilities at once: hybrid composite post-quantum cryptography (PQC) certificates and a Model Context Protocol (MCP) Server for AI-driven certificate lifecycle management.

The timing is deliberate. Enterprise security teams are simultaneously managing three converging deadlines: the White House's Executive Order 14412 on Securing the Nation Against Advanced Cryptographic Attacks, signed in June 2026; the CA/Browser Forum's scheduled transition to 47-day maximum certificate lifespans; and the operational reality that AI agents are minting new machine identities faster than manual CLM processes can track. AppViewX is positioning its Summer 2026 release as a single platform response to all three.

Hybrid PQC certificates without a hard cutover

The hybrid composite PQC certificate approach pairs a classical algorithm, either RSA or ECC, with the ML-DSA post-quantum algorithm inside one certificate. Legacy applications validate the classical component and continue working without modification; quantum-capable infrastructure validates the post-quantum component. No full environment replacement is required before the migration begins.

According to GlobeNewswire, support spans Root, Intermediate, and End-Entity certificates across AppViewX's PKI hierarchy. Enterprises migrating from Active Directory Certificate Services (AD CS) can enable PQC as part of that same initiative rather than running parallel workstreams, collapsing what would otherwise be two separate modernization projects into one. CMDB-enriched risk assessments within the platform prioritize which certificates to migrate first, scored by business impact rather than by volume alone.

The 47-day certificate lifespan mandate from the CA/Browser Forum sharpens the urgency further. Shorter validity windows mean higher renewal frequency, and any organization still renewing certificates through manual ticketing workflows will face an unsustainable ops burden once that schedule takes effect. AppViewX's hybrid PQC capability is explicitly designed to let teams tackle PKI modernization and lifespan compliance through a single initiative, according to HackRead's coverage of the announcement.

An MCP server that puts AI agents inside certificate governance

The AppViewX MCP Server is built on the open Model Context Protocol standard and exposes certificate lifecycle operations as structured, callable actions. AI agents built on any major agent framework can invoke those actions in real time: requesting new certificates, triggering renewals when expiry or policy events are detected, and running automated discovery and inventory across distributed environments.

The critical design constraint, as described by both GlobeNewswire and HackRead, is that agent-initiated actions run within the same governance layer security teams already maintain. Permissions, issuance policies, and audit controls are enforced at the API layer rather than delegated to the agent. Every agent action produces an audit-ready log, which matters for compliance teams who need to demonstrate that autonomous operations stayed within policy bounds.

That architecture distinction separates the MCP Server from ad-hoc automation scripts, which typically bypass policy enforcement entirely. Enterprises deploying agentic AI across IT operations have struggled to maintain auditability when those agents touch security-sensitive systems. AppViewX's approach enforces governance at the interface rather than relying on the agent itself to behave correctly.

Why two separate problems are actually one

Paul Trulove, Chief Product Officer at AppViewX, described the underlying dynamic in the company's announcement: AI agents are expanding the cryptographic attack surface at exactly the moment that surface needs to become quantum-resistant. Most organizations are treating PQC migration and agentic AI identity management as separate security programs with separate budgets and timelines. The company's argument is that treating them separately creates a gap that will close at a rate most teams are not prepared for.

AppViewX CEO Archit Lohokare framed the release around operational practicality rather than a theoretical security posture, noting that hybrid PQC certificates give customers quantum readiness without disruption to existing environments, while the MCP Server gives AI agents the ability to manage certificates at scale without creating new governance blind spots, according to GlobeNewswire.

What this means for your team

• Audit your current CLM tooling against the 47-day certificate lifespan timeline: if renewal is still predominantly manual, the CA/Browser Forum's schedule makes automation a near-term operational requirement, not an optimization.
• Evaluate whether your PQC migration plan requires a full infrastructure cutover, hybrid composite certificates (RSA/ECC + ML-DSA) offer a staged path that maintains legacy compatibility and can be bundled with an AD CS migration already on the roadmap.
• Establish governance requirements for AI agent identity actions now, before agents are deployed at scale: any CLM platform used for agentic workflows should enforce policy and produce audit logs at the API layer, not rely on the agent to self-govern.
• Cross-check Executive Order 14412 compliance obligations for your organization against your current PKI modernization timeline, federal contractors and critical-infrastructure operators should treat the two as the same workstream.