PKI Spotlight
Overview
Unsung works with PKI Solutions as a partner to supply and implement PKI Spotlight, a monitoring and posture management platform that keeps a continuous view of your certificate authorities, revocation services, certificate inventory and HSMs. For organisations running PKI across several teams, sites or business units, it answers a question many find difficult to answer with confidence: what do we actually have, and is any of it about to fail?
Buying PKI Spotlight through Unsung
Independent licensing advice. We advise on the right licensing model and product mix, so you get value for money from PKI Solutions.
Fit with what you already run. We connect the platform to your ADCS or EJBCA CAs, Luna or nShield HSMs, DigiCert CertCentral and your SIEM, and set alert thresholds that are useful rather than noisy.
Support and pricing. First-line triage comes from our PKI specialists, with escalation to PKI Solutions when needed, and our partnership gives access to partner pricing.
The Challenge
PKI tends to grow quietly. CAs are stood up for individual projects, ownership changes, documentation falls behind, and the estate becomes larger and less understood than the records suggest. The results are familiar:
- Expiries found only when a service stops working
- Revocation infrastructure failing silently until authentication breaks
- Misconfigured templates and weak settings left unnoticed for years
- Troubleshooting that relies on one or two individuals
- Migration and post-quantum planning held back by an inventory nobody trusts
General monitoring tools rarely help, because they watch servers and services rather than the trust relationships between them.
What It Does
PKI Spotlight continuously monitors certificate authorities, revocation infrastructure, templates, validation locations and HSMs, with a topology view of how they depend on each other. It supports Microsoft ADCS and EJBCA, and Luna and nShield HSMs on-premises and in the cloud.
It maintains an inventory of PKI certificates and CRLs with expiry alerts, detects known ADCS risk conditions and configuration drift, and brings public certificates into view through DigiCert CertCentral. Alerts go to Splunk, other SIEMs via syslog, or email. Findings are prioritised by impact, with remediation guidance and a maturity self-assessment against the PKI Consortium model.
How Unsung Helps
We provide the professional services around the platform: deployment and configuration, integration with your CA estate, HSMs and SIEM, and testing to confirm monitoring covers what it should and that alerts reach the right people. Once live, we help you interpret findings, prioritise them against your risk appetite and turn them into remediation work your teams can act on.
We are vendor-neutral. If you mainly need certificate lifecycle automation rather than PKI health monitoring, Keyfactor Command or Certdog may be the better choice, and CRL OCSP Monitor covers revocation services on their own. If PKI Spotlight is not the right fit, we will say so.
Related Unsung Services
- PKI Health Check: A point-in-time assessment of your PKI to complement continuous monitoring.
- PKI Consultancy: Independent advice on PKI strategy, remediation priorities and tooling.
- Certificate Lifecycle Management: Visibility, automation and control across your certificate estate.
- PKI Management & Hosting: Ongoing management of your PKI by our specialists.
