Security? Typically, it is much better than login credentials
Cost? These typically come from your own CA. Only the cost of operating the CA apply
Implementation? You need a way to put the certificates onto the end devices. For the AD integrated CA this is done with GPOs. For everything else, you MD with the help of the API should be used. Of load them manually.
If you found this post helpful, please give it Kudos. If my answer solves your problem, please click Accept as Solution so others can benefit from it.