The practice of storing and governing credentials in one authoritative system rather than scattering them across Git, clusters, CI tools, and local files. Done well, it improves rotation and auditability. Done poorly, it simply moves sprawl to another layer.
Expanded Definition
secret centralisation is the governance pattern of placing credentials, tokens, API keys, and certificates under one authoritative control plane so discovery, rotation, access policy, and audit can be applied consistently. In NHI programs, it is not merely a storage choice; it is an operational control that reduces uncontrolled duplication across Git repositories, CI tools, Kubernetes manifests, and local developer files. The distinction matters because a central vault can still be ineffective if teams export secrets into side channels or if the central system lacks lifecycle enforcement. Definitions vary across vendors on whether a secrets manager alone constitutes centralisation, so NHI practitioners should judge the design by enforcement outcomes rather than product category. The OWASP Non-Human Identity Top 10 treats poor secret handling as a core identity risk, especially when standing credentials persist without strong governance. The most common misapplication is treating a central vault as solved risk, which occurs when teams continue to sync copies into pipelines and configuration files.
Examples and Use Cases
Implementing secret centralisation rigorously often introduces dependency on a single control point, requiring organisations to weigh faster rotation and better auditability against operational coupling and recovery planning.
- A platform team stores deployment tokens in one managed vault, then injects short-lived values into workloads at runtime instead of committing static values to source control.
- A security team uses a central service to rotate database passwords across microservices, avoiding the drift that appears when each application owner manages credentials independently.
- During incident response, investigators trace access patterns through one authority rather than searching Git history, build logs, and shell scripts for hidden copies of the same secret.
- In a CI/CD environment, centralisation helps prevent the pattern highlighted in the Reviewdog GitHub Action supply chain attack, where exposed workflow paths can multiply credential exposure.
- For workload identity, teams align the vault with external identity mechanisms such as the SPIFFE overview so workloads fetch what they need without embedding long-lived secrets in build artifacts.
Centralisation also supports lessons from the Guide to the Secret Sprawl Challenge, where scattered credentials create blind spots across toolchains and teams.
Why It Matters in NHI Security
Secret centralisation matters because NHI compromise usually begins with a credential that was too easy to find, too hard to revoke, or too widely copied. NHI Mgmt Group reports that 96% of organisations store secrets outside of secrets managers in vulnerable locations, which shows how often central governance is bypassed in practice. That kind of sprawl turns rotation into a partial exercise and offboarding into guesswork. It also weakens Zero Trust programs, because one leaked secret can open access across systems that were assumed to be segmented. A central model only improves security when it is paired with inventory, access policy, rotation, and revocation discipline. The same logic applies to incident containment: if a credential is not centrally governed, teams cannot prove where it was used or whether every copy was removed. Organisations typically encounter the full cost of secret centralisation only after a leak, at which point credential recovery and reissuance become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Secret sprawl and weak credential governance are core non-human identity risks. |
| NIST CSF 2.0 | PR.AC-1 | Identity and credential management rely on controlled access to secrets repositories. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust depends on limiting credential exposure and validating access paths. |
| NIST SP 800-63 | Digital identity assurance principles inform strong credential handling and revocation. | |
| CSA MAESTRO | Agentic systems need governed secret access so tool use stays bounded and auditable. |
Centralize secrets under enforced lifecycle controls and eliminate unmanaged copies across code and pipelines.
