TL;DR: Akeyless argues that secrets management built for static environments is failing under modern NHI sprawl, where over forty-five non-human identities can sit behind each human identity and legacy vaults create friction, overhead, and risk. Static review and rotation models assume a manageable secrets estate; dynamic application ecosystems break that assumption.
At a glance
What this is: This is a vendor analysis of why legacy secrets management no longer fits modern NHI environments, with the key finding that static vault-centric controls cannot keep up with secrets proliferation.
Why it matters: It matters because IAM and PAM teams now have to govern machine credentials, not just human access, and the old assumption that secrets can be tracked and rotated on a slow cadence is no longer reliable.
👉 Read Akeyless's analysis of why legacy secrets management is failing modern NHI governance
Context
The core governance problem is secrets sprawl: modern application estates create far more credentials than legacy vault models were designed to manage. When API keys, encryption keys, and certificates proliferate across cloud and multi-cloud environments, the issue is not just storage but lifecycle control, ownership, and revocation.
Akeyless frames the mismatch as a design problem, not a tooling problem. Traditional vaults were built for more static internal and cloud networks, while modern NHI estates are dynamic, distributed, and harder to inventory, which turns rotation and oversight into a persistent operational burden.
Key questions
Q: What breaks when legacy secrets management is used for modern NHI estates?
A: Legacy secrets management breaks when machine credentials multiply faster than teams can inventory, rotate, and revoke them. Vaults can still store secrets, but they do not solve ownership, lifecycle tracking, or runtime trust across dynamic cloud workloads. The result is secret sprawl, longer exposure windows, and governance that arrives after the risk has already expanded.
Q: Why do unmanaged machine secrets create so much operational risk?
A: Unmanaged machine secrets create operational risk because they are reusable access paths that can persist across services, environments, and deployment cycles. When those credentials are not tied to clear lifecycle ownership, compromise or misconfiguration can spread quickly. The issue is not only breach likelihood, but the difficulty of knowing what still exists and who can still use it.
Q: How do security teams know if secret rotation is actually working?
A: Secret rotation is working only when teams can prove that each credential has an owner, an expiry path, and a tested revocation process. If rotation causes outages, leaves unknown dependencies behind, or cannot be completed quickly after exposure, the control is not operationally mature. Effective rotation reduces usable lifetime without breaking legitimate workloads.
Q: What should IAM teams prioritise before moving to ephemeral credentials?
A: IAM teams should prioritise identity binding, issuance policy, and workload ownership before switching to ephemeral credentials. If the system cannot prove which workload receives a credential, how long it lives, and under what conditions it is valid, short-lived access only moves the problem around. Governance has to be defined at issuance, not just at storage.
Technical breakdown
Why static vault models break under NHI sprawl
Legacy vaults assume secrets are relatively stable assets with predictable owners, known usage patterns, and manageable rotation cycles. That assumption fails in modern application environments where service-to-service communication, ephemeral workloads, and cloud-native deployment patterns create a constantly shifting secrets estate. A vault can store credentials, but it does not by itself solve inventory, ownership, dependency mapping, or safe retirement. When the rate of change exceeds governance cadence, the control surface expands faster than the team can certify it.
Practical implication: Treat vaulting as one control layer, not the governance model for the entire NHI lifecycle.
Why manual rotation creates control debt
Manual rotation sounds like a safeguard, but at scale it becomes a source of risk when every update requires human intervention, troubleshooting, and exception handling. The article points to time loss and operational friction as the visible symptoms of a deeper issue: rotation that depends on human effort cannot keep pace with machine identity growth. In practice, delayed rotation means longer exposure windows, more configuration drift, and a higher chance that teams stop rotating low-visibility secrets altogether.
Practical implication: Prioritise automated rotation paths for high-change credentials and measure the backlog of unrotated secrets.
Why ephemeral credentials change the governance model
Ephemeral or secretless credentials reduce the lifetime of reusable secrets and narrow the attack window, but they also shift governance upstream. Instead of managing long-lived credentials after issuance, teams need controls over identity binding, issuance policy, runtime trust, and short-lived access scope. That changes the centre of gravity from secret storage to authenticated session design. The important shift is that the control objective moves from protecting a static artifact to governing the conditions under which access is minted and consumed.
Practical implication: Design your programme around short-lived issuance and policy enforcement, not just secret storage and rotation.
Threat narrative
Attacker objective: The attacker seeks durable access through reusable machine credentials that can be leveraged across interconnected systems and services.
- Entry occurs when exposed or unmanaged machine secrets give an attacker a reusable credential path into application and cloud environments.
- Escalation follows when those credentials are embedded in workflows, allowing access to spread across services faster than teams can revoke or reissue them.
- Impact emerges as secret sprawl drives larger blast radius, operational disruption, and longer exposure windows for compromised identities and workloads.
Breaches seen in the wild
- Toyota T-Connect key exposure 2022: A subcontractor left a T-Connect server key on public GitHub from 2017 to 2022; 296,019 customers' emails were exposed, misuse unknown.
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Secret sprawl is now a governance problem, not just a storage problem: The article shows that secrets have outgrown vault-centric thinking because modern environments generate, distribute, and retire credentials continuously. That means lifecycle ownership, not vault capacity, is the real control plane. Practitioners should treat secret inventory and revocation as governance obligations, not back-office hygiene.
Forty-five-to-one identity ratios expose the failure of static control assumptions: The quoted ratio of non-human to human identities highlights how quickly machine credentials can outnumber the people expected to oversee them. That scale breaks review cadences designed for human access and exposes a control gap between issuance and oversight. The implication is that governance must move closer to runtime issuance and away from periodic review alone.
Legacy vaults create control debt when they are forced to do lifecycle work they were never built for: The article is explicit that older vault models were designed for more static environments, not today’s dynamic cloud estates. That mismatch creates dependency on manual rotation, exception handling, and specialist knowledge. The result is not just inefficiency but a governance backlog that accumulates risk faster than teams can pay it down.
Ephemeral credentials redefine the security objective: Short-lived credentials reduce exposure, but they also change what needs to be governed. Instead of tracking long-lived secrets after creation, teams must govern issuance policy, runtime trust, and session-bound access conditions. That shifts the field toward runtime governance for machine identity, which is where modern NHI control will be won or lost.
Modern NHI governance needs a named concept: secret lifecycle mismatch: This is the gap between how fast secrets are created and used versus how slowly legacy controls can inventory, rotate, and revoke them. The article makes clear that the mismatch is not theoretical, it is already driving operational overhead and breach risk. Practitioners should frame their programmes around lifecycle speed, not just vault consolidation.
From our research library:
- Enterprises manage far more machine secrets than human ones: 20 times as many according to Enterprise Strategy Group, and 45 times according to GitGuardian.
- Read next: Secrets Management Buyer's Guide
What this signals
Secret lifecycle mismatch: The real issue is not whether organisations have a vault, but whether their credential lifecycle keeps pace with workload change. When secrets are created faster than they can be inventoried and retired, governance becomes reactive and exception-driven.
Legacy secrets programmes should now be measured by how quickly they can reduce the number of long-lived credentials in production. If manual rotation remains the default, the programme is already carrying hidden control debt.
For practitioners
- Map your secret estate by lifecycle stage Inventory where secrets are created, where they are stored, and where they are consumed across cloud and multi-cloud environments. Separate long-lived credentials from ephemeral ones so ownership and rotation policy can be applied by category, not by vault alone.
- Reduce manual rotation dependency Identify secrets that still require human-led rotation or troubleshooting and move those paths to automated renewal or short-lived credential patterns. Prioritise the credentials that support production workloads and external-facing application flows first.
- Set governance rules for ephemeral credentials Define issuance conditions, expiry limits, and workload binding requirements so short-lived credentials are governed at mint time rather than after compromise. Treat runtime trust as the control objective for machine identities.
- Use one control model across human and nonhuman secrets Unify policy, ownership, and reporting for human and NHI secrets where the operational model overlaps, but keep lifecycle controls distinct where machine identity behaves differently from human access. This avoids split governance and duplicate tooling assumptions.
Key takeaways
- Legacy secrets management is failing because modern NHI estates create more credentials than periodic governance can realistically track.
- The article ties that failure to scale, with more than forty-five non-human identities under the surface for every one human identity.
- The practical response is to shift from vault-centred control to lifecycle governance, short-lived credentials, and runtime trust enforcement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Secret sprawl and unmanaged credentials are the central risk discussed in the article. |
| NHI-07 — Long-Lived Secrets | The article argues that static secrets and manual rotation cannot keep up with modern NHI estates. | |
| NHI-05 — Overprivileged NHI | Secrets used across interconnected services can silently expand access beyond intended scope. | |
| Recommendation — Scan for exposed secrets and remove any workflow that allows credentials to spread uncontrolled. Replace long-lived secrets with short-lived credentials wherever workloads can support them. Tighten access scope for each machine identity so credentials cannot be reused broadly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on governing who or what can use credentials across dynamic environments. |
| Recommendation — Review machine access permissions against actual workload need rather than inherited defaults. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Rotation and lifecycle control of credentials are central to the article's argument. |
| Recommendation — Apply authenticator management controls to automate rotation and retire stale machine credentials. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The threat pattern is durable access through exposed or unmanaged secrets. |
| Recommendation — Map exposed secret paths to credential access techniques and hunt for reuse across systems. | ||
Key terms
- Secrets Sprawl: The uncontrolled proliferation of sensitive credentials, API keys, tokens, passwords, certificates, across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
- Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
- Vault-Centric Control: Vault-centric control is a secrets strategy that treats the vault as the main governance point for machine credentials. It is useful for storage and retrieval, but weak on its own when identity lifecycles, runtime trust, and distributed ownership drive the real risk.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
What's in the full article
Akeyless's full post covers the operational detail this post intentionally leaves for the source:
- The webinar framing around how legacy secrets management fails in dynamic cloud estates
- The specific operational burden created by manual rotation and troubleshooting
- The maturity model used to assess how far an organisation has progressed in secrets governance
- The practical argument for ephemeral and secretless credentials in modern environments
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org