Notifications
Clear all
Topic starter
24/06/2026 10:21 pm
TL;DR: Secrets management still breaks when teams treat vault storage or scanning as the end state, because exposure context, ownership, rotation status, and access scope determine whether a leaked credential is merely detected or actually exploitable, according to Entro Security. The operational requirement is not more secrets inventory, but contextual governance that makes revocation, monitoring, and accountability actionable.
NHIMG editorial — based on content published by Entro Security: Context is king when it comes to secrets management
By the numbers:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks.
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: How should security teams govern leaked secrets when they are still valid?
A: Treat leaked secrets as active identity assets until proven otherwise.
Q: Why do secrets in private repositories still create security risk?
A: Private repositories are not a guarantee of safety because many secrets leak through internal collaboration tools, copied snippets, CI/CD logs, and downstream configuration files.
Q: What is the difference between storing secrets securely and governing them well?
A: Secure storage protects where the secret sits.
Practitioner guidance
- Map every secret to a live owner and workload Record which application, database, pipeline, or integration the secret authorises, and assign a business owner who can approve revocation when the secret is exposed or retired.
- Connect discovery to automated revocation Do not stop at alerting when a secret is found in a repo, chat channel, or ticketing system.
- Review secrets by exposure context, not just age Prioritise public leaks, production credentials, and secrets used by high-privilege machine identities ahead of low-impact dev credentials, even when the leaked item is older.
What's in the full article
Entro Security's full blog covers the operational detail this post intentionally leaves for the source:
- Examples of how context-aware secrets management maps ownership, exposure, and rotation state to each secret.
- Discussion of how access controls, monitoring, and auditing work together when secrets are exposed.
- Operational examples of how teams can interpret the age of a secret, where it was used, and who owns it.
- Explanation of how the platform frames the relationship between secrets and NHI governance.
👉 Read Entro Security's blog on context-aware secrets management →
Context-aware secrets management: what IAM teams are missing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 6:58 am
Context-aware secrets management is really about identity context, not storage. A vault can hold a secret, but it cannot by itself answer the governance questions that matter: who owns it, what system it protects, where it was exposed, and whether it is still active. That missing context is what turns secrets handling into NHI governance rather than file protection. Practitioners should treat every secret as an identity object with lifecycle state, exposure history, and business dependency.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to The State of Secrets Sprawl 2026.
- A separate finding shows that 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks.
A question worth separating out:
Q: Who should be accountable for secrets that belong to applications or service accounts?
A: Accountability should sit with the team that owns the workload, not with a generic security inbox. Secrets tied to applications, pipelines, or machine identities need a named operational owner who can approve rotation and revocation, and an identity programme that tracks those decisions through the lifecycle.
👉 Read our full editorial: Context-aware secrets management is now baseline NHI control
