Notifications
Clear all
Topic starter
07/06/2026 9:24 pm
TL;DR: Secrets storage is only one part of access security, while access mediation, just-in-time permissions, logging, and offboarding determine whether credentials stay hidden or become operational risk, according to StrongDM. The broader lesson is that identity governance fails when teams treat secrets management and access control as interchangeable.
NHIMG editorial — based on content published by StrongDM: Access Alternatives to HashiCorp Vault
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
Questions worth separating out
Q: How should security teams choose between secrets management and access mediation?
A: Choose secrets management when the main problem is storing, rotating, or generating credentials.
Q: Why do ephemeral credentials not solve privileged access risk on their own?
A: Ephemeral credentials reduce the time a credential can be abused, but they do not narrow the underlying entitlement unless the access scope is also constrained.
Q: What do IAM teams get wrong about vault-based access architectures?
A: They often assume that hiding credentials automatically creates governance.
Practitioner guidance
- Map the full access path before choosing a secrets model Inventory where access is mediated by VPNs, SSH keys, database credentials, Kubernetes APIs, and direct logins, then determine which paths still bypass central policy and session recording.
- Separate secret custody from entitlement control Use a secrets store only for credential protection when the real requirement is storage, rotation, or generation, but add a mediation layer when you need policy enforcement and auditable access.
- Tighten privilege before shortening credential lifetime Set explicit resource scope, approval rules, and session boundaries before relying on ephemeral credentials, because expiration alone does not prevent overreach during the active session.
What's in the full article
StrongDM's full blog post covers the operational detail this post intentionally leaves for the source:
- Platform-by-platform comparison of how StrongDM, Vault, and homegrown tooling differ in deployment and maintenance effort
- Specific use-case fit for databases, servers, Kubernetes, and vendor privileged access workflows
- Practical tradeoffs around audit logging, credential hiding, and SSO integration that implementation teams need
- The article's view of when a homebrew secrets system is realistic and what it demands from in-house security engineering
👉 Read StrongDM's comparison of HashiCorp Vault alternatives →
HashiCorp Vault alternatives: what IAM teams should re-evaluate?
Explore further
08/06/2026 9:20 am
Secrets management is not the same control problem as access governance. This comparison is useful because it forces practitioners to separate credential custody from entitlement enforcement. A vault can reduce exposure, but it does not automatically solve who may reach which system, when, and with what audit trail. The implication is that IAM and PAM programmes should stop treating secret storage as a full access architecture.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure.
A question worth separating out:
Q: Should organisations replace a secrets store with a unified access platform?
A: Not automatically. The right decision depends on whether the organisation needs credential custody, access control, or both. Many teams need a secrets store for application secrets and a mediation layer for privileged human or machine access. The practical question is which control surface closes the gap with the least operational friction.
👉 Read our full editorial: HashiCorp Vault alternatives show access control is the real problem
