Topic starter
04/06/2026 3:03 pm
TL;DR: Most enterprises now run five to ten secret stores at once and are unlikely to consolidate them, according to Oasis Security, because local vault choices are shaped by cloud, CI/CD, SaaS, and acquisition realities. That makes vault-centric PAM structurally insufficient: governance has to span discovery, context, policy, and dependency-aware rotation across every store.
Editorial analysis by NHI Mgmt Group, based on content published by Oasis Security: “The Multi-Vault Reality of Modern PAM”.
Key questions
Q: What breaks when PAM only governs one vault in a multi-vault environment?
A: The programme loses a unified view of ownership, active usage, and lifecycle state.
Q: Why does multi-vault sprawl increase privileged access risk?
A: Because every extra store adds another place where secrets, ownership, and dependency data can diverge.
Q: How do security teams know if PAM is actually working?
A: Look for evidence that elevated rights are short-lived, session activity is logged, and access reviews result in real removals rather than paperwork.
Practitioner guidance
- Define a cross-vault governance layer Create a control plane that sits above AWS Secrets Manager, Azure Key Vault, enterprise vaults, and CI/CD stores so policy is enforced consistently across all privileged credentials.
- Map the consumer-to-resource chain Record which application, service, or pipeline consumes each secret, what identity it authenticates as, and which resource it reaches before you approve rotation or offboarding.
- Inventory non-human identities beyond the vault Search for secrets in code, environment variables, developer tooling, SaaS stores, and acquired environments so the programme sees what vault inventory alone will miss.
Bottom line: Multi-vault estates turn PAM into a governance challenge because no single vault can explain ownership, runtime use, or dependency impact across the full privileged access footprint.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 3:17 pm
Multi-vault PAM is now a governance layer problem, not a vault problem: once privileged identities span cloud-native stores, enterprise vaults, SaaS platforms, and acquired environments, no single vault can tell the full access story. The control question changes from where a secret lives to whether the organisation can govern its lifecycle and usage coherently. Practitioners should stop treating vault consolidation as the default answer and start treating cross-vault governance as the primary design constraint.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: When should teams prioritise governance above vault consolidation?
A: Prioritise governance first whenever cloud, SaaS, CI/CD, and acquired environments already hold secrets that cannot be cleanly moved into one store. Consolidation often fails because platform integrations, licensing costs, and developer workflow friction preserve sprawl. Governance above the vault is the scalable control point.
👉 Read our full editorial: Multi-vault PAM is now an enterprise governance problem