Topic starter
25/06/2026 5:06 pm
TL;DR: Secrets management still breaks down at discovery, classification, monitoring, and revocation, with leaked credentials remaining a major operational burden according to Entro Security. The real issue is not whether secrets exist, but whether organisations can govern them as living non-human identities across their full lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “Hard questions you should ask your secrets management service”.
Key questions
Q: What breaks when secrets are reused across developers, agents, and pipelines?
A: When secrets are reused, the same credential can authenticate multiple actors and workflows, which destroys accountability and widens blast radius after exposure.
Q: Why do leaked secrets remain risky even when a vault exists?
A: A vault only helps if the secret can be identified, classified, monitored, and invalidated quickly.
Q: How do identity teams know whether secrets governance is actually working?
A: Identity teams know secrets governance is working when they can prove that every active secret has an owner, an approved scope, and a tested revocation path.
Practitioner guidance
- Establish continuous secrets discovery Scan code, pipelines, vaults, and collaboration tools so every API key, token, password, and certificate is accounted for in one inventory.
- Attach ownership and context to each secret Enrich every secret with system owner, usage scope, rotation cadence, and expiry so classification supports lifecycle decisions rather than static storage.
- Automate revocation on exposure signals Define invalidation triggers for leaked or anomalous secrets so detection can remove access before reuse, not after manual review.
Bottom line: Secrets management fails most often when organisations can store credentials but cannot reliably discover, classify, and retire them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:37 pm
Secrets governance fails when teams treat storage as the finish line: A vault does not solve discovery, classification, or lifecycle control by itself. The hard part is maintaining a complete view of every secret across pipelines, apps, and collaboration channels, then binding each one to ownership and expiry. Without that, the programme protects a subset of the estate while the rest remains operationally invisible.
A few things that frame the scale:
- 88% of security professionals are concerned about secrets sprawl, with 49% of those in larger organisations described as "very concerned", according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: When does over-permissioned secret access become a lateral movement risk?
A: It becomes a lateral movement risk when one credential can reach more systems or data than the originating workload needs. At that point, compromise of a single secret can create a wider blast radius than the business process justifies. Least privilege has to apply to the secret’s actual use path, not just its storage.
👉 Read our full editorial: Secrets management hard questions expose NHI governance gaps