Notifications
Clear all
Topic starter
20/08/2026 5:55 pm
TL;DR: Weak secrets management now drives a large share of cloud incidents, with Cycode citing 22% of overall security incidents in 2025 stemming from credentials in public view. The real problem is not storage alone but secret sprawl across code, CI/CD, and collaboration tools, where rotation and detection must work together.
NHIMG editorial — based on content published by Cycode: The Best Secrets Management Tools of 2026
By the numbers:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
Q: How should security teams govern secrets across code, vaults, and collaboration tools?
A: Treat secrets as lifecycle-bound identities, not static strings.
Q: Why do static credentials create more risk than short-lived access tokens?
A: Static credentials create more risk because they remain valid until someone finds and removes them, which gives attackers a durable entry path.
Q: How do organisations know if secrets management is actually working?
A: Secrets management is working only when credentials are absent from endpoints, build logs, environment variables, and source-controlled configuration.
Practitioner guidance
- Expand secret discovery beyond repositories Scan Slack, Teams, Jira, Confluence, and cloud storage in the same control plane as source code so exposed credentials do not escape detection simply because they moved out of Git.
- Prioritise active-secret validation Separate dormant findings from live credentials, then revoke or rotate only the secrets that still authenticate successfully and have a reachable service path.
- Replace static credentials with runtime issuance Use dynamic secrets, workload identity, and short-lived credentials where applications can authenticate without embedding reusable tokens into code or pipelines.
What's in the full article
Cycode's full article covers the operational detail this post intentionally leaves for the source:
- Side-by-side feature summaries for 16 secrets management tools and the environments they fit best.
- Tool-specific notes on rotation, validation, CI/CD integration, and cloud-native support.
- Practical selection criteria for teams comparing vaults, detection platforms, and hybrid approaches.
- Implementation details behind secret detection across code, chat, and cloud storage.
👉 Read Cycode's guide to the best secrets management tools of 2026 →
Secrets management tools in 2026: are vaults enough on their own?
Explore further
20/08/2026 6:35 pm
Vault-only thinking is now a governance failure, not a security strategy. Secrets management tools can store credentials safely, but they cannot compensate for development and collaboration workflows that keep leaking new secrets into uncontrolled places. The discipline now has to treat discovery, validation, rotation, and offboarding as one lifecycle problem. Practitioners should stop evaluating secrets platforms as storage products and start judging them as lifecycle control systems.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded.
A question worth separating out:
Q: What is the difference between secret scanning and secrets management?
A: Secret scanning finds credentials that have been exposed, while secrets management controls how credentials are stored, issued, rotated, and revoked. Scanning is detective. Management is preventive and lifecycle-based. Strong programmes need both because discovery alone does not remove access.
👉 Read our full editorial: Secrets management tools in 2026 expose the limits of vault-only control
