Notifications
Clear all
Topic starter
16/09/2026 9:20 am
TL;DR: Secrets sprawl grows when acquisitions, deployment workflows, and AI integrations multiply credential copies faster than ownership and retirement processes can keep up, according to Akeyless. The core problem is not secret quantity but lifecycle control: visibility without revocation, rotation, and application refresh discipline leaves reusable access alive long after its business purpose has changed.
NHIMG editorial — based on content published by Akeyless: Enterprise Secrets Management Challenges Grow with the Business
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
- 28% of secrets incidents now originate outside code repositories in Slack, Jira, and Confluence, and they are 13% more likely to be categorised as critical than code-based leaks.
Questions worth separating out
Q: What breaks when secrets are copied into multiple tools and workflows?
A: The control boundary breaks down because revocation in one store does not remove access from every downstream copy.
Q: Why do acquired applications create secrets management risk?
A: Because they often arrive with their own credential stores, rotation habits, and access assumptions.
Q: How should security teams reduce secrets sprawl without disrupting delivery?
A: Start by classifying secrets by business criticality, lifetime, and exposure path.
Practitioner guidance
- Build a credential-to-owner inventory Connect each secret to a responsible team, consuming application, and storage location, including copies in CI/CD variables, logs, and older commits.
- Re-certify inherited access before consolidation For acquired or spinoff applications, verify which credentials are still required, who owns them, and which dependencies would fail if they were retired.
- Replace reusable keys with workload identity where possible Use identity-based access for supported workloads so temporary environments do not depend on persistent API keys.
What's in the full article
Akeyless's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step secrets governance patterns for acquisitions, spinoffs, and mixed legacy estates
- Operational guidance for using Multi Vault Governance across supported external stores
- Implementation detail on automated rotation and application refresh for persistent credentials
- Practical examples of Jenkins job retrieval patterns and where build pipelines still leak secrets
👉 Read Akeyless's analysis of enterprise secrets sprawl and lifecycle drift →
Secrets sprawl and lifecycle drift: where enterprise controls break down?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
16/09/2026 9:21 am
Secret sprawl is really identity sprawl. Once a credential is copied into CI/CD, local tooling, support systems, or inherited stores, the enterprise is no longer governing one secret but many access paths. That is why the control problem sits at the intersection of NHI inventory, ownership, and retirement rather than at the vault alone. Practitioners should treat every copy as a separate governance object.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and those incidents are 13% more likely to be critical than code-based leaks.
A question worth separating out:
Q: Why do AI coding agents complicate secrets management?
A: AI coding agents complicate secrets management because they combine prompting, execution, and environment setup in one workflow. If secrets are copied into prompts, .env files, or repositories, they become easy to duplicate and hard to audit. The problem is not the agent alone, but the speed at which it can spread access material across tools.
👉 Read our full editorial: Enterprise secrets management fails when credentials outlive ownership
