Topic starter
21/08/2026 4:50 pm
TL;DR: SMBs still spread passwords, API keys, certificates, and service accounts across spreadsheets, browsers, and personal tools, Devolutions says, and that leaves offboarding and rotation weak. Vaulting those secrets matters because it makes access accountable, time-bound, and auditable.
Editorial analysis by NHI Mgmt Group, based on content published by Devolutions: “White papers”.
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
Key questions
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How should SMBs decide when a secure vault is better than a password manager?
A: Use a secure vault when the organisation needs mediated access, approvals, rotation, session logging, and support for human and machine secrets.
Q: What breaks when SMBs keep secrets in spreadsheets and browsers?
A: They lose control of ownership, rotation, and revocation.
Practitioner guidance
- Centralise all high-risk secrets Move admin passwords, vendor logins, API keys, certificates, and service accounts into one governed vault so there is a single source of truth for ownership and use.
- Enforce use without reveal Require credential injection or brokered session launch for privileged work so operators complete tasks without copying secrets into notes, terminals, or chat.
- Time-box every privileged checkout Make approvals expire automatically and bind sensitive access to a specific task, ticket, or change so standing use does not become the default.
Bottom line: SMBs are not mainly facing a storage problem. They are facing a governance problem in which secrets spread across personal tools, vendor access, and machine workflows.
Glossary terms: Secure Digital Vault, Secrets Sprawl, Use Without Reveal, Identity Blast Radius
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
21/08/2026 5:09 pm
Secret governance is now an SMB control-plane problem, not a storage problem. The article is right to separate convenience from governance because the real failure is not where secrets sit but whether their use is accountable, revocable, and auditable. Once SMBs mix human logins, vendor access, and machine credentials in unmanaged stores, the boundary between access and exposure disappears. That makes secure vaulting a baseline identity control, not an optional hardening layer.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When does secret rotation actually reduce operational risk?
A: Rotation helps when the updated secret is propagated to every dependent system and the change is recorded for audit and incident response. If a rotated credential breaks applications or remains unknown to administrators, the process creates disruption without materially lowering exposure.
👉 Read our full editorial: Secure digital vaults are becoming essential for SMB secret governance