Topic starter
21/08/2026 4:50 pm
TL;DR: SMBs still store passwords, API keys, certificates, and service accounts in spreadsheets, browsers, and personal tools, and Devolutions argues that this creates audit friction, hidden access paths, and slower operations as credential abuse and third-party risk rise. The core issue is not storage convenience but governed use, because standing secrets and unmanaged checkout processes expand blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Devolutions: “White papers”.
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when SMBs keep secrets in spreadsheets and browsers?
A: They lose control of ownership, rotation, and revocation.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How should SMBs decide when a secure vault is better than a password manager?
A: Use a secure vault when the organisation needs mediated access, approvals, rotation, session logging, and support for human and machine secrets.
Practitioner guidance
- Centralise all high-risk secrets Move admin passwords, vendor logins, API keys, certificates, and service accounts into one governed vault so there is a single source of truth for ownership and use.
- Enforce use without reveal Require credential injection or brokered session launch for privileged work so operators complete tasks without copying secrets into notes, terminals, or chat.
- Time-box every privileged checkout Make approvals expire automatically and bind sensitive access to a specific task, ticket, or change so standing use does not become the default.
Bottom line: SMBs are not mainly facing a storage problem. They are facing a governance problem in which secrets spread across personal tools, vendor access, and machine workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:09 pm
Secret governance is now an SMB control-plane problem, not a storage problem. The article is right to separate convenience from governance because the real failure is not where secrets sit but whether their use is accountable, revocable, and auditable. Once SMBs mix human logins, vendor access, and machine credentials in unmanaged stores, the boundary between access and exposure disappears. That makes secure vaulting a baseline identity control, not an optional hardening layer.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When does secret rotation actually reduce operational risk?
A: Rotation helps when the updated secret is propagated to every dependent system and the change is recorded for audit and incident response. If a rotated credential breaks applications or remains unknown to administrators, the process creates disruption without materially lowering exposure.
👉 Read our full editorial: Secure digital vaults are becoming essential for SMB secret governance