Notifications
Clear all
Topic starter
21/08/2026 4:50 pm
TL;DR: SMBs still store passwords, API keys, certificates, and service accounts in spreadsheets, browsers, and personal tools, and Devolutions argues that this creates audit friction, hidden access paths, and slower operations as credential abuse and third-party risk rise. The core issue is not storage convenience but governed use, because standing secrets and unmanaged checkout processes expand blast radius.
NHIMG editorial — based on content published by Devolutions: Why your small or mid-sized business needs a secure digital vault
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system, according to Akeyless' 2024 State of Secrets Management Survey.
- 88% of security professionals are concerned about secrets sprawl, with 49% of those in larger organisations described as very concerned, according to Akeyless.
Questions worth separating out
Q: What breaks when SMBs keep secrets in spreadsheets and browsers?
A: They lose control of ownership, rotation, and revocation.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How should SMBs decide when a secure vault is better than a password manager?
A: Use a secure vault when the organisation needs mediated access, approvals, rotation, session logging, and support for human and machine secrets.
Practitioner guidance
- Inventory every secret-bearing system Build a complete list of admin passwords, vendor logins, API keys, certificates, and service accounts, then identify where each one is stored and who can use it.
- Move to mediated secret use Require use without reveal for privileged sessions, remote access, and high-risk scripts so users and operators do not copy secrets into terminals or notes.
- Apply lifecycle rules to machine identities Assign explicit owners, rotation schedules, and offboarding triggers to service accounts, API tokens, and certificates.
What's in the full article
Devolutions' full white paper covers the operational detail this post intentionally leaves for the source:
- A full feature-by-feature comparison between a secure digital vault and a password manager for SMB use cases.
- Detailed capability guidance on approvals, rotation, session recording, and secret injection without reveal.
- Deployment and integration considerations for cloud, on-premises, and hybrid environments.
- The vendor's implementation framing for remote access brokering, break-glass readiness, and SIEM export.
👉 Read Devolutions' white paper on secure digital vault requirements for SMBs →
Secure digital vaults for SMBs: what governance gap are teams missing?
Explore further
21/08/2026 5:09 pm
Secret sprawl is no longer a storage inconvenience. It is an identity lifecycle failure. When credentials live in spreadsheets, browsers, and personal tools, the organisation loses the ability to prove ownership, enforce rotation, or revoke access cleanly. That is why the control problem spans human IAM, privileged access, and non-human identity governance at the same time. SMBs should treat every unmanaged secret as a governed identity asset, not a convenience item.
A few things that frame the scale:
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- 54% of organisations are dissatisfied with their current secrets management solution because not all secrets are secured, according to the same survey.
A question worth separating out:
Q: Who should be accountable for secrets governance in a small business?
A: Accountability should sit with the teams that own access risk, usually IAM, PAM, security operations, and system owners together. The key is to avoid treating secrets as a purely IT storage problem. If a secret can open a system, someone must own its lifecycle from issuance through revocation.
👉 Read our full editorial: Secure digital vaults are becoming essential for SMB secret governance
