Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: Key material fragmented across regions and cloud providers so no single entity can reconstruct it is the core of Akeyless’s Distributed Fragments Cryptography model, according to Akeyless. The real issue is that secrecy, sovereignty, and operational simplicity now have to be governed as one identity and key-management problem, not separate ones.
NHIMG editorial — based on content published by Akeyless: Distributed Fragments Cryptography and the end of the SaaS trust dilemma
By the numbers:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: How do security teams evaluate zero-knowledge key custody in SaaS models?
A: Start by proving that no single provider-controlled component can reconstruct the full key material.
Q: Why do fragmented key architectures matter for regulated enterprises?
A: They reduce concentration risk by preventing any one system from holding complete cryptographic material, which supports sovereignty and audit expectations.
Q: What breaks when secret management is treated as storage only?
A: Storage-only thinking leaves replication, runtime delivery, and offboarding outside governance.
Practitioner guidance
- Validate custody proof, not just vendor assurances Require evidence that no single service path can reconstruct complete keys, and test the fragment boundary as part of design review and audit evidence.
- Map secrets to operational owners and revocation paths Assign explicit ownership for keys, certificates, and secrets, then define who can request, approve, and revoke protected operations across the full lifecycle.
- Review gateway placement and outbound-only trust boundaries Confirm that the customer-controlled fragment remains in your environment and that inbound access paths are not introduced through supporting infrastructure.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Implementation specifics for Distributed Fragments Cryptography across regulated environments and hybrid deployments
- The platform's claims about zero-knowledge custody and how the gateway participates in protected operations
- Compliance positioning for FIPS, SOC 2, ISO 27001, and GDPR in multi-cloud use cases
- How the vendor describes automated rotation and just-in-time access in the context of DFC
👉 Read Akeyless's analysis of distributed fragments cryptography for regulated key custody →
Zero-knowledge key ownership: what it means for regulated teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/09/2026 10:11 am
Zero-knowledge key ownership is a governance model, not a marketing claim. The article’s central proposition is that complete control over secrets and keys can be preserved even in a SaaS operating model if no single party can reconstruct the full cryptographic material. That matters because identity programmes often equate custody with storage, when the real governance question is who can assemble, use, and revoke the material across its lifecycle. Practitioners should treat custody proof as the deciding requirement.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, according to The 2025 State of NHIs and Secrets in Cybersecurity, which shows how redundancy amplifies exposure when lifecycle control is weak.
A question worth separating out:
Q: What is the difference between zero-knowledge custody and ordinary vault encryption?
A: Zero-knowledge custody means the provider cannot reconstruct the full secret at any point, while ordinary vault encryption may still leave the operator or platform with the ability to access complete material. The difference is about who can assemble the key, not just who stores it. That distinction matters most in regulated environments and shared SaaS operations.
👉 Read our full editorial: Zero-knowledge secrets management for regulated enterprise key control
