Agentic vaults for credentials: what changes for IAM and NHI teams?

TL;DR: Credential sprawl, leaked AI-service secrets and post-quantum risk are converging around one problem: credentials are now the control surface for users, agents and service accounts, according to ConductorOne and GitGuardian data. Traditional vault patterns struggle at agent scale, where broad access or vault sprawl both widen exposure.

NHIMG editorial — what this means for AI and NHI governance

By the numbers:

• 28.65 million new secrets leaked on public GitHub in 2025, up 34% year over year, with leaked AI-service credentials up 81%.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

Questions worth separating out

Q: How should security teams handle exposed secrets in AI-driven environments?

A: Security teams should treat exposed secrets as active access paths and respond as though misuse can begin immediately.

Q: Why do traditional vaults struggle with AI-driven workloads?

A: Traditional vaults assume infrequent human checkout and manual oversight.

Q: What is the biggest risk of storing credentials without strong lifecycle controls?

A: The biggest risk is that the secret outlives the access need.

Practitioner guidance

• Map every secret to a specific identity and use case Inventory API keys, tokens, passwords, certificates, and signing secrets by the identity that can consume them, the workload they unlock, and the policy that should govern disclosure.
• Enforce request-time policy checks for secret revelation Require the vault to evaluate identity, context, and approval state before a secret is disclosed.
• Separate long-lived secrets from short-lived operational access Reserve durable credentials for cases that truly require them and move routine access to just-in-time patterns wherever possible.

What's in the full announcement

ConductorOne's full product post covers the operational detail this post intentionally leaves for the source:

• How Agentic Vault handles request-time policy checks for humans, agents, and service accounts
• The full audit-trail model down to the individual secret, including read and rotation events
• The vendor's description of end-to-end rotation flow, including provisioning, cycling, and destruction
• How decoy credentials are intended to trigger alerts on use

👉 Read ConductorOne's post on post-quantum agentic vault governance for credentials →

Agentic vaults for credentials: what changes for IAM and NHI teams?

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →