Topic starter
25/06/2026 1:08 am
TL;DR: Secrets remain a major attack surface because they are often unmanaged, static, and invisible across code, vaults, and cloud workflows, according to SSH Communications Security's analysis of KuppingerCole's Compass coverage. Ephemeral provisioning helps reduce exposure, but access review models still assume credentials persist long enough to be observed and revoked.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “Modern Secrets Management: Elevate Access Security Across the Enterprise”.
Key questions
Q: What fails when teams keep relying on standing secrets?
A: Standing secrets fail because they create reusable access that can be copied, shared, or abused long after the original task.
Q: When should organisations prioritise JIT access over persistent credentials?
A: Organisations should prioritise JIT access when the credential is only needed for a discrete task, session, or approval-bound workflow.
Q: How do identity teams know whether secrets governance is actually working?
A: Identity teams know secrets governance is working when they can prove that every active secret has an owner, an approved scope, and a tested revocation path.
Practitioner guidance
- Inventory every secret path Map where passwords, API keys, certificates, tokens and SSH keys exist in code, pipelines, vaults and cloud workflows, then classify which are standing credentials and which are already ephemeral.
- Shift approval to issuance time Require task-specific policy checks before credentials are issued, so expiry, scope and identity context are enforced before the secret exists.
- Pair secret governance with entitlement review Review who or what can use each credential after issuance, especially in cloud and CI/CD environments where a valid secret can still unlock excessive resource access.
Bottom line: Static secrets remain a governance problem because they can be copied, reused, and abused long after they were issued.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:20 am
Secret visibility is now an identity control, not a storage concern. The article reflects a wider shift in which unmanaged credentials are treated as active access pathways rather than passive configuration artefacts. That matters because secrets hidden in code, pipelines, or vault sprawl can be used without the normal human-authentication signals teams rely on. Practitioners should therefore govern discovery, rotation, and revocation as identity functions, not as vault administration.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between secrets management and CIEM?
A: Secrets management governs the credential itself, including how it is created, stored, rotated, and revoked. CIEM governs the cloud permissions that credential can exercise once it is used. They are different controls, but they need to work together because a short-lived secret can still unlock excessive cloud access.
👉 Read our full editorial: Secrets management and JIT access are reshaping identity controls