Topic starter
16/12/2025 5:29 pm
TL;DR: Static secrets still dominate non-human identity access patterns, but they leave a bootstrap trust gap, create multicloud policy drift, and keep revoked credentials alive far too long, according to Aembit and GitGuardian research. Layered identity controls that remove standing credential exposure matter more than vault centralisation alone.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “5 Secrets Manager Alternatives for Securing Non-Human Identities”.
By the numbers:
- 64% of secrets confirmed as valid in 2022 remained unrevoked heading into 2026.
- Credentials for AI services surged 81% as agentic workflows introduced new categories of machine credentials into production stacks.
Key questions
Q: What breaks when secrets managers are the only control for non-human identities?
A: Secret storage remains intact, but trust governance does not.
Q: Why do cloud environments increase non-human identity risk?
A: Cloud environments increase non-human identity risk because automation, APIs, and service accounts multiply faster than manual review can keep up.
A: Warning signs include keys appearing in crash dumps, secrets being moved outside their original secure boundary, and access paths that give engineers or systems broader reach than intended.
Practitioner guidance
- Map bootstrap credentials for every workload Inventory the credential or token each workload uses before it can reach a vault, broker, or cloud-native identity service.
- Prioritise secretless access for cross-cloud workloads Move database, API, and SaaS connections that span clouds toward token-based federation or workload IAM so the secret never crosses the trust boundary in the first place.
- Separate storage control from use control Document which controls only store or rotate credentials and which controls decide whether a workload may use them in the current context.
Bottom line: Secrets managers reduce storage risk, but they do not eliminate the bootstrap trust problem that governs non-human identity access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 7:57 am
Vault centralisation is not identity governance. A secrets manager can store credentials securely, but it cannot by itself decide when a workload should authenticate, where a secret may be used, or whether trust should persist across clouds. That is why the security problem in multicloud is not storage density but issuance control. Practitioners should stop treating vault coverage as a proxy for governance maturity.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- 30.9% of organisations store long-term credentials directly in code, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between workload IAM and secrets management?
A: Secrets management stores and rotates credentials, while workload IAM governs whether a workload should receive access in the first place. Both are needed, but they solve different problems. Without workload IAM, secrets can still be overprivileged or reused too broadly; without secrets management, credentials are still exposed and difficult to revoke.
👉 Read our full editorial: Secrets manager alternatives for non-human identities in multicloud