Topic starter
08/06/2026 4:56 pm
TL;DR: Poor secrets management remains a leading breach driver, with credential abuse cited in 22% of breaches in the 2025 Verizon DBIR, while cloud environments add more API keys, tokens, and certificates that must be secured, according to Aembit. Static credentials extend exposure windows; identity-first access and workload identity are the governance shift.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “Secrets Management Best Practices for Cloud Environments”.
Key questions
Q: What breaks when cloud teams still rely on static secrets for NHIs?
A: Static secrets create a persistent exposure window.
Q: Why do stored NHI credentials increase cloud compromise impact?
A: Because the credential becomes a standing ticket into cloud services until it is rotated or revoked.
Q: When should organisations move from vault-based secrets to workload identity?
A: Organisations should make the move when workloads are growing faster than manual credential handling can safely support, or when the same secret is reused across services.
Practitioner guidance
- Reduce long-lived credentials first Inventory API keys, passwords, certificates, and tokens that persist beyond a deployment or workload session, then prioritise the ones exposed in code, pipelines, or shared configs.
- Shift eligible workloads to federated identity Replace stored shared secrets with cloud IAM roles and workload identity federation where the platform supports short-lived trust exchange across environments.
- Automate rotation for unavoidable secrets Set rotation triggers by time, use, or security event so that static credentials do not survive long enough to become reusable attack paths.
Bottom line: Cloud secrets risk is driven less by storage location alone than by credentials that remain valid long after the workload or deployment that used them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/06/2026 6:50 pm
Identity-first access is now the practical control boundary for cloud NHI secrets. Static credential governance assumes secrets can be stored, monitored, and rotated fast enough to stay ahead of exposure. In cloud and automated environments, that assumption no longer holds once workloads, pipelines, and AI-driven processes multiply. The implication is that secrets management should be treated as an exception path, not the operating model.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What controls matter most when secrets cannot be eliminated?
A: Rotation, least privilege, and auditability matter most. If a secret must exist, it should be scoped narrowly, rotated automatically, and monitored continuously so that exposure does not become open-ended. Access reviews and event logging help, but only if the credential lifecycle is actively governed from creation through revocation.
👉 Read our full editorial: Secrets management for cloud NHIs is shifting to identity-first access
This post was modified 5 days ago by NHI Mgmt Group