Topic starter
25/06/2026 12:43 am
TL;DR: Akeyless says financial organisations face exploding machine identity counts, with secrets, tokens, and certificates now underpinning APIs, pipelines, and AI-driven tools while static or shared credentials widen breach risk. The governance gap is no longer storage alone; it is whether lifecycle, privilege, and revocation controls can keep pace with machine-speed access.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Why a Secrets Management Strategy Is Key for Finance Organizations”.
By the numbers:
- Machine identities now outnumber humans 82 to 1 in financial organizations.
- The average breach in financial services now costs $5.56 million, according to IBM’s Cost of a Data Breach Report 2025 cited by Akeyless.
Key questions
Q: What breaks when machine secrets are stored in code or left unrotated?
A: The organisation loses the ability to prove where access exists, who owns it, and whether compromise has already spread.
Q: Why do machine identities increase financial control risk?
A: Machine identities increase financial control risk because they can operate with standing privilege, scale across systems and keep acting after the original business need has changed.
Q: How can organisations tell whether secrets management is actually working?
A: Look for reduced secret sprawl, faster revocation, and fewer unmanaged copies outside the central system.
Practitioner guidance
- Standardize machine identity inventory Map every application, bot, microservice, and AI agent that authenticates with a secret, then assign ownership and review cadence for each credential set.
- Replace standing secrets with task-scoped issuance Issue secrets only when a workload needs them, bind them to context and role, and expire them as soon as the task completes.
- Automate rotation and revocation Set rotation triggers for schedule, use, and suspected compromise, then verify revocation actually removes access from connected systems.
Bottom line: Financial organisations now depend on machine identities and AI agents that expand the number of credentials security teams must govern.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- How the zero-knowledge architecture and Distributed Fragments Cryptography model changes secret handling in regulated environments
- The finance-specific compliance mapping across PCI DSS, GLBA, NYDFS, SOX, and SEC expectations
- The on-demand identity model for AI agents and machine workloads, including ephemeral access patterns
- The vendor's operational claims about hybrid SaaS delivery and customer-controlled key fragments
👉 Read Akeyless's analysis of secrets management for financial machine identities and AI agents →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
25/06/2026 9:43 am
Machine identity sprawl is now a finance governance problem, not a vault problem: The article shows that credentials sit inside a much larger access model spanning APIs, pipelines, cloud systems, and AI-driven tools. Once machine identities outnumber humans by such a margin, the real issue becomes whether the organisation can inventory, scope, and revoke access across every runtime identity. Practitioners should treat secrets management as a governance function tied to lifecycle and entitlement control.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
- 54% of organisations are dissatisfied with their current secrets management solution because not all secrets are secured, and 43% cite lack of central management, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: Who should be accountable for secrets exposed in AI workspaces?
A: Accountability should sit jointly with IAM, security operations, and the business owners of the workspace. IAM governs privileged access, security teams handle detection and revocation, and business leaders set acceptable-use rules. If the platform stores or reveals secrets, the governance gap is organisational, not just technical.
👉 Read our full editorial: Secrets management for financial machine identities and AI agents
This post was modified 4 hours ago by NHI Mgmt Group