Notifications
Clear all
Topic starter
17/08/2026 4:41 pm
TL;DR: Distributed secret vaults are fragmenting visibility, rotation, and access control across modern environments, according to Akeyless, and the article argues that siloed secrets create security, compliance, and management risk that grows as teams multiply vaults. The governance problem is no longer secret storage alone, but whether organisations can still assert control over machine identities and privileged access.
NHIMG editorial — based on content published by Akeyless: secret silos, vault sprawl, and the case for centralized secrets governance
By the numbers:
- 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits.
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
Questions worth separating out
Q: How should security teams govern secrets across multiple vaults?
A: Security teams should govern multi-vault environments above the storage layer.
Q: Why do secret silos increase machine identity risk?
A: Secret silos increase machine identity risk because the same credential can be copied, reused, or forgotten in multiple environments.
Q: What breaks when secret rotation is managed separately in each vault?
A: Rotation breaks down when each vault follows its own schedule, owner, and approval path.
Practitioner guidance
- Build a unified secret inventory Catalogue every vault, secret store, and embedded credential location across cloud, Kubernetes, and self-managed environments.
- Reduce secret duplication across environments Identify where the same credentials, certificates, or tokens appear in multiple places and remove duplicates where feasible.
- Enforce lifecycle controls on machine identities Apply rotation, revocation, and offboarding rules to the secrets that power service accounts, workloads, and automation tools.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step migration planning for moving secrets into a centralized management system.
- Practical guidance on using a universal secrets connector to manage AWS, Azure, Google Cloud, and Kubernetes vaults together.
- Role-based access control considerations for updating, deleting, and auditing distributed secrets from one platform.
- Implementation trade-offs between a fully vaultless model and a federated vault management approach.
👉 Read Akeyless's analysis of secret silos and vault sprawl →
Secret vault sprawl: what is it doing to NHI governance?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
Secret silo sprawl is a visibility failure before it is a storage failure. Once credentials, certificates, and keys are split across vaults, teams stop having a complete inventory of who can access what. That breaks governance because access review, rotation, and incident response all depend on a trustworthy secret map. The practitioner conclusion is simple: if the inventory is fragmented, the control plane is fragmented too.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure.
A question worth separating out:
Q: Which frameworks should teams use to evaluate secret sprawl risk?
A: Teams should use OWASP Non-Human Identity Top 10 for NHI governance, NIST Cybersecurity Framework 2.0 for control alignment, and NIST SP 800-53 Rev 5 Security and Privacy Controls for access control and authentication. Those frameworks help translate vault sprawl into specific control gaps and remediation priorities.
👉 Read our full editorial: Secret vault sprawl is creating governance gaps across NHI estates
