Notifications
Clear all
Topic starter
17/08/2026 4:41 pm
TL;DR: Static secrets remain a core enterprise risk even in “secretless” architectures, because dynamic credentials still depend on governed keys, certificates, and token lifecycles, according to Akeyless. The real control shift is from direct secret handling to abstraction, rotation, and Zero Standing Privilege across machine identities and workloads.
NHIMG editorial — based on content published by Akeyless: Secretless architecture and the path from static secrets to universal identity
By the numbers:
- There are over 50 machine identities for every human identity today, and many still rely on secrets for access and authorization.
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
Questions worth separating out
A: Start by identifying every identity primitive that still exists underneath the abstraction, including certificates, tokens, and workload identities.
Q: Why do secretless designs still require strong NHI governance?
A: Because secretless removes direct handling, not the need to issue, validate, rotate, and revoke machine credentials.
Q: What breaks when teams assume secretless means secret-free?
A: Governance breaks first, because teams stop tracking the underlying trust primitives that workloads still depend on.
Practitioner guidance
- Map every secretless trust path back to its underlying identity primitive Document which workloads rely on certificates, tokens, or workload identities and identify who or what issues them, validates them, and revokes them.
- Eliminate standing machine privilege where sessions can be made ephemeral Convert always-on service access to task-scoped issuance, then enforce expiry at the end of the job or session.
- Treat secret detection and revocation as a coupled control Detection alone does not reduce exposure if a leaked credential remains valid.
What's in the full article
Akeyless' full blog covers the operational detail this post intentionally leaves for the source:
- The practical breakdown of static secrets, rotating secrets, and Zero Standing Privilege as implementation patterns.
- The vendor's explanation of how SPIFFE, OIDC, and Universal Identity fit into a secretless architecture.
- The pricing and platform-model details that are only relevant once an organisation is evaluating a specific deployment path.
- The product-level architecture choices for managing certificates, encryption keys, and dynamic credentials at scale.
👉 Read Akeyless' analysis of secretless architecture and machine identity governance →
Secretless architecture: what it means for IAM and NHI teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
Secretless does not remove the governance burden, it relocates it. The security problem moves from developer-visible secrets to the issuance, binding, and retirement of machine trust primitives. That matters because the most important control is no longer where the secret sits, but whether the credential lifecycle is consistently governed across every workload that can request access.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, which is why exposure management must be paired with revocation.
A question worth separating out:
Q: Who is accountable for machine credentials in a secretless model?
A: Accountability sits with the teams that own identity issuance, runtime access policy, and revocation, not with application developers alone. If a workload can mint or inherit access, the owning IAM, platform, and security functions must define the lifecycle and the control boundaries.
👉 Read our full editorial: Secretless architecture still depends on governed secret lifecycles
