Notifications
Clear all
Topic starter
17/08/2026 4:42 pm
TL;DR: Secretless machine access reduces reliance on stored credentials by using platform-managed roles and federated trust instead of explicit secrets, according to Saviynt. The practical shift is not just stronger authentication, but a broader NHI governance model that treats machine access as lifecycle-managed identity rather than reusable credential storage.
NHIMG editorial — based on content published by Saviynt: Machines without Secrets, "Secretless: The New Best Practice"
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
A: Start by identifying every identity primitive that still exists underneath the abstraction, including certificates, tokens, and workload identities.
Q: Why do secretless controls matter for machine identities?
A: They reduce the number of stored credentials that can be copied, leaked, or reused across environments.
Q: What breaks when organisations keep using long-lived secrets for machine identities?
A: Long-lived secrets make compromise durable, hard to scope, and difficult to detect quickly.
Practitioner guidance
- Inventory workloads that still depend on shared secrets Map cloud, SaaS, and internal applications to identify where machine access still relies on long-lived keys, passwords, or tokens.
- Replace platform-native access with secretless patterns where feasible Use native workload roles and federation for applications that already run inside a cloud control plane or trusted identity boundary.
- Review trust relationships as part of access governance Treat federation links, role assumption paths, and cross-account trust policies as governed identity assets.
What's in the full article
Saviynt's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of secretless machine access in AWS and other cloud environments
- The specific configuration hurdles involved in federated SSO across platforms
- The article's full three-pronged approach for reducing machine identity risk
- Practical guidance on when to use secret vaulting and rotation instead of secretless access
👉 Read Saviynt's analysis of secretless machine identity access and NHI governance →
Secretless machine access: what does it change for IAM teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
Secretless is a workload identity pattern, not a universal replacement for secrets. The article correctly shows that some cloud platforms can issue access without a stored secret, but that does not mean every machine interaction can or should be converted immediately. In practice, secretless works best where the platform can assert identity, the workload boundary is clear, and federation does not introduce unmanaged trust. The practitioner takeaway is to treat it as a targeted identity model, not a blanket architecture decision.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of organisations are currently using a dedicated secrets management system, which helps explain why secret sprawl remains difficult to govern at scale.
A question worth separating out:
Q: Who is accountable when secretless access still fails in production?
A: Accountability sits with the team that owns the workload identity, the federation relationship, and the surrounding access policy. If the platform, application, and security team each assume the other controls the trust path, offboarding and review will fail even when the credential itself is no longer stored locally.
👉 Read our full editorial: Secretless machine identity access is changing NHI governance
