Notifications
Clear all
Topic starter
17/08/2026 4:39 pm
TL;DR: Traditional vault-centric secrets management is breaking down as cloud-native workflows and machine identity sprawl increase operational complexity, according to Akeyless. The practical issue is no longer storage alone but whether access, rotation, and ephemeral use can be governed without creating a single point of failure.
NHIMG editorial — based on content published by Akeyless: an interview on evolving secrets management and machine identity
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: How should security teams govern cloud secrets across DevOps and runtime systems?
A: Treat secrets as lifecycle-managed NHI credentials, not static configuration values.
Q: Why do traditional vaults create risk in DevOps and multi-cloud environments?
A: Vaults can become a single point of failure when too many workloads depend on one retrieval path or one control boundary.
Q: What breaks when organisations keep using long-lived secrets for machine identities?
A: Long-lived secrets make compromise durable, hard to scope, and difficult to detect quickly.
Practitioner guidance
- Inventory secret distribution paths Map where credentials are stored, copied, injected, and retrieved across CI/CD, cloud workloads, and service accounts.
- Replace long-lived credentials with short-lived access Prioritise workloads that can use ephemeral credentials or task-scoped tokens instead of reusable secrets.
- Treat the vault as a dependency, not a boundary Validate what happens when the central secret store is unavailable and identify which pipelines or services fail closed versus fail open.
What's in the full article
Akeyless's full interview covers the operational detail this post intentionally leaves for the source:
- The interview context around how Refael Angel frames secrets management and machine identity in cloud-native environments.
- The specific reasoning behind the claim that traditional vaults have become a single point of failure.
- The practical discussion of ephemeral credentials and just-in-time access in enterprise workflows.
- The source article’s own explanation of how Akeyless balances security and usability for DevOps teams.
👉 Read Akeyless's interview on secrets management and machine identity →
Secrets management and machine identity: are legacy vaults enough?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:45 pm
Traditional vaults are not a complete control plane for machine identity. They solve storage, but the article exposes the deeper problem of runtime governance across cloud-native workflows. When credentials must be delivered into distributed automation, the risk shifts to availability, scope, and reuse. The practitioner takeaway is that secrets governance must be treated as lifecycle and execution control, not as a storage project.
A few things that frame the scale:
- 88% of security professionals are concerned about secrets sprawl, with 49% of those in larger organisations described as "very concerned", according to The 2024 State of Secrets Management Survey.
- Only 44% of organisations are currently using a dedicated secrets management system, which helps explain why manual secret handling remains common.
A question worth separating out:
Q: Should organisations prioritise JIT access before secrets rotation?
A: No, the two controls should be implemented together. JIT reduces the time a credential can be used, while rotation limits the value of any credential that is exposed. If one is present without the other, attackers still have too much room to act. The stronger programme combines both.
👉 Read our full editorial: Secrets management’s single-point-of-failure problem in cloud workflows
