Topic starter
25/06/2026 5:03 pm
TL;DR: Distributed applications now rely on growing numbers of credentials, API keys, and certificates, and Entro Security argues that embedded secrets and config-file storage are no longer adequate for modern secrets management. The real issue is that secrets governance still assumes centralized control can keep pace with sprawl, ownership gaps, and operational rotation work that most programmes cannot sustain.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “HashiCorp Vault vs Akeyless SaaS secrets management”.
Key questions
Q: What breaks when secrets are stored in code or config files instead of a governed manager?
A: Secrets stored in code or config files are hard to inventory, rotate, and revoke consistently.
Q: Why do distributed applications make secrets governance harder?
A: Distributed applications multiply the number of places a secret can appear and the number of systems that depend on it.
Q: How do organisations know if secrets management is actually working?
A: Secrets management is working only when credentials are absent from endpoints, build logs, environment variables, and source-controlled configuration.
Practitioner guidance
- Inventory every non-human credential path Map where credentials, API keys, and certificates are stored, copied, and consumed across code, config files, CI/CD, and runtime systems.
- Separate storage control from lifecycle control Define who owns issuance, rotation, revocation, and retirement for each secret so a vault decision does not mask governance gaps.
- Test dynamic secret workflows for shared access pressure Check whether short-lived credentials create conflicts when multiple services or NHIs need the same access pattern at the same time.
Bottom line: Secrets management is no longer just about secure storage, because the real control gap is how credentials are governed across distributed application lifecycles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 5:31 pm
Secrets management is now a governance problem, not a storage problem. The article’s core point is that distributed applications generate more credential surfaces than legacy vault assumptions were designed to handle. Once secrets are spread across code, pipelines, and cloud services, ownership and lifecycle control matter more than where the secret started. The practitioner conclusion is that secrets programmes must be judged by operational control coverage, not by whether a vault exists.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between centralised vaulting and lifecycle governance?
A: Centralised vaulting is about where secrets are stored. Lifecycle governance is about how they are issued, used, rotated, revoked, and retired across the full identity estate. A team can have a vault and still fail governance if ownership and retirement processes do not cover every copy of the secret.
👉 Read our full editorial: HashiCorp Vault vs Akeyless SaaS secrets management
This post was modified 1 day ago by NHI Mgmt Group