Notifications
Clear all
Topic starter
25/06/2026 5:15 pm
TL;DR: Secrets management is meant to secure credentials, tokens, certificates, and API keys across machine identities, but Akeyless’ guide shows that fragmented storage, weak rotation, and limited auditing still undermine control. The operational issue is not just storage, but whether lifecycle governance can keep pace with secret sprawl and application delivery.
NHIMG editorial — based on content published by Akeyless: Essential Guide to Secrets Management
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
- The average cost of IT downtime is approximately $5,600 per minute according to Gartner.
- Credential abuse was the most common initial access vector, accounting for 22% of all breaches.
Questions worth separating out
Q: How should security teams govern secrets across cloud and DevOps environments?
A: They should treat secrets as lifecycle-managed identities, not just encrypted values.
Q: Why do long-lived secrets create more risk than teams expect?
A: Long-lived secrets expand the time available for theft, reuse, and lateral movement.
Q: What breaks when secret rotation is not tied to application dependencies?
A: Rotation can silently disrupt services that still depend on stale values, or worse, leave shadow copies active in scripts and configs.
Practitioner guidance
- Map every secret to an owner and a workload Build an inventory that ties each secret to the application, service account, pipeline, or API that consumes it.
- Replace standing credentials with short-lived issuance Use ephemeral credentials for workloads that can tolerate re-authentication, especially in CI/CD and containerised environments.
- Bind rotation to revocation evidence Do not count a credential as protected until you can confirm the old value has been disabled everywhere it was used.
What's in the full article
Akeyless' full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanations of how its secrets management model handles vaulting, dynamic secrets, and zero-knowledge key ownership.
- Direct comparisons of Akeyless with HashiCorp Vault, Azure Key Vault, Google Secret Manager, and AWS Secrets Manager.
- Implementation guidance for CI/CD injection, multi-cloud deployment, and operational rotation workflows.
- Vendor-specific examples of how its platform positions automation, scalability, and storage architecture for production use.
👉 Read Akeyless' essential guide to secrets management and machine identities →
Secrets management lifecycle gaps: what IAM teams need to fix?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 5:50 pm
Secret lifecycle control is now a governance discipline, not a tooling feature. The article describes the familiar mechanics of rotation, vaulting, and access control, but the real issue is whether organisations can manage machine credentials as governed assets across their full lifecycle. When secrets exist in code, pipelines, and distributed workloads, the control problem becomes one of ownership, expiry, revocation, and evidence. Practitioners should treat secrets management as part of identity governance, not as an isolated security utility.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How do organisations know if secrets management is actually working?
A: They should look for short credential lifetimes, complete ownership records, reliable revocation evidence, and audit logs that show where each secret was used. If a team cannot prove who can access a secret and where it is deployed, the programme is providing storage, not control.
👉 Read our full editorial: Secrets management is still failing on lifecycle control and visibility
