Topic starter
25/06/2026 5:07 pm
TL;DR: Secrets management fails when organisations treat vaulting as the finish line: 80% of secrets still slip through the cracks, and automated rotation is needed to shrink exposure windows and support compliance, according to Entro Security. The practical issue is governance, not storage, because centralisation, rotation, monitoring, and least privilege only work when they are operationally coordinated.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “9 Secrets Management Strategies that every company should adopt”.
By the numbers:
- 80% of secrets slip through the cracks and go unnoticed when organisations rely on fragmented vaulting, according to Entro Security.
Key questions
Q: What breaks when organisations rely on vaults alone for secrets security?
A: Vaults help store secrets, but they do not solve visibility, governance, or exposure detection on their own.
Q: Why do exposed API keys and tokens create such a high-risk failure mode in software delivery?
A: Exposed secrets matter because they often grant direct access to cloud accounts, source repositories, databases, or release pipelines.
Q: How do security teams know if secret rotation is actually working?
A: Secret rotation is working only when teams can prove that each credential has an owner, an expiry path, and a tested revocation process.
Practitioner guidance
- Centralise the secrets inventory Consolidate API keys, access tokens, and certificates into one governed inventory so policy, monitoring, and audit can operate on a complete view of exposure.
- Remove hard-coded secrets from code paths Scan repositories, build scripts, and deployment artefacts for embedded credentials and replace them with managed secret references before they propagate further.
- Map secret consumers before rotation Identify every application, service, and pipeline that depends on a shared secret so rotation can be sequenced without breaking runtime authentication.
Bottom line: Secrets management fails when vaults are treated as the endpoint rather than one control in a wider lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 5:37 pm
Secret governance debt is the real problem: organisations do not fail because they lack a vault, they fail because secrets exist in too many states at once. Some are centralised, some are embedded in code, and some are still active after their intended use. The practical conclusion is that secrets management is a lifecycle discipline, not a storage decision.
A few things that frame the scale:
- Enterprises manage far more machine secrets than human ones: 20 times as many according to Enterprise Strategy Group, and 45 times according to GitGuardian.
A question worth separating out:
Q: Should organisations treat NHI secrets and human credentials under the same governance model?
A: Yes, when the credential can authenticate to production systems or cloud services. The governance logic is the same: know who or what it belongs to, limit privilege, shorten lifetime, and remove it cleanly when the owner changes or the task ends. The controls differ in execution, but the lifecycle risk is shared.
👉 Read our full editorial: Secrets management strategies for NHI governance and exposure control
This post was modified 1 day ago by NHI Mgmt Group