Notifications
Clear all
Topic starter
21/08/2026 5:02 pm
TL;DR: Secrets managers are no longer just encrypted vaults, according to AccuKnox, because the real evaluation criteria are dynamic short-lived credentials, identity-based access control, immutable auditability, and migration without workflow disruption. Static secrets and weak lifecycle governance still create the blast radius that attackers exploit.
NHIMG editorial — based on content published by AccuKnox: Top 5 Things to Look For in a Secrets Manager
By the numbers:
- In 2024 alone, more than 39 million leaked secrets were detected on GitHub.
- 70 percent of secrets leaked in 2022 remain active today, expanding the exploitable credential surface.
- Over 60% of companies experienced secrets-related security incidents in 2024, with hard-coded secrets as the primary cause.
Questions worth separating out
Q: How should security teams replace shared secrets for workloads that span multiple clouds?
A: Use federated workload identity so the workload proves who it is with a signed token or attestation instead of a shared static secret.
Q: Why do encrypted vaults still leave organisations exposed to secrets theft?
A: Encryption protects secrets at rest, but it does not stop valid credentials from being copied and reused once exposed.
Q: What do security teams get wrong about secrets manager migration?
A: They often focus on storage migration and ignore policy translation, endpoint cutover, and workload compatibility.
Practitioner guidance
- Map every secret type to an owning identity Inventory API keys, database passwords, cloud credentials, service account tokens, and certificates, then bind each to a named human, workload, or service identity with a documented owner.
- Replace long-lived secrets with lease-bound credentials Use dynamic issuance for cloud, database, and Kubernetes access so retrieved credentials expire quickly and cannot be reused after the task completes.
- Tighten retrieval policy to secret paths Review whether policies limit access by environment, application, and duty, and remove any broad role that can read more secret paths than required.
What's in the full article
AccuKnox's full article covers the operational detail this post intentionally leaves for the source:
- How AccuKnox maps its Vault-compatible API to existing endpoint changes during migration.
- The specific combinations of AWS, Kubernetes, database, and PKI workflows supported by dynamic credential engines.
- Namespace, policy, and audit configuration details for teams planning a pilot rollout.
- How the platform aligns secrets management with runtime security and CSPM in one deployment.
👉 Read AccuKnox's full article on what to look for in a secrets manager →
Secrets manager governance: are your access controls keeping up?
Explore further
21/08/2026 5:17 pm
Secrets manager evaluation is now an NHI governance problem, not a storage problem. The market language often starts with encryption, but the real failure mode is credential lifetime and retrieval governance. If a secret can be reused after theft, the vault has not solved the access problem, it has only relocated it. Practitioners should judge tools by how they reduce exposure windows and constrain who can retrieve which secret, not by how many secret types they store.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded.
A question worth separating out:
Q: How do organisations know whether their secrets governance is actually working?
A: Look for fewer identities with decrypt rights, fewer hardcoded credentials in code and state, and clear evidence that retired workloads can no longer access secret paths. If secret use still depends on manual exceptions or shared automation roles, governance is present in theory but not in practice.
👉 Read our full editorial: Secrets manager evaluation now hinges on lifecycle, audit, and access
