Topic starter
21/08/2026 5:02 pm
TL;DR: Secrets managers are no longer just encrypted vaults, according to AccuKnox, because the real evaluation criteria are dynamic short-lived credentials, identity-based access control, immutable auditability, and migration without workflow disruption. Static secrets and weak lifecycle governance still create the blast radius that attackers exploit.
Editorial analysis by NHI Mgmt Group, based on content published by AccuKnox: “Top 5 Things to Look For in a Secrets Manager”.
By the numbers:
- In 2024 alone, more than 39 million leaked secrets were detected on GitHub.
Key questions
Q: What breaks when secrets are static instead of dynamic?
A: Static secrets break the assumption that access is temporary, contextual, and easy to revoke.
Q: Why do long-lived service account secrets increase breach risk?
A: They extend the window in which a leaked or reused credential remains valid, so a single exposure can become persistent access.
Q: How can security teams tell whether secret management is actually working?
A: Look for fewer plaintext secrets, narrower reuse, faster rotation, and a shrinking set of credentials that remain valid across multiple systems.
Practitioner guidance
- Assess credential TTL discipline Inventory where secrets remain static, where they rotate manually, and where expiration is enforced automatically.
- Bind secret retrieval to identity policy Verify that each human, service account, or workload can only read the specific paths and secret types it needs.
- Require immutable audit evidence Confirm that every secret access event records identity, auth method, secret path, action, and outcome, and that logs can be exported into SIEM without breaking namespace boundaries.
Bottom line: Secrets managers are being judged as governance systems for non-human credentials, not just encrypted storage for sensitive values.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:17 pm
Secrets manager evaluation has moved from storage quality to credential governance. A vault that encrypts values but cannot enforce short-lived issuance, precise identity binding, and traceable access is only solving part of the problem. The modern evaluation lens is whether the platform governs the full lifecycle of a machine credential, from creation through expiry and audit.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should teams prioritise first in secrets governance: rotation, auditability, or access scope?
A: Access scope and lifecycle enforcement usually come first, because rotating a secret that is broadly exposed does not fix overreach. Auditability then proves whether the scope and lifecycle controls are being followed. Rotation is essential, but it is strongest when it operates inside a well-scoped identity model.
👉 Read our full editorial: Secrets manager evaluation now hinges on lifecycle, audit, and access