Topic starter
08/07/2026 7:02 pm
TL;DR: Secrets management failures keep turning convenience shortcuts into breach paths and operational outages, with exposed credentials, hardcoded keys, and leaked tokens still common in modern development and cloud workflows, according to Infisical’s guide. The governance gap is not awareness but control over where secrets live, who can fetch them, and how quickly exposure is neutralised.
Editorial analysis by NHI Mgmt Group, based on content published by Infisical: “Secrets Management: The Complete Guide to Protecting API Keys, Credentials & Certificates”.
Key questions
Q: What breaks when organisations do not centralise secrets management?
A: Without centralisation, teams lose visibility into where secrets live, who can access them and whether they have been rotated or revoked.
Q: Why do leaked service credentials so often lead to lateral movement?
A: Because many credentials are over-scoped and reused across systems.
Q: How do security teams know whether secret rotation is actually working?
A: Rotation is working only if exposed credentials are found quickly, revoked everywhere they are used and replaced before attackers can reuse them.
Practitioner guidance
- Inventory every secret and assign an owner Build and maintain a complete registry of API keys, tokens, certificates, and cloud credentials, including where each one is stored and which workload uses it.
- Move high-value credentials into a central vault Stop relying on plaintext files, chat messages, and local .env copies as operational storage.
- Scope credentials to one workload or environment Separate development, staging, and production credentials, and avoid sharing the same secret across unrelated services.
Bottom line: Secrets management failures persist because credentials are still copied, shared, and reused in places that governance cannot reliably see.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:26 pm
Secret sprawl is a governance failure, not a training failure. People will keep taking the fastest path when release pressure is high, which is why the real problem is not awareness but the absence of enforceable control over secret inventory, access, and revocation. A programme that relies on memory, spreadsheet tracking, or ad hoc sharing is already operating beyond its assurance model. The practitioner conclusion is simple: if ownership and lifecycle cannot be proven, the control does not exist.
A few things that frame the scale:
- 88% of security professionals are concerned about secrets sprawl, with 49% of those in larger organisations described as "very concerned", according to the 2024 State of Secrets Management Survey.
- 54% of organisations are dissatisfied with their current secrets management solution because not all secrets are secured, and 43% cite lack of central management, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: Should organisations prioritise dynamic secrets over managed storage?
A: Prioritise dynamic secrets when credential lifetime is the main risk and the workload can authenticate without a permanent shared secret. Prioritise managed storage when the estate is mostly single-cloud and the operating burden of self-managed platforms would create more risk than the credential lifetime you are trying to reduce.
👉 Read our full editorial: Secrets management failures are still driving breach and outage risk