Topic starter
17/08/2026 4:42 pm
TL;DR: Akeyless says static API keys, SSH keys and passwords remain the weak point in multi-cloud and microservice environments, while secretless authentication and passwordless access reduce exposure by replacing long-lived credentials with dynamic, short-lived tokens. Credential governance breaks when the thing being governed exists only briefly, because review, rotation and revocation models assume persistence.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Embracing a Secretless Approach with Akeyless”.
Key questions
Q: What breaks when privileged access still depends on standing secrets in cloud environments?
A: Standing secrets create a durable attack path because the credential remains usable long after the original task has ended.
Q: Why do passwordless and secretless controls reduce identity risk differently?
A: Passwordless controls remove reusable human passwords from the login path, which reduces theft and reuse risk for administrators and employees.
Q: How do security teams know when short-lived credentials are actually working?
A: They are working when access is issued only for a specific task, expires automatically and leaves no reusable secret behind in code, logs or endpoints.
Practitioner guidance
- Map where reusable secrets still exist Inventory API keys, SSH keys, passwords and certificates across cloud, Kubernetes and remote access paths, then identify which ones can be replaced by short-lived credentials.
- Separate human and machine access governance Apply different control patterns to administrators and workloads so that passwordless SSO, MFA and secretless authentication are governed as distinct access models.
- Reduce standing credential duration Replace long-lived machine secrets with ephemeral tokens or certificates issued only for the task, and define expiry as part of the access policy.
Bottom line: Static secrets remain a durable attack path in cloud and microservice environments because they can outlive the workload and the operator.
What's in the full article
Akeyless' full article covers the operational detail this post intentionally leaves for the source:
- Examples of secretless access for PostgreSQL, MySQL, Linux and Kubernetes workflows
- How short-lived SSH certificates and ephemeral API tokens are applied in practice
- The article's incident examples linking compromised credentials to remote access and admin risk
- A closer look at the SPIFFE integration and how workload identity fits into the model
👉 Read Akeyless' analysis of secretless access and passwordless identity for NHI risk →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:47 pm
Static secrets are the real governance debt in modern identity programmes: the problem is not only exposure, it is persistence. Long-lived credentials are designed for reuse, but cloud and microservice environments now expect identities to appear, authenticate and disappear continuously. That mismatch means traditional review and rotation routines often arrive after the risk has already moved on. Practitioners should treat secret lifetime as a first-class governance variable.
A few things that frame the scale:
- 30.9% of organisations store long-term credentials directly in code, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise secret rotation or secret discovery first?
A: They should do both, but rotation is the control that reduces immediate exposure when a secret is already live. Discovery tells you where the problem is. Rotation and revocation tell you whether the credential still works. If you can only choose one urgent action after a leak, invalidate the credential and confirm it is no longer active.
👉 Read our full editorial: Secretless access and passwordless identity reduce NHI risk