Notifications
Clear all
Topic starter
19/08/2026 3:31 pm
TL;DR: Centralised audit and operational telemetry can help teams detect secret reads, policy changes, and seal events while triggering automated response when suspicious behaviour appears, according to Wazuh. The governance issue is that centralised secrets are only as safe as the visibility and response wrapped around them, not the vault itself.
NHIMG editorial — based on content published by Wazuh: monitoring HashiCorp Vault with Wazuh
By the numbers:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.
- 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits.
- 60% of NHIs are being overused, with the same NHI utilised by more than one application, increasing the risk of widespread compromise if exposed.
Questions worth separating out
Q: How should security teams implement Vault monitoring for secret access and policy changes?
A: Teams should collect Vault audit logs, parse them into meaningful fields, and alert on request types, secret paths, and actor identity.
Q: Why do centralised secrets stores still need active response controls?
A: Centralisation reduces sprawl, but it does not stop misuse after credentials are exposed or abused.
Q: What breaks when Vault audit logging is not enabled or cannot write?
A: You lose the ability to reconstruct who accessed what, when, and under which policy context.
Practitioner guidance
- Enable Vault audit logging before production use Turn on audit devices, preserve logs outside the vault host, and verify that request, response, and policy-change events are captured with usable identity context.
- Normalise Vault events into alertable identity fields Map request.operation, auth.display_name, and request.path into rules so repeated reads, root usage, and policy updates can be correlated quickly.
- Test automated sealing as a containment control Run controlled exercises that validate the sealing script, the alert thresholds, and the service recovery path after a suspicious access pattern is detected.
What's in the full article
Wazuh's full post covers the operational detail this post intentionally leaves for the source:
- Step-by-step Vault audit device configuration for file-based logging and prefixing.
- Custom decoder and rule files for parsing Vault audit and operational events in Wazuh.
- Active Response script wiring for automated sealing when suspicious access patterns are detected.
- Hands-on test commands that generate sample reads, denials, and exfiltration-like activity.
👉 Read Wazuh's guide to monitoring HashiCorp Vault with Wazuh →
Vault audit logging and active response: are your controls ready?
Explore further
19/08/2026 4:13 pm
Vault monitoring is an NHI governance problem, not just an observability problem. A secrets vault is itself a non-human identity control surface because it brokers access to credentials, tokens, and certificates. Once access is centralised, the question becomes whether policy changes, read behaviour, and sealing events are visible enough to support lifecycle governance. The practitioner implication is that vault telemetry must be treated as identity evidence, not just operational noise.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to The State of Secrets Sprawl 2026.
- Our research also shows that 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded.
A question worth separating out:
Q: Who is accountable when automated sealing interrupts Vault availability?
A: The security and platform teams are accountable together because sealing is a governance decision as much as a technical one. Frameworks such as the NIST Cybersecurity Framework and NIST SP 800-53 place responsibility on access control, logging, and incident response discipline.
👉 Read our full editorial: Wazuh and Vault monitoring: what secret access telemetry changes
