Notifications
Clear all
Topic starter
17/08/2026 4:38 pm
TL;DR: Secure storage, time-bound access, auditability, and cross-domain controls are now table stakes for protecting secrets, certificates, and confidential files across a growing enterprise estate, according to Arcon. The harder problem is governance: zero trust only works when storage, sharing, and deletion are enforced consistently, not just promised at the application layer.
NHIMG editorial — based on content published by Arcon: Why did ARCON build My Vault solution?
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: How should security teams govern secrets across multiple vaults?
A: Security teams should govern multi-vault environments above the storage layer.
Q: Why do cross-domain file-sharing controls fail so often?
A: They fail when organisations assume internal identity rules automatically apply to external users.
Q: What breaks when credentials are stored outside a secrets manager?
A: When credentials live in code, config files, or CI/CD systems, they bypass the controls that make secrets governable.
Practitioner guidance
- Map vault entitlements to asset lifecycle Document who can create, request, transfer, download, and delete each category of secret or file, then tie those permissions to the asset’s business owner and retention rules.
- Enforce step-up controls for external recipients Require stronger authentication and per-item approval before any cross-domain user can access shared content, especially files that can be copied or forwarded outside the vault.
- Time-limit sensitive access by default Set time-bound access and automatic deletion for secrets, certificates, and high-risk files so access expires when the task or collaboration ends.
What's in the full article
Arcon's full post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step product behaviour for secure file upload, sharing, and ownership transfer workflows.
- Details of cross-domain access handling, including two-factor authentication and restriction logic for shared content.
- How the vault synchronises with the DRM folder and what that means for operational file handling.
- The integration points with privileged access management for centralised control over sensitive assets.
👉 Read Arcon’s analysis of secure vault controls for secrets and confidential files →
Vault controls for secrets and files: what IAM teams should check?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
Zero-trust vaulting is an NHI governance control, not just a storage pattern. The article’s core value lies in its recognition that secrets, certificates, and confidential files need policy enforcement at the storage layer. That shifts the discussion away from repository design and toward lifecycle control, auditability, and access containment. Practitioners should judge vaults by whether they reduce standing exposure and improve governance outcomes, not by whether they simply encrypt data.
A few things that frame the scale:
- 88% of security professionals are concerned about secrets sprawl, with 49% of those in larger organisations described as "very concerned", according to The 2024 State of Secrets Management Survey.
- 54% of organisations are dissatisfied with their current secrets management solution because not all secrets are secured, and 43% cite lack of central management.
A question worth separating out:
Q: Should organisations replace their credential vault before adopting new PAM controls?
A: Not necessarily. The better question is whether the current vault, rotation process, and session controls already provide a complete governance chain. If they do not, organisations should define which system is authoritative for storage, access, and invalidation before adding another platform into the stack.
👉 Read our full editorial: Zero-trust vault controls for secrets and file sharing
