Secrets Management Horror Stories from the Field: Four Compliance Pitfalls Organizations Can't Ignore

What you'll learn

• Asset inventories that overlook machine identities – ICT registers list servers and applications but can't account for the 82:1 ratio of machine identities authenticating across them.
• Access controls that stop at the human perimeter – MFA and SSO protect workforce access while service accounts and API keys operate with static, long-lived credentials and excessive privilege.
• Vault sprawl with no unified governance – Different teams adopt different secret stores across AWS, Azure, GCP, and on-premises, each with inconsistent rotation, retention, and audit practices.
• Third-party credentials no one owns – External integrations use static tokens created years ago with no visibility into which vendors have access to what.

Topics covered