Secrets Management in the Age of AI: Why Vaults Fall Short and What Replaces Them

Every enterprise now manages 109 machine identities for every human one, up from 82 to 1 a year earlier, according to Palo Alto Networks' 2026 Identity Security Landscape report. Seventy-nine of those 109 are AI agents. A secrets vault built to store a password a person might rotate once a quarter was never sized for that ratio. The market spent the first eight months of 2026 proving it: four separate acquisitions worth a combined $26.6 billion, each one folding a standalone secrets or non-human-identity (NHI) vendor into a larger identity or security platform.

Traditional vaults fail AI agents for three specific reasons, not one vague "AI changes everything" reason. They were sized for human-paced rotation. They centralize access behind a single trust boundary that becomes a bottleneck at agent volume. And they treat possession of a secret as proof of authorization, an assumption that breaks the moment the thing holding the secret is a process an attacker can impersonate. What replaces a vault is not a bigger vault. It is credentials that expire in minutes instead of months, issued to a cryptographically verified workload instead of handed to whatever process asks for them.

I built LoginRadius from 2013 into a platform that authenticated over a billion end users, and in the early years a handful of us tracked every service-account password in a shared spreadsheet. That was already fragile for a team of humans. At GrackerAI, the AI research and content platform I run today, agents request credentials for a dozen systems in the course of a single research task, thousands of times a day. A spreadsheet, or a vault built on the same possession-equals-authorization logic as a spreadsheet, does not survive that.

What a vault was built to do

A traditional secrets vault, HashiCorp Vault, CyberArk Conjur, AWS Secrets Manager, works like a safe-deposit box. Something writes a secret in, something reads it out, and the vault's job is to control who gets a key to the box and log every time it opens. That model assumes secrets are created rarely, read by a known, small set of applications, and rotated on a schedule a human sets and remembers to run.

Nothing about an AI agent matches that assumption. An agent doesn't have a fixed set of systems it touches. It decides, mid-task, which database or API it needs next, and it needs a working credential the moment it decides that, not after a change ticket clears.

Three ways agents break the vault model

Volume. A mid-size company managing a few thousand secrets across its infrastructure is a solved problem. An AI pipeline that spins up a fresh container, service account, or task-scoped credential per job can generate more secrets in a day than a five-year-old company accumulated in its lifetime. Vaults built to serve thousands of lookups an hour start queuing when tens of thousands of agents request credentials in the same minute.

Latency and blast radius. A vault is a single trust boundary by design, which is exactly what makes it auditable. It is also exactly what makes it a single point of failure once agents run across regions. An agent in Singapore should not wait on a round trip to a vault in Virginia for every credential it needs, and if that vault goes dark, every agent depending on it goes dark with it.

Possession versus authorization. A vault hands a secret to whatever process proves it holds the right token or certificate to ask for it. That was a reasonable proxy for authorization when the process asking was a known application on a known server. It stops being a reasonable proxy when the process asking is an autonomous agent that can be prompt-injected, hijacked, or misconfigured into requesting access it should never have. Possessing a valid credential and being the legitimate requester are no longer the same fact, and vaults were never built to tell the two apart.

The 2026 consolidation wave is the tell

You don't have to take an architecture argument on faith. Watch where the acquisition money went in 2026.

Read across the four deals and the pattern is not "secrets management is dying." It's that secrets management stopped being sellable as a standalone product. Every acquirer already had an identity, PAM, or data-security platform, and every target was a point solution built specifically for machine and agent credentials. The buyers concluded, with real capital, that agent-scale secrets handling has to sit inside a broader identity platform, not bolt onto a vault. I wrote about the CyberArk deal when it was announced, and the three deals that followed in May, June, and July only confirmed the direction: identity security is consolidating around platforms, not point vaults.

What actually replaces a vault

Two ideas are doing the work, and neither one is "encrypt the box better."

The first is ephemeral, just-in-time secrets. Instead of a password that stays valid until someone remembers to rotate it, an agent gets a credential minted for the specific task, valid for minutes, and useless the moment the task ends. A stolen 90-day API key gives an attacker 90 days. A stolen five-minute credential gives them five minutes, usually less, because by the time they have done anything with it the window has closed. I broke down the exact mechanics of that shift, including how token lifetimes are actually shrinking in production systems today, in my piece on credential lifecycle management for AI agents.

The second is workload identity: proving what a process is through a cryptographic identity instead of a shared secret it carries around. SPIFFE, the open standard most of this space has converged on, issues each workload a short-lived identity document instead of a password. A database can verify that identity directly. No shared secret changes hands, and nothing sits in a vault waiting to be stolen because there is no long-lived secret to steal in the first place.

Neither idea is new. SPIFFE has existed since 2016. What changed in 2026 is that the vendors named above stopped selling these as advanced add-ons and started shipping them as the default. If you want a side-by-side of the tools doing discovery, posture, and workload identity for machine identities specifically, I keep a running comparison in my guide to non-human identity management tools.

What this looked like running agents at GrackerAI

The theory is easy. The part that actually changed our operations was smaller and less glamorous: we stopped writing any credential into an environment file that outlived the process using it.

Early on, our research agents held standing API keys for a handful of data sources, the same pattern every SaaS company defaults to. It worked fine until one agent's task queue backed up and held a live key in memory longer than we intended, which is a boring failure mode until you think about what it means at agent scale. A credential's real exposure window is not what you configured. It is how long the process holding it stays alive, and agents don't have the predictable lifespan of a cron job.

The fix wasn't a bigger vault. It was moving the highest-risk integrations to credentials scoped to a single task and revoked on completion, whether the task took five seconds or five minutes. Audit logs got smaller and more specific instead of bigger and vaguer, because every credential now maps to exactly one task instead of one long-lived service account covering hundreds of unrelated calls. That specificity is the actual payoff. It is not primarily about stopping a breach. It is about being able to answer, precisely, which task touched which system, which is the question every compliance auditor and every incident responder asks first.

Where to start if your vault still looks like 2019

Don't try to replace your vault in one project. Start narrower.

1. Inventory the secrets your AI or automation pipelines actually use, separate from the rest of your credential sprawl. Most teams are surprised by how many standing keys sit behind agents nobody flagged as high-risk.
2. Kill any credential with no expiry first. Not the highest-privilege one, the one with no expiry. An unexpiring low-privilege key is a worse bet than an expiring high-privilege one, because nobody is watching it.
3. Pilot ephemeral credentials on one agent pipeline before touching human SSO or your core vault. Measure the authentication failure rate before and after. It should barely move if the implementation is right.
4. If you still need a managed secrets store for the pieces that aren't ready for workload identity, pick deliberately rather than defaulting to whatever's already installed. I compared the two most common choices for teams making that call in Infisical versus Doppler.

Frequently asked questions

Is HashiCorp Vault or CyberArk dead for AI agents?

No, but neither is sufficient alone anymore. Both now ship or integrate ephemeral-credential and workload-identity features, which is the real story behind CyberArk landing inside Palo Alto Networks for $25 billion. The standalone, possession-based vault-as-product category is what's disappearing, not the vendors.

What is workload identity, in one sentence?

A cryptographic, short-lived identity issued to a piece of software so it can prove what it is without ever holding a shared secret, the way SPIFFE issues identity documents to workloads instead of passwords.

How long should an AI agent's credential live?

As short as the task that needs it, ideally minutes, and revoked immediately on completion rather than on a fixed calendar interval. The goal is matching credential lifetime to task lifetime, not picking a shorter version of the old quarterly rotation.