Midsize and large organizations spend tens of thousands or even millions of dollars annually on storage encryption. They dedicate hundreds of internal engineering hours to mapping data hierarchies and managing role-based access control.
After investing all that time and money locking down storage, they often leave the keys in plain sight.
Secrets sprawl has emerged as the greatest threat to storage security. The scale of exposed keys and hardcoded credentials has reached an all-time high, driven by cloud adoption, engineering velocity and the boom in generative AI.
Reining in secrets sprawl requires a control plane that unifies cryptographic key management and identity governance. The control plane combines context-aware access, separation of duties and zero standing privilege to create a truly resilient storage environment.
The Alarming Scope of Secrets Sprawl
According to the State of Secrets Sprawl 2026 report, 28.65 million new secrets were detected in code stored on GitHub in 2025 alone, a 152 percent increase since 2021. The report also notes that 32.2 percent of corporate repositories contain at least one hardcoded secret — a potential goldmine for attackers.
The risk isn’t just that secrets leak. It’s that they are rarely rotated or revoked. Tracking shows that 64 percent of secrets first detected in 2022 were still active and exploitable in 2026. Once a key spills into developer ecosystems or log files, it tends to stay active until a breach occurs.
The rapid adoption of AI coding assistants has accelerated secrets sprawl. AI-assisted commits leak secrets at roughly twice the rate of human-written code. AI generators often hallucinate or pull standard placeholder strings that developers replace with real production tokens.
Direct Correlation to Major Breaches
According to the Verizon 2026 Data Breach Investigations Report, vulnerability exploitation overtook credential abuse as the No. 1 initial access vector for the first time in the report’s 19-year history. However, stolen or abused credentials still appeared somewhere in 39 percent of all breach pathways.
Threat actors rely on compromised secrets to escalate their privileges, move laterally through the infrastructure and exfiltrate data. Encryption keys and active credentials are typically stolen during an initial intrusion. Organizations often patch the vulnerability or close the exploit vector but fail to rotate the secrets that were exposed.
Attackers increasingly steal active session secrets or exploit unauthorized third-party OAuth tokens to gain high-privilege access to corporate cloud resources. OAuth tokens often grant long-lived access, enabling an attacker to decrypt and exfiltrate entire storage buckets. Hijacked secrets also give an attacker access to administrative storage functions.
Addressing the Root Causes of Secrets Sprawl
Over-privileged service accounts are a major source of secrets sprawl. Storage systems also depend heavily on non-human identities that often lack basic protections. Hardcoded secrets and poor rotation practices compound the risk.
A shocking number of organizations use native cloud or hardware encryption but leave the cryptographic keys in the same console or account as the data. A lack of contextual access control allows attackers to use stolen credentials from anywhere.
A truly resilient storage environment uses a zero-standing-privilege model for just-in-time access. If an attacker uncovers an API key or uses a cloned token, the secret is already useless.
It also treats identity governance and cryptographic key management as a unified control plane that ties decryption requests to a verified identity. If the identity’s context changes, the storage layer automatically revokes the ability to decrypt.
A unified plane ensures that storage administrators can’t access the systems managing the keys. Conversely, the team managing the keys can’t access the storage hardware. This prevents a compromised identity from controlling both lock and key.
Potential Pitfalls to Avoid
When organizations attempt to build this unified plane, they often rely on one cloud provider’s identity and key tools. That can leave on-premises storage or secondary clouds disconnected from the unified plane. Implementing dynamic, short-lived keys also creates massive amounts of log data. Without automated filtering, security teams can be overwhelmed by the noise.
Technologent's data management team helps organizations develop a unified data resilience strategy that secures storage at scale. Cyber resilience is embedded in every asset and managed through a single pane of glass. Contact our experts for help reining in secrets sprawl and reducing the risk of a devastating breach.
Comments