TLDR
- A vault stores the secrets it knows about. It does not find the ones already committed to Git, hardcoded in CI variables, or sitting in a SaaS integration config.
- The three distinct problems in secrets management for non-human identities are storage, discovery, and rotation. Most platforms do one well and the other two partially.
- HashiCorp Vault, Akeyless, and Conjur are built for the storage and rotation problem. GitGuardian and Entro are built for the discovery problem. Doppler and Infisical sit closest to developers and handle storage well but rotation depends heavily on your stack.
- Cloud-native options (AWS Secrets Manager, Azure Key Vault) are cheap to operate if you already live in one cloud, but they fragment across multi-cloud and do not detect secrets that never went through them in the first place.
- The operating cost of a vault at scale is not the licensing fee. It is the rotation breakage, the consumer migration effort when you rekey, and the engineer time spent debugging auth method misconfigurations.
The best secrets management platforms for non-human identities are HashiCorp Vault (self-hosted, maximum control), Akeyless (SaaS vault with unified secrets gateway), Conjur (DevOps-focused secrets management), AWS Secrets Manager (low-friction for AWS-only shops), Azure Key Vault (tightly coupled to Microsoft workloads), Doppler (developer-first, CI-friendly), Infisical (open-source with strong GitOps integration), GitGuardian (detection and historical leak remediation), Entro (NHI context and secrets risk scoring), and 1Password Secrets Automation (team-friendly with service account support).
Why “Secrets Management for Non-Human Identities” Returns NHI Governance Tools, Not Vaults
Search that phrase and you will land on NHI governance category pages, not vaulting tools. The reason matters for buying decisions. NHI security platforms position themselves as the orchestration layer above secrets management: they inventory every service account, API key, and OAuth token, map what those identities can reach, and flag standing privilege. Secrets management tools are the storage and delivery layer beneath that.
The boundary is specific. A secrets management platform stores a credential, controls who can read it, and optionally rotates it on a schedule. It has no opinion about whether the credential should exist, whether it grants excessive permissions in your AWS IAM policy, or whether a developer copied it into a GitHub Actions secret three sprints ago. NHI governance tools handle the second set of questions. The tools in this article handle the first.
Where the line blurs: Entro and GitGuardian have moved into both sides, and Conjur is sold alongside broader PAM tooling that does handle privilege governance. For teams evaluating a complete program, the decision is not vault versus NHI platform. It is which layer to fix first, and the answer depends on whether your immediate risk is secrets sprawled across codebases or secrets in the vault that rotate and break consumers every ninety days.
The SecurityOpsWire Secrets Gap Audit: Matching the Tool to the Actual Problem
Before reaching for any platform, the buying decision collapses to three distinct gaps. Most teams have all three, but one is actively burning them today.
Gap 1: Storage. Credentials live in environment variables, config files, or a spreadsheet someone owns. Nothing is centralized. The fix is a vault, any vault. Get centralized first; optimize later.
Gap 2: Discovery. A vault exists but the team does not know what is outside it. A developer hardcoded a token six months ago. A CI pipeline pulls a database password from a repo variable that was set in 2021. The vault does not see these. Secret scanning and NHI context tools address this gap, not more vault features.
Gap 3: Rotation without breakage. The vault exists, the secrets are centralized, but rotation is manual because every time auto-rotation fires, something breaks. This is a consumer-side architecture problem more than a vault problem, but some platforms handle it better than others. Dynamic secrets (short-lived credentials generated per-request) eliminate the rotation-breakage problem at the cost of more complex consumer code.
Run this audit before reading vendor datasheets. A team with Gap 2 does not benefit from a more sophisticated vault until they know what they are not vaulting.
9 Best Secrets Management Platforms for Non-Human Identities
1. HashiCorp Vault
HashiCorp Vault is the reference implementation for secrets management in any environment that runs workloads outside a single cloud provider. Its dynamic secrets engine generates short-lived credentials for AWS, GCP, Azure, databases, PKI, and SSH on demand, so the rotation-breakage problem is largely architectural: if consumers request a new credential per session, there is nothing to rotate and nothing to break.
The operating cost is the honest critique. Running Vault in HA mode requires Raft or Consul storage backends, regular snapshot discipline, careful seal configuration, and someone who understands what “Vault is sealed” means at 2am. HashiCorp Cloud Platform (HCP) Vault offloads cluster operations but, as of this publication, HCP Vault does not publish pricing tiers publicly. Teams evaluating it should request a quote based on secrets count and requests-per-second, not just cluster count.
Vault’s auth method breadth is where it wins over every cloud-native alternative. Kubernetes service accounts, AWS IAM, Azure AD, GCP service accounts, JWT, OIDC, AppRole, and LDAP are all supported natively. For a shop running mixed cloud and on-premises workloads, that auth surface is the vault’s primary value, not the storage itself.
Vault does not do secret scanning. It has no visibility into what is outside it.
2. Akeyless
Akeyless positions itself as a SaaS-delivered secrets gateway: credentials are never stored in plaintext on Akeyless infrastructure, instead fragmented using a distributed key technology the company calls Zero-Knowledge Encryption. For teams that want vault capabilities without running vault infrastructure, that SaaS delivery model is the primary differentiator versus HashiCorp.
Akeyless supports dynamic secrets, static secrets, rotated secrets, and SSH certificate issuance. Its gateway component runs inside your network and handles the auth broker role, so secrets are fetched and decrypted locally rather than transmitted over the wire in cleartext. The gateway is the operational unit to manage: teams running multiple cloud environments typically deploy one gateway per VPC boundary.
Where Akeyless earns consideration over AWS Secrets Manager for multi-cloud shops is coverage parity: a single Akeyless instance manages secrets across AWS, GCP, Azure, and on-premises without building separate federation. Akeyless does not publish public pricing at the seat or secrets level; the company quotes per environment. For secret scanning or NHI governance, Akeyless does not compete. It is a storage and rotation platform.
3. Conjur
Conjur (IDIRA) is a secrets manager purpose-built for DevOps and machine identity use cases. Where HashiCorp Vault targets polyglot environments with maximum flexibility, Conjur targets enterprises that need secrets management integrated with broader PAM workflows: break-glass access, session recording, and privilege governance at the human layer.
Conjur’s policy-as-code model is its architectural differentiator. Secrets access policies are defined in YAML and stored in version control, which fits detection-as-code disciplines and makes policy drift auditable. The tradeoff is that policy authoring has a steep learning curve and small teams without a dedicated security engineer tend to find the model harder to operate than Vault’s UI-driven approach.
Conjur Open Source exists and is free to run. Enterprise tiers and PAM integrations are priced separately and the vendor does not publish list pricing. For teams buying Conjur as a standalone secrets manager without a broader PAM context, the value proposition weakens: HashiCorp Vault covers equivalent ground with a larger community and more auth methods. Conjur’s strength is integration depth within an enterprise PAM estate, not standalone vault performance.
4. AWS Secrets Manager
AWS Secrets Manager charges per secret stored and per API call, with current figures published on the AWS Secrets Manager pricing page. For teams running exclusively on AWS, this is the lowest-friction vault available: IAM-native auth, direct integration with Lambda, ECS, EKS, RDS, and Redshift, and automatic rotation for supported AWS services without any additional infrastructure.
The ceiling appears at multi-cloud boundaries. Secrets Manager does not authenticate GCP workloads or on-premises systems without additional IAM federation work. When a service in GCP needs a secret stored in AWS Secrets Manager, the auth chain gets complicated and fragile. Teams in this situation frequently end up running both Secrets Manager and a cloud-agnostic vault, which is more expensive and more complex than picking one.
Rotation for AWS managed services (RDS, Redshift, DocumentDB) is well-supported. Rotation for arbitrary credentials requires a Lambda function implementing the rotation contract, which is straightforward but requires maintenance. Like every vault in this list, Secrets Manager has no visibility into hardcoded credentials outside AWS or into secrets committed to source control.
5. Azure Key Vault
Azure Key Vault provides secret storage, key management, and certificate management tightly coupled to the Microsoft identity layer. Workloads using Managed Identities authenticate to Key Vault without any credential in the code path, which is the closest any cloud-native vault gets to eliminating the secrets-in-config problem for workloads it can reach.
Azure Key Vault’s pricing tiers (Standard and Premium, with HSM-backed operations available) are published on the Azure pricing page, and costs scale per operation rather than per secret. For Azure-native shops, the operational cost is low: no cluster to manage, Managed Identity auth handles the bootstrap problem, and integration with Azure DevOps pipelines is native.
The same multi-cloud ceiling applies as with AWS Secrets Manager. Key Vault is the right answer for workloads running in Azure. It is not the right answer for the team that runs workloads across three clouds and needs a single secrets plane. And like every vault, it does not detect secrets that live outside it.
6. Doppler
Doppler takes a different architectural position than HashiCorp or cloud-native vaults: it is a secrets synchronization platform that focuses on getting the right secret to the right environment without requiring developers to change how they consume configuration. Doppler CLI, native integrations with Heroku, Vercel, Railway, GitHub Actions, CircleCI, and Kubernetes secrets sync are the primary delivery mechanisms.
For teams where the core problem is developers copying secrets into CI variables because fetching from a vault is too much friction, Doppler solves that specific problem well. Its project and config scoping model maps naturally to development team workflows, and its access controls are straightforward enough that developers set them up rather than waiting for a security team to configure auth methods.
Doppler offers tiered pricing including a free tier and paid plans; current plan details and pricing are on the Doppler pricing page. The platform does not provide dynamic secrets generation or native HSM integration at the Team tier. For security teams that need cryptographic proof of secret access or hardware-backed key storage, Doppler is not the right fit. For developer productivity and reducing secrets sprawl across CI configurations, it is among the lowest-friction options on this list.
7. Infisical
Infisical is an open-source secrets manager that has added secret scanning, audit logging, and dynamic secrets in recent versions. The self-hosted option makes it attractive for teams with data residency requirements or air-gapped environments where SaaS vault delivery is not acceptable. The Infisical Cloud option provides the same features as a managed service.
Infisical’s native secret scanning checks for hardcoded secrets in code during commits via its pre-commit hooks and CLI, which is closer to the discovery gap than any other platform in the storage category. The scanning coverage is not as deep as GitGuardian’s, but it handles the most common case of catching new secrets before they enter the repo, rather than remediating historical exposure.
Infisical offers tiered plans including a free Community tier and paid options for teams and enterprises; current plan details are on the Infisical pricing page. For teams evaluating Infisical against Doppler: Infisical gives more control at the infrastructure level and has an active open-source community, while Doppler has broader native integrations with PaaS providers. Teams running their own Kubernetes-based infrastructure tend to prefer Infisical; teams running heavily on Vercel, Heroku, or similar platforms tend to prefer Doppler.
8. GitGuardian
GitGuardian addresses the discovery gap that every vault in this list ignores. Its core product scans Git repositories, including historical commits, for hardcoded secrets: API keys, database credentials, private keys, OAuth tokens, and cloud credentials. The distinction from a vault is complete: GitGuardian does not store, deliver, or rotate secrets. It finds them where they should never have been.
For teams that have been running a vault for two years but have never audited what is in their pre-vault commit history, GitGuardian’s historical scanning capability is where the immediate risk lives. A token committed in 2021 may still be valid. The vault does not know it exists. GitGuardian does.
GitGuardian also monitors public GitHub for secrets accidentally pushed to public repos, which is the highest-urgency class of exposure because credential-harvesting bots monitor public commits in near-real time. GitGuardian’s Honeytoken feature generates canary credentials to detect unauthorized access by planting fake secrets that alert on use. GitGuardian offers a free tier for individual developers; enterprise pricing is available on request from the GitGuardian pricing page. For teams evaluating a complete secrets program, GitGuardian belongs alongside a vault, not instead of one.
9. Entro Security
Entro sits in the overlap between secrets management and NHI governance. Where GitGuardian finds secrets in code, Entro focuses on the secrets already in vaults and SaaS integrations, asking what those secrets can reach and whether the access is still needed. For each secret, Entro builds a context graph: which service uses it, which environments it touches, what permissions the underlying credential grants in the target system, and when it was last rotated.
That context is what vaults do not provide. A HashiCorp Vault admin knows a secret exists in a path. They typically do not know that the API key stored at that path grants admin access to a production Salesforce org and has not been rotated in fourteen months. Entro surfaces that combination as a prioritized risk rather than a stored credential.
Entro integrates with major vault platforms (HashiCorp, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), SaaS tools, and cloud IAM to build the context graph. For a team that already runs a vault and wants to understand the risk profile of what is in it, Entro is a complement rather than a replacement. Entro does not publicly disclose pricing. For teams building a complete NHI security program, the relationship between secrets management tools and broader non-human identity discovery is worth mapping before procurement.
Honorable Mention: 1Password Secrets Automation
1Password Secrets Automation, part of 1Password Business and Enterprise tiers, extends 1Password’s credential storage model to machine identity use cases via its CLI, SDKs, and Connect server. Service accounts in 1Password can read secrets programmatically, making it a reasonable choice for smaller engineering teams that already use 1Password for human credentials and want to avoid running a separate vault for a modest number of automated workflows.
The ceiling is architectural: 1Password Secrets Automation is not a dynamic secrets engine, does not generate short-lived database credentials on demand, and does not have the auth method breadth of HashiCorp Vault. For teams with fewer than a few hundred secrets and no complex Kubernetes workload auth requirements, it is a low-friction entry point. For teams operating at scale with dozens of microservices and database credential rotation requirements, the platform is not designed for that problem.
Side-by-Side Comparison: Which Platform Covers Which Gap
| Platform | Secret Storage | Secret Scanning / Discovery | Auto-Rotation | Dynamic Secrets | Multi-Cloud Native | NHI Context |
|---|---|---|---|---|---|---|
| HashiCorp Vault | Yes | No | Yes | Yes (broad engine support) | Yes | No |
| Akeyless | Yes | No | Yes | Yes | Yes | No |
| Conjur | Yes | No | Yes | Yes (via PAM integration) | Partial | Partial (with PAM integration) |
| AWS Secrets Manager | Yes | No | Yes (AWS services) | No | No (AWS only) | No |
| Azure Key Vault | Yes | No | Partial | No | No (Azure only) | No |
| Doppler | Yes | No | No (sync only) | No | Yes | No |
| Infisical | Yes | Partial (commit hooks) | Yes | Yes (recent versions) | Yes | No |
| GitGuardian | No | Yes (deep, historical) | No | No | N/A | Partial (exposure context) |
| Entro | No (integrates with vaults) | Yes (SaaS + vault inventory) | Orchestrates rotation | No | Yes (multi-vault) | Yes |
| 1Password Secrets Automation | Yes | No | No | No | Yes | No |
What Does Rotation Without Breaking Consumers Actually Require?
Rotation is the feature most teams think they want and the one that causes the most operational pain when they implement it. The failure mode is specific: a secret rotates at midnight, the consumer service caches the old credential, and something breaks at 12:01am. The vault did its job correctly. The consumer did not handle credential refresh.
Two architectural patterns avoid this. The first is dual-secret rotation: the vault maintains two valid versions of a credential simultaneously, rotates version A while version B is still valid, then retires version A after a grace period. AWS Secrets Manager implements this for supported RDS rotation natively. HashiCorp Vault requires implementing the rotation Lambda or script to handle it. The second is dynamic secrets: the consumer requests a new credential per session or per request, so the concept of rotating a long-lived credential disappears. HashiCorp Vault’s database secrets engine is the cleanest implementation of this model.
Infisical and Doppler both support rotation but rely on consumers polling for updates rather than the push model. That distinction matters for high-throughput services where the polling interval creates a window of stale credentials. For services where a thirty-second stale window is acceptable, polling works. For payment processing infrastructure or anything with tight consistency requirements, dynamic secrets are the correct design.
Teams evaluating service account credential management alongside vault selection will find the rotation architecture question is often the deciding factor between platforms.
How Do These Platforms Handle Secrets Already Leaked Into Code and CI?
Bluntly: most do not. The eight storage-focused platforms on this list have no capability to detect a hardcoded credential already in your Git history or a secret stored as a GitHub Actions repository variable. Their perimeter starts where the secret enters the vault.
GitGuardian’s historical scanning is the clearest answer to this problem. It can scan the full commit history of a repository and surface every secret pattern it detects, with source information (file, commit, author) to support remediation. The remediation workflow matters: rotating the credential is required even after removing it from code, because the commit exists in history and anyone with repo access (or who cloned before the removal) has it.
Infisical’s pre-commit hook integration addresses the forward-looking version of the problem: it blocks new secrets from entering the repo. It does not retroactively scan history. For a team starting fresh, Infisical’s scanning is a reasonable first layer. For a team that has been shipping code for three years without secret scanning, GitGuardian’s historical audit is the right starting point.
CI secrets are a separate surface. GitHub Actions repository secrets, GitLab CI/CD variables, and Jenkins credentials stores are not code repositories, so Git scanning does not find them. Entro’s integration approach covers this surface by connecting directly to those platforms via API and inventorying what is stored there, including when secrets were last changed and what they access. For a comprehensive program, the application security posture management layer and the secrets management layer need to share signal about what is in CI configuration versus what is in the vault.
What Is the Operating Cost of Running a Vault at Scale?
The operating cost of a self-hosted HashiCorp Vault cluster at enterprise scale is not primarily the compute. It is the engineering time to manage seal operations, rotate root tokens, maintain auth method configurations, upgrade across versions without seal migration errors, and respond to the inevitable audit inquiry about who accessed a specific secret six months ago. Teams that underestimate this frequently run one cluster per team or per business unit, which replicates the sprawl problem they were solving.
Consider a hypothetical: a 600-person SaaS company running forty microservices across two AWS regions, with a three-person platform security team. Self-hosted Vault in HA mode requires those three people to own cluster health, backup validation, auth method configuration for every service team, and rotation scripts for eight database types. HCP Vault offloads cluster operations but concentrates cost at the cluster tier. AWS Secrets Manager charges per secret stored and per API call (see the AWS Secrets Manager pricing page for current figures); at a modest secret count the storage cost is low, but API call volume from high-frequency services adds up quickly. The real cost in that scenario is the rotation Lambda maintenance and the multi-cloud limitation if that company later adds GCP workloads.
Akeyless and GitGuardian’s SaaS models eliminate cluster operations but introduce a dependency on the vendor’s availability. For secrets delivery (not discovery), that availability dependency is significant: if the secrets gateway is unreachable, services that need credentials at startup will fail. Gateway caching mitigates this but requires configuration and testing to get right.
The operating cost that nobody budgets for is rotation breakage remediation. Every time auto-rotation fires and something breaks, a developer opens a ticket and someone investigates. At scale, across dozens of credentials, that ticket volume is a real engineering cost. Dynamic secrets eliminate it architecturally; well-implemented dual-secret rotation reduces it. Poorly configured single-credential rotation produces it continuously.
Where Does Secrets Management Stop and NHI Governance Start?
Secrets management ends when the credential is delivered to the consumer. It has no opinion about what that credential can access in the target system, whether that access is excessive, whether the service using it is still running, or whether the same credential was shared across five environments without documentation. Those questions belong to NHI governance.
NHI governance platforms inventory non-human identities across the entire environment, not just what passed through the vault. They correlate a service account in AWS IAM with the Kubernetes pod that uses it, the secrets that pod reads, and the downstream resources those secrets grant access to. That full context graph is what determines blast radius if any link in the chain is compromised. For a detailed look at how that layer works, the SecurityOpsWire analysis of non-human identity security platforms covers the governance tooling that sits above the vault layer.
The practical implication: a team that has deployed HashiCorp Vault but has not inventoried which non-human identities exist outside the vault, what those identities can reach, and whether the access is still justified is still early in the NHI security program. The vault is necessary but not sufficient. AI-driven environments make this more complex, as agents and automated workflows generate new non-human identities rapidly; the broader challenge of workload identity security for Kubernetes and cloud environments increasingly intersects with secrets management program design.
Frequently Asked Questions
What is secrets management for non-human identities?
Secrets management for non-human identities is the practice of securely storing, delivering, rotating, and auditing credentials used by machines rather than humans: API keys, database passwords, private keys, OAuth tokens, and service account credentials. Unlike human password management, machine credentials must be fetched programmatically at runtime, often thousands of times per day, by services that cannot participate in MFA or interactive login flows. The goal is to eliminate long-lived, static credentials stored in code or configuration files.
What is secret scanning and how is it different from a vault?
Secret scanning is the detection of credentials that exist outside a vault: hardcoded in source code, committed to Git history, stored in CI pipeline variables, or exposed in log output. A vault secures credentials it has been given. Secret scanning finds credentials that were never put into a vault. The two capabilities are complementary, not overlapping. GitGuardian is the most commonly referenced dedicated secret scanning platform. Infisical provides pre-commit scanning as part of its broader secrets manager. Most vault platforms provide neither.
How does credential vaulting differ from credential rotation?
Credential vaulting is storage with access control: the vault holds the secret, enforces who can read it, and logs access. Credential rotation is the periodic replacement of a stored credential with a new one, either on a schedule or triggered by policy. Vaulting without rotation leaves long-lived credentials in place, which means a leaked credential remains valid indefinitely. Rotation without proper consumer architecture, specifically without dual-secret support or dynamic secrets, breaks services when the credential they cached no longer matches what the vault holds.
Which secrets management platform is best for a multi-cloud environment?
HashiCorp Vault and Akeyless are the two strongest options for genuinely multi-cloud environments. Both support auth methods across AWS, GCP, and Azure without requiring secrets to be stored in each cloud provider’s native service. AWS Secrets Manager and Azure Key Vault are strong within their respective clouds but create management fragmentation when workloads span clouds. For teams that cannot run their own vault infrastructure, Akeyless’s SaaS gateway model eliminates cluster operations while preserving multi-cloud coverage.
How much does AWS Secrets Manager cost per month?
AWS Secrets Manager charges $0.40 per secret per month and $0.05 per 10,000 API calls, as listed on the AWS Secrets Manager pricing page. For a workload reading the same secret ten thousand times a day, the API call cost exceeds the storage cost rapidly. Caching the secret locally with a short TTL reduces API call volume; the AWS SDKs include a caching client for this purpose. Rotation using Lambda functions does not add per-rotation fees beyond the Lambda execution cost.
What does hardcoded secrets detection actually find?
Hardcoded secrets detection tools scan source code, commit history, CI configuration, and sometimes log files for patterns that match known credential formats: AWS access key prefixes, private key headers, connection string formats, and API key patterns from hundreds of known providers. GitGuardian’s detector library covers a large range of provider-specific formats by pattern matching, not just generic entropy scoring. The most operationally important find is credentials in commit history that have since been removed from the working tree but remain accessible to anyone who can read the repository’s full history.
Do AI agents require different secrets management than traditional services?
AI agents that call external APIs, connect to databases, or interact with third-party services require the same credential delivery mechanisms as any automated service. The difference is the rate of new credential creation. An agent framework that spawns new agents dynamically may create new API clients, service accounts, or session tokens at a rate that outpaces manual vault path management. Dynamic secrets engines handle the per-session credential pattern well. The broader challenge of tracking what credentials AI agents hold and what those credentials can access overlaps with the NHI governance problem; the AI agent security platform category addresses identity and authorization controls at the agent layer.
What is the difference between Doppler and HashiCorp Vault?
Doppler is a developer-oriented secrets synchronization platform: it stores secrets centrally and syncs them to environments, CI systems, and container orchestrators via native integrations. HashiCorp Vault is a secrets engine with dynamic credential generation, fine-grained access policy, hardware security module support, and a wide range of auth backends. Doppler is the right choice for teams that want low-friction secrets management without infrastructure to operate. HashiCorp Vault is the right choice for teams that need dynamic database credentials, strict cryptographic controls, or complex auth method requirements. The two are not interchangeable at the top of the requirements stack.
Buying Against the Actual Gap, Not the Most Marketed One
Most secrets management evaluations start with the vault because vaults are the most visible part of the category. The storage problem is real, but for teams that have been shipping software for more than two years, the discovery problem is usually larger and more immediately exploitable. A credential committed to a private repository in 2022 is still in that repository. A vault deployed in 2023 does not know it exists.
The correct sequence for most teams is: inventory what you have (GitGuardian or Entro), then centralize storage (Vault, Akeyless, or a cloud-native option depending on your environment), then build rotation into consumer architecture rather than bolting it onto stored static credentials. Running those steps in reverse is how teams end up with an operational vault, confident they have addressed the secrets problem, while unrotated credentials from the pre-vault era remain valid and unmonitored.
The platform decision follows from the gap, not from the category. Teams in a single AWS account with three developers do not need HashiCorp Vault in HA mode. Teams running forty microservices across three clouds with a dedicated platform team do not need Doppler. The operating cost of a vault, measured in engineering time rather than licensing, is the most underestimated variable in the evaluation. A platform that fits your current team size and infrastructure complexity will be operated correctly. One that requires capabilities your team does not yet have will be operated incorrectly, and a misconfigured vault is worse than a spreadsheet because it creates false confidence.
