While many in the industry are talking about Zero Trust cybersecurity, far fewer are asking a more fundamental question: where do your credentials actually live?
For years, vendors and partners have promoted the principle of “never trust, always verify”. But there can be a significant gap between the concept of Zero Trust and how organisations apply it in practice.
API keys, tokens, passwords and certificates can end up scattered across GitHub repositories, CI/CD pipelines, Jira tickets and collaboration tools. Developers, security engineers and platform teams all need access to them, yet ownership of the credential lifecycle can be fragmented.
Every unmanaged or exposed credential can create an unnecessary avenue for compromise. According to IBM’s Cost of a Data Breach Report 2025, breaches involving stolen or compromised credentials represent a significant financial risk to organisations.
For IBM partners, this gap between Zero Trust strategy and day-to-day security creates an opportunity. IBM Vault, from HashiCorp, an IBM company, provides a practical way to help customers address it.
An identity-first approach for people, machines and AI agents
Zero Trust is no longer just about controlling access for employees. In modern hybrid and multicloud environments, applications, services and machines also need trusted identities and controlled access to the resources they require.
IBM Vault helps organisations establish identity-based access to secrets and sensitive resources, applying least-privilege and time-bound access for people, applications and machines. Instead of relying on long-lived, static credentials, organisations can use dynamic credentials that reduce exposure and simplify the management of access.
For customers, this creates four practical areas of focus:
#1 Protect people: Apply least-privilege and time-bound access to sensitive systems and resources.
#2 Protect machines and applications: Help services and applications establish trusted identities and replace static credentials with dynamic, short-lived access.
#3 Secure applications across hybrid cloud: Establish trusted connections between services and workloads wherever they run, helping organisations maintain consistent security across increasingly complex environments.
#4 Protect data and encryption keys: Manage certificates, encryption keys and secrets throughout their lifecycle, with capabilities designed to support encryption as a service and automated secrets discovery and remediation.
Discovering the secrets customers don't know they have
Most organisations cannot protect what they cannot see. That makes discovery a practical way for partners to start a conversation around IBM Vault.
HCP Vault Radar scans code repositories, pipelines and collaboration tools such as Jira, Slack and Confluence for exposed secrets. It can then correlate discovered credentials with Vault, helping organisations identify risks, remediate exposed secrets and bring them under central management.
For partners, this provides a tangible starting point. Rather than opening a broad Zero T
rust conversation, a partner can help a customer identify a specific and measurable problem: where are their secrets, how exposed are they, and what can be done about them?
The result is a quantified starting point for a wider conversation around identity, secrets management and machine access.
Why IBM Vault matters in the age of AI
The rapid adoption of AI introduces another dimension to the identity challenge.
AI agents are increasingly being designed to act autonomously, accessing APIs, applications, databases and other services on behalf of users or organisations. Unlike a human user, an agent can make large numbers of requests at machine speed, across multiple systems.
That makes the management of non-human identities increasingly important. Traditional approaches based on long-lived credentials can create unnecessary risk when applications and AI agents need access to sensitive resources. IBM Vault can help organisations provide workloads with the identities and short-lived credentials they need, while reducing reliance on static secrets.
Where IBM Vault is already being used
– Canva has used Vault to address secret sprawl and centralise secrets management, supporting millions of builds and backend secret reads each month while significantly reducing secret provisioning processes.1, 2
– athenahealth uses Vault at significant scale, processing hundreds of millions of requests for secrets each day. Its implementation helped remove manual ticketing processes and significantly reduce issue-resolution times.3
– Starbucks uses Vault to manage short-lived, dynamic secrets across more than 100,000 edge devices.4
These examples demonstrate that, at scale, effective identity and secrets management can support security, operational efficiency and the ability to manage increasingly complex IT environments.
The opportunity for IBM partners
For IBM partners, IBM Vault offers several ways to build a practical Zero Trust proposition.
A natural way in: Secret sprawl is a challenge that development, security and infrastructure teams already understand, and a Vault Radar assessment gives partners a way to quantify the problem and create a credible starting point.
A story that expands: Start with secrets discovery and remediation, then explore machine identity, human access, application connectivity and data protection as requirements develop.
A business case, not just a security case: Security breach aside, manual credential management, failed audits, operational disruption and developer time all add to the cost of doing nothing. This creates opportunities to engage security, engineering and business stakeholders.
Built for hybrid and multicloud environments: IBM Vault is designed to support organisations operating across complex technology estates, including environments built around platforms such as Microsoft Azure and AWS, enabling partners to position Vault as part of a customer’s existing cloud and security strategy.
Why Arrow for IBM?
As an authorised and experienced IBM distributor, Arrow ECS helps partners build and grow their IBM practice, with a dedicated IBM team working alongside them:
Technical support: Technical Solution Engineers to support demonstrations and help partners develop tailored Proofs of Concept.
Commercial support: Access to IBM funding, commercial programmes and flexible payment solutions for opportunity development and customer engagement.
Marketing support: Bespoke marketing activities to help generate demand and create customer conversations.
Business development support: A dedicated IBM team to help identify opportunities, develop propositions and build a sustainable IBM practice, from strategy and opportunity identification through to execution and sustainable growth.
Zero Trust is already on your customers’ agendas. The challenge for partners is turning a broad security principle into a practical conversation with a clear starting point.
Ready to explore the opportunity?
Talk to the Arrow IBM team about positioning IBM Vault with your customers, identifying potential opportunities and accessing the technical, commercial and marketing support available to you.
More IBM Vault articles:
Azure Key Vault or IBM Vault? For your customers, the answer is "and" | Arrow ECS
IBM Vault on AWS: Security that scales as fast as your customers' cloud | Arrow ECS
—-------------------
Sources
1 Canva: Redesigning secrets management (customer story), HashiCorp, an IBM company.
2 Canva: Streamlining secrets management at Canva with HashiCorp Vault, HashiCorp, an IBM company.
3 athenahealth: A new prescription for secrets management (customer story), HashiCorp, an IBM company.
4 Starbucks: Securing secrets and identity for 100,000+ edge devices at Starbucks with HashiCorp Vault (case study), HashiCorp, an IBM company.
