9 key takeaways from the State Of Secrets Sprawl 2026: Urgent action for Vietnam's CIO

For Chief Information Officers (CIOs) and CISOs in Vietnam, managing large-scale development teams often involves a high-stakes trade-off between security and speed. Under the pressure of tight deadlines, developers frequently resort to hardcoding API keys, platform authentication tokens, or database passwords directly into source code to ensure systems go live as quickly as possible.

Ignoring this security bottleneck leads to quantifiable financial damage. There have been numerous cases where businesses faced cloud infrastructure bills (AWS, Azure) amounting to billions of VND in just a few days because hackers seized leaked API keys to run unauthorized cryptocurrency mining clusters. Worse yet, an entire customer database can be encrypted by ransomware simply because a snippet containing access credentials was accidentally pushed to a public GitHub repository.

GitGuardian's "The State of Secrets Sprawl 2026" report, recently analyzed by The Hacker News, provides sobering data on the scale of this contagion. Here are the 9 critical takeaways technology leaders must grasp.

The 9 pillars of the State Of Secrets Sprawl 2026 report

1. Record-breaking leak volumes

In 2025 alone, GitGuardian’s scanning systems detected 28.65 million secrets directly embedded and leaked across public repositories. This represents a 34% increase from the previous year, proving that traditional security controls are no longer keeping pace with the velocity of modern code production.

2. Internal repositories carry 6x more risk

Organizations often operate under the false assumption that internal codebases are inherently safe because they sit behind a firewall. The data proves otherwise: Internal repositories are 6 times more likely to contain exposed secrets than public ones. Once an attacker breaches the perimeter, the internal system provides a buffet of valid credentials for deep lateral movement.

3. Leakage speed outpaces workforce growth

The volume of leaked secrets is growing faster than the global population of developers. Since 2021, the rate of secret exposure has increased at 1.6 times the rate of developer expansion. Manual code review processes have become effectively obsolete against this sheer volume of data.

4. AI adoption multiplies security errors

While AI-assisted coding tools boost productivity, the rate of secret leakage in AI-generated code is double the average. 

Furthermore, credentials specifically related to AI services themselves surged by 81%, reaching 1.27 million incidents.

5. The dominance of Non-Human Identities (NHI)

Modern networks thrive on machine-to-machine communication. The ratio of Non-Human Identities (service accounts, bots, API tokens) to actual human users in the enterprise is now at 100:1. The lack of monitoring for this identity group remains a massive blind spot in privilege governance.

6. Sprawl beyond the repository

Risk is not confined to Git. Roughly 28% of credential exposures originate from internal collaboration tools like Slack, Jira, and Confluence, or are stored as plaintext files on employee workstations.

7. 97% of organizations faced an identity incident

The report notes that 97% of organizations encountered at least one identity-related incident in the past year, with 70% of those stemming from AI-integrated projects and activities.

8. Remediation stagnation

Disturbingly, data shows that 64% of valid secrets leaked as far back as 2022 have yet to be revoked and remain functional in early 2026. Developers often delete the offending line in the current version, but the version control history (commit logs) keeps the credential alive and retrievable.

9. The mandate: Move from "Scanning" to "Full Management"

To combat the scale of Secret Sprawl, reactive scanning tools are merely a band-aid. Organizations require a comprehensive Secrets Lifecycle Management mechanism that includes periodic automated rotation and instant revocation upon the detection of anomalous access behavior.

The solution: Transitioning to automated DevSecOps

Understanding these 9 points is the first step in risk identification. However, to handle millions of existing lines of code and the daily influx of new commits, CIOs cannot rely on policy memos or asking developers to "be more careful."

Organizations must implement Shift-left Security by establishing a mature DevSecOps workflow. Rather than struggling to build this from scratch, many enterprises in Vietnam are partnering with specialized security consultants like IPSIP Vietnam to audit their infrastructure and integrate secret management solutions directly into the CI/CD pipeline.

Establishing this security architecture brings clear measurable benefits:

• Operational visibility: Gain 100% visibility of every credential across the entire infrastructure—from code repos and CI/CD systems to chat tools. Release speed increases as the system automatically blocks "dirty" commits at the developer's machine without disrupting the broader workflow.

• Risk and cost reduction: Eliminate up to 90% of supply chain attack risks by sanitizing source code early. IT and security teams save hundreds of hours of manual code review monthly. Most importantly, organizations prevent multi-billion VND cloud overages and avoid the legal nightmare of a customer data breach.

Frequently Asked Questions (FAQ)

-----

References:

• The State of Secrets Sprawl 2026: 9 Takeaways for CISOs - The Hacker News / Ground News

• Annual Report: The State of Secrets Sprawl 2026 - GitGuardian