--- title: "Vault Coverage Is the Missing Metric in the NHI Programs" url: https://daily.dev/posts/vault-coverage-is-the-missing-metric-in-the-nhi-programs-b3s767asf source_url: https://blog.gitguardian.com/vault-coverage type: article source: "GitGuardian" published: 2026-08-11T15:19:27.615Z updated: 2026-08-11T15:20:03.199Z tags: ["iam", "secrets-management", "gitguardian"] reading_time: 9 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vault Coverage Is the Missing Metric in the NHI Programs **[GitGuardian](https://daily.dev/sources/gitguardian)** · 9 min read · 0 upvotes · 0 comments ## Summary Most vault programs track only the credentials already onboarded, producing a numerator without a denominator. Vault coverage — unique credentials matched to a managed vault divided by all credentials detected across connected systems — is the missing metric that lets IAM and Security teams measure actual policy compliance. GitGuardian detects credentials across source control, CI/CD, cloud, and collaboration tools, deduplicates them by value using hashed fingerprints, and reconciles them against connected vaults without storing the actual secrets. This surfaces three risk states: vaulted and contained, vaulted but copied elsewhere, and never vaulted. The metric supports PCI DSS 4.0 compliance (enforced from March 2025), executive reporting, and remediation prioritization. GitGuardian's 2025 research found 28.6 million new hardcoded secrets on public GitHub, with 64% of secrets confirmed valid in 2022 still valid years later. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I calculate vault coverage for my secrets management program? Vault coverage equals unique credentials matched to a managed vault divided by unique credentials detected across all connected sources. The numerator comes from your vault inventory; the denominator requires active discovery across source control, CI/CD pipelines, cloud environments, and collaboration tools, since credentials move through engineering systems without a central registration event. A credential appearing in multiple locations counts once after deduplication. _Teams tracking machine credential risk across sprawling environments follow vault coverage discussions like this on daily.dev._ ### Can a secret stored in a vault still be exposed? Yes. A credential correctly stored in a vault such as Azure Key Vault or Delinea Secret Server can still carry risk if an active plaintext copy exists in a code repository, CI/CD variable, or Kubernetes manifest. Vault storage and containment are separate states. IAM teams should review vault coverage alongside the unmanaged-copy rate to distinguish credentials that are vaulted and contained from those that are vaulted but still copied elsewhere. _Developers remediating credential sprawl alongside vault adoption track these distinctions on daily.dev._ ### When did PCI DSS 4.0 enforcement of hardcoded credential requirements start? PCI DSS 4.0 policy on hardcoded application and system account credentials began being enforced in March 2025. A discovery-based vault coverage metric can support a PCI DSS assessment, and the list of unmatched credentials behind that metric can drive remediation. A raw stored-secret count alone cannot confirm whether an organization has met those standards. _Security engineers navigating PCI DSS 4.0 credential requirements stay current on daily.dev._ ## Similar posts on daily.dev - [Credential Exposure and the Security Stack Gap](https://daily.dev/posts/credential-exposure-and-the-security-stack-gap-3juixpmja) · GitGuardian · 0 upvotes · 0 comments - [GitGuardian NHI Governance Now Gives More Comprehensive Visibility](https://daily.dev/posts/gitguardian-nhi-governance-now-gives-more-comprehensive-visibility-fnorwlcey) · GitGuardian · 0 upvotes · 0 comments - [Unified Secrets Security with GitGuardian and AWS Secrets Manager](https://daily.dev/posts/unified-secrets-security-with-gitguardian-and-aws-secrets-manager-veaiu8foj) · GitGuardian · 0 upvotes · 0 comments - [Confronting Vault Sprawl And The Risks It Brings](https://daily.dev/posts/confronting-vault-sprawl-and-the-risks-it-brings-tfvqwxsao) · Security Boulevard · 0 upvotes · 0 comments - [NHI Governance Is the Outcome. GitGuardian Is How You Get There](https://daily.dev/posts/nhi-governance-is-the-outcome-gitguardian-is-how-you-get-there-qlkhy1551) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#iam](https://daily.dev/tags/iam), [#secrets-management](https://daily.dev/tags/secrets-management), [#gitguardian](https://daily.dev/tags/gitguardian) [View this post on daily.dev](https://daily.dev/posts/vault-coverage-is-the-missing-metric-in-the-nhi-programs-b3s767asf)