secrets management

Vault

Vault is a secrets management product that issues short-lived credentials. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

Vault stores secrets and, more importantly, issues them. Rather than holding a static database password, an application authenticates to Vault and receives a credential that expires in an hour. The secret never lives in configuration and revocation is automatic.

The dynamic-secret model is the reason Vault exists and the reason it is hard. Adopting it means every consumer of a credential must be able to request one, which is an application change, not a configuration change.

How pricing works once you are inside

Vault Community Edition is open source and complete for most needs. HCP Vault and Vault Enterprise price on managed infrastructure and on the enterprise features — namespaces, replication, and the governance controls.

The honest cost of Vault is operational rather than licensing. Running it in production means high availability, unsealing automation, backup and a disaster recovery plan for the secrets store itself. Teams consistently underestimate this.

Where it breaks down

Unsealing is the classic operational problem. Vault starts sealed and needs a quorum of key holders to unseal; automating that without defeating the security model requires care, and getting it wrong means an outage that needs humans at 3am.

The learning curve is steep. Policies, auth methods, secret engines and the token hierarchy are all concepts with sharp edges, and a misconfigured policy either grants too much or breaks an application.

What switching costs

High. Secrets migrate, but the dynamic-credential integrations, the policies and the application authentication flows are all Vault-specific and represent the bulk of the work.

Who should not use it

Teams without platform engineering capacity. A secrets manager that is down is worse than static secrets, and keeping it up is a real job.

Sources

HashiCorp Vault public documentation and pricing page, read October 2026.