HashiCorp Vault

Overview

HashiCorp Vault is the reference secrets management platform and a cornerstone of machine identity for cloud-native infrastructure. IBM acquired HashiCorp in 2024, and Vault is available self-hosted (with an open-source core) and as managed HashiCorp Cloud Platform.

What it is good at

Dynamic secrets are the signature capability: rather than storing a static database password, Vault generates short-lived, on-demand credentials and revokes them automatically, which shrinks the exposure window that leaked secrets create. It is far more than a vault: encryption-as-a-service, a strong PKI engine for issuing internal certificates, and pluggable auth methods and secret engines for nearly every cloud and database. It is the de facto standard in mature platform-engineering organizations, with deep ecosystem and Terraform integration.

Where it falls short

Operating Vault well is a real responsibility: high availability, seal/unseal, upgrades, and policy design require skilled platform engineers, and teams routinely underestimate this. The HCP managed option reduces but does not remove the learning curve. Post-acquisition licensing (the move to the BSL license, then IBM ownership) has prompted some teams to evaluate alternatives like OpenBao and Akeyless. It is infrastructure-focused, not a developer-friendly drop-in.

Pricing

Open-source core is free to self-host; HCP Vault and Vault Enterprise are usage- and feature-based, quote-driven at the enterprise tier. Factor in the operational cost of running it.

Best for, and who should look elsewhere

Choose Vault for mid-market and enterprise platform teams that need dynamic secrets, PKI, and broad integration, and can operate it. Smaller or less ops-heavy teams should consider Akeyless, Doppler, or Infisical.

Bottom line

The gold-standard secrets and machine-identity platform for teams with the engineering capacity to run it.