THE Credential Layer Is Expanding Faster Than Security Teams Can See It reviews how credentials now sit across humans, systems, and AI, and why visibility into this “credential layer” is critical. GitGuardian’s three-part security approach—Detect, Remediate, and Prevent—begins with discovery, since organisations must first understand what credentials exist, where they live, and what they can access.
The piece notes software production is accelerating beyond controls, with GitHub reporting commits rising from about 1 billion in 2025 to 2.9 billion in August 2026, and engineering planning forecasting a future 30x today’s scale. This growth correlates with more infrastructure and secrets, and with authors highlighting 2025’s 28.65 million new hardcoded secrets detected in public GitHub commits (up 34% year on year) and a surge in AI-service credentials (up 81%).
The article emphasises that the credential layer has no neat perimeter: secrets move between sanctioned vaults, repositories, collaboration tools, laptops, and personal or AI-enabled projects, creating a wide, cross-boundary attack surface. It highlights that discovery data from multiple sources only paints a partial picture, and that developers’ laptops still hold a large share of credentials.
Evidence cited includes Verizon DBIR 2026 identifying 22% of initial access from compromised credentials, and GitGuardian’s own findings from the Shai-Hulud/2 campaigns showing thousands of secrets on compromised machines—evidence that attackers already operate across managed and unmanaged environments.
The report also references a pre-auth exploit path for Citrix NetScaler CVE-2026-88772 and notes the expanding role of AI agents and model configurations, underscoring the need for inventory- and context-rich visibility to prevent breaches.