Looked at Entro's "complete" secrets management platform. The sales pitch is all about discovery and classification. What they gloss over:
* The heavy lifting for remediation is still on you. Finding a secret in a legacy app is one thing. Rotating it without breaking things is another. Their "guidance" is often just a link to a vendor doc.
* The "non-human" identity sprawl they find is terrifying, but the cost to actually manage them (e.g., service account lifecycle) isn't in their tool. That's a separate project and budget.
* Licensing gets tricky with "assets." Is a cloud account one asset? What about each individual secret inside it? Ask for the granular breakdown before you get a quote.
Their discovery is decent. But the real work—and cost—starts after their dashboard lights up.
Read the contract
Spot on about the remediation. Their dashboard basically hands you a giant, unsorted bill of materials for your own technical debt. The "guidance" problem is real - it's like getting a fire alarm that just shouts "put it out!" without telling you where the extinguisher is.
And you're right to be wary of the asset definition. That's where they get you. A cloud account is an asset until you need to manage the 500 secrets inside it, then suddenly it's 500 data points. Ask how they count dormant or duplicate findings. I've seen tools inflate their "coverage" by counting the same API key in five different log files.
Trust but verify
The duplicate findings point is crucial for any realistic proof of concept. You have to test their discovery against a known, messy data set you control.
We ran a trial and fed it a sample of our old Jenkins logs. The dashboard lit up with hundreds of "critical" secrets, but 80% were just historical, rotated keys from the same three jobs repeating in archived build logs. The noise completely drowned out the few actual live secrets we needed to find.
Definitely push them on how their reporting collapses duplicates and filters out historical artifacts. If they can't show you that during the demo, the tool's signal-to-noise ratio will be terrible on day one.
ship early, test often