leetcrypt
f6d145669c
Adds VISION.md (target personas + 20-credential surface), docs/MARKET.md (competitive positioning), and docs/FINDINGS-2026-06-16.md (controlled-env test run: live cutover POCs for postgres/gitea/aws/mysql/redis/wireguard, the backup-gate defect + fix, and the MariaDB unprivileged-rotation gap). Swaps the placeholder _igo_options assets for the banner/icon set. Refreshes the project CLAUDE.md directive. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
232 lines
16 KiB
Markdown
232 lines
16 KiB
Markdown
# incredigo — Market Analysis & Positioning (2026-06-16)
|
||
|
||
Research into the credential/secret **rotation** market: who sells it, who buys it, where
|
||
the white space is, and who incredigo should be built for. Sourced web research (2025–2026);
|
||
treat market-size figures as analyst-dependent and the academic adoption numbers as
|
||
directional (see Caveats).
|
||
|
||
---
|
||
|
||
## TL;DR
|
||
|
||
- The **money** is in enterprise **PAM** (~$4.3–5.6B, ~22% CAGR) and **machine-identity**
|
||
rotation — and it is consolidating fast: **CyberArk → Palo Alto Networks (~$25B, Jul 2025)**,
|
||
**HashiCorp Vault → IBM ($6.4B, Feb 2025)**. That is not a fight a local-first CLI wins.
|
||
- **Three credible white-space wedges incredigo already targets:**
|
||
1. **Local-file secret discovery + rotation** for solo devs / small teams (sprawl is
|
||
exploding: **+34% YoY**, secrets appear in **~8 places per machine**). Incumbents assume
|
||
you've *already* migrated into their hub — nobody owns "find the mess on this laptop, then
|
||
rotate it." → incredigo **Mode B**.
|
||
2. **Local-first / RAM-only / no-cloud / no-server.** OpenBao/Infisical/Bitwarden prove the
|
||
no-cloud demand, but every one is a **server/daemon**. A **single RAM-only binary** is
|
||
genuinely differentiated.
|
||
3. **The manual/browser "long tail"** of accounts with no rotation API. Every incumbent —
|
||
enterprise PAM *and* consumer password managers — explicitly refuses this. The one serious
|
||
consumer attempt (**Dashlane**) **publicly gave up** as "too brittle." → incredigo's
|
||
**guided worklist + change-URL** layer.
|
||
- **RFC 8615 `.well-known/change-password` is a thin primitive** (~12% top-site adoption, often
|
||
unhelpful redirects). It confirms "auto-change everything" is unrealistic and validates
|
||
incredigo's split: **rotate what's automatable, guide the human through the rest.**
|
||
|
||
---
|
||
|
||
## 1. Vendors — who sells rotation, and to whom
|
||
|
||
### Enterprise secrets platforms
|
||
|
||
| Vendor | Rotation story | Pricing | Typical client |
|
||
|---|---|---|---|
|
||
| **HashiCorp Vault** (now **IBM**, $6.4B, closed Feb 27 2025) | Core = **dynamic short-lived secrets** + static rotation. Moved to **BSL** license (2023) → OpenBao fork. **HCP Vault Secrets SaaS sunset** (EOS Jun 30 2025, EOL Jul 1 2026). | Community Edition free (self-host); HCP Vault Dedicated ~$1.58/hr | Large enterprise, platform/DevOps |
|
||
| **CyberArk** (incl. **Conjur**) — **being acquired by Palo Alto Networks (~$25B, announced Jul 30 2025)** | PAM market leader; automated rotation + deep audit. Conjur = machine/DevOps secrets. | Conjur OSS free; enterprise ~$1,000–1,500 / identity / yr | Large/regulated enterprise |
|
||
| **Akeyless** | Vaultless SaaS, JIT access + automated rotation ("Distributed Fragments Cryptography") | Custom / contact sales | Mid-large enterprise (**78% of revenue from public corps**, 2 Fortune-5) |
|
||
| **Doppler** | Fully automated rotation, broad integrations (AWS/GCP/CI/KMS) | From **$3/user/mo** | Dev/DevOps teams, startup→midmarket |
|
||
| **Infisical** (OSS, MIT) | Rotation for Postgres/MySQL/AWS IAM; **flagged for limited retry/failure guidance** | Cloud from $8/user/mo; self-host free | Developers, OSS-leaning, self-host shops |
|
||
| **Phase** | Automated rotation + keeps deployments in sync; cloud or self-host | — | Dev/DevOps, compliance-driven |
|
||
|
||
### Cloud-native (rotation = "you write the Lambda/Function")
|
||
|
||
| Vendor | Rotation story | Pricing |
|
||
|---|---|---|
|
||
| **AWS Secrets Manager** | Native rotation for **RDS/Redshift/DocumentDB only**; others need custom Lambda. re:Invent 2025: "zero-touch rotation" for some 3rd-party secrets. | $0.40/secret/mo + $0.05/10k calls |
|
||
| **Azure Key Vault** | Microsoft-centric; FIPS/gov favored | $0.03/10k ops |
|
||
| **GCP Secret Manager** | Rotation = schedule → Pub/Sub → **Cloud Function you author** | $0.06/secret version/mo |
|
||
|
||
### PAM specialists
|
||
|
||
- **Delinea** — PAM + password rotation, **mid-market** (fast deploy, low TCO); 2024 Gartner MQ Leader.
|
||
- **BeyondTrust** — PAM + credential rotation, **enterprise**; Gartner MQ Leader ×6, 2025 Forrester Wave Leader (PIM).
|
||
- **Teleport** (w/ StrongDM, HashiCorp Boundary) — **certificate/ephemeral-access**, cloud-native/DevOps; ephemeral certs reduce the *need* to rotate long-lived secrets.
|
||
|
||
### Password managers w/ rotation crossover
|
||
|
||
- **1Password** — Business $7.99/user/mo; Secrets Automation via self-hosted Connect Server.
|
||
- **Bitwarden** — OSS, client-side crypto, self-hostable; Secrets Manager for devs; business from $4/user/mo; $100M Series B (2022).
|
||
- **Keeper** — KeeperPAM: automated rotation + session recording + discovery; business from $6/user/mo.
|
||
|
||
**Pattern:** every vendor rotates **what has an API** (databases, cloud IAM, AD) and assumes
|
||
secrets are **already centralized in their store**. None of them owns *discovery of sprawl on a
|
||
local machine* or *the no-API long tail*.
|
||
|
||
---
|
||
|
||
## 2. PAM market — size & leaders
|
||
|
||
- **Size 2025→2026:** Mordor **$4.25B → $5.17B**; Fortune Business Insights **$4.51B → $5.58B**.
|
||
- **Growth:** Mordor → **$13.83B by 2031 (~21.7% CAGR)**; Precedence → up to ~$30B by 2034 (~23.8%).
|
||
- **Leaders:** CyberArk, BeyondTrust, Delinea, One Identity, ARCON, Wallix, ManageEngine, Okta.
|
||
- **Why rotation matters here:** automated rotation/vaulting is a **core PAM primitive**, now
|
||
driven by **machine identities outnumbering humans ~40:1**.
|
||
|
||
**Implication for incredigo:** do not compete in PAM. Be the tool that serves the people PAM
|
||
is too heavy/expensive/cloud-bound to serve.
|
||
|
||
---
|
||
|
||
## 3. Consumer auto-password-change — a graveyard
|
||
|
||
- **Dashlane** removed its automatic Password Changer in **early 2022** — officially "an
|
||
extremely complex feature that was prone to breaking." (Also killed its free plan Sept 16 2025.)
|
||
This is the canonical cautionary tale.
|
||
- **Chrome / Google Password Manager** — announced **Automated Password Change** at I/O 2025;
|
||
navigates the site and fills the change form **with per-change user approval** (no silent
|
||
action). Rollout late 2025, **limited English-language cooperative sites only**.
|
||
- **Apple** — no general web auto-changer; leans into **passkeys** + a change-password URL quirk.
|
||
- **Academic verdict (arxiv 2511.10111, Nov 2025, 111 Tranco sites):** *"no popular third-party
|
||
or browser-embedded password manager supports automated website password updates."* Sites use
|
||
**diverse, confusing** flows, often **break autocomplete**, and some **deliberately block
|
||
automation**. The industry's real answer is **passkeys**, not auto-change.
|
||
|
||
**Implication:** fully-automatic browser rotation is a known tar pit. incredigo's **guided,
|
||
human-in-the-loop worklist** (rotate what's scriptable; hand the human a ranked, linked
|
||
checklist for the rest; never bypass MFA/CAPTCHA) is the *pragmatic* shape that survives where
|
||
"automate everything" died. This matches Hard Rule #5 (self-owned only) and #6 (dry-run default).
|
||
|
||
---
|
||
|
||
## 4. RFC 8615 `.well-known/change-password`
|
||
|
||
- W3C "A Well-Known URL for Changing Passwords" lets tools deep-link to a site's change page.
|
||
- **Adoption (Tranco top 200, 2025):** ~**12.2%** support the W3C path; ~**33.8%** support
|
||
Apple's competing URL-quirk. Adopters incl. Google, GitHub, WordPress, Facebook, X. **Most
|
||
redirects land on a generic security page, not the change form.**
|
||
- Consumed by Chrome and Safari; Bitwarden has open community requests.
|
||
|
||
**Implication:** good enough to power incredigo's **offline change-URL generation** (already
|
||
built: curated table + RFC 8615 well-known + host fallback), but thin enough that it can't be
|
||
the whole answer — reinforcing the rotate-vs-guide split.
|
||
|
||
---
|
||
|
||
## 5. Underserved segments (the white space)
|
||
|
||
**A. Solo devs & small teams with local secret sprawl.**
|
||
- **GitGuardian State of Secrets Sprawl 2026:** **29M new hardcoded secrets in 2025, +34% YoY**;
|
||
each live secret appeared in **~8 locations on the same machine** (.env, shell history, IDE
|
||
configs, cached tokens, build artifacts); **59% of compromised machines were CI/CD runners**.
|
||
- **Snyk:** ~28M credentials leaked on GitHub in 2025.
|
||
- No major vendor owns **discover-then-rotate of sprawl already on the box** (.aws/.netrc/ssh/
|
||
docker/kube) — they start *after* migration into their hub. → **incredigo Mode B.**
|
||
|
||
**B. Privacy-conscious / no-cloud.**
|
||
- HashiCorp's BSL relicense spawned **OpenBao** (LF/MPL-2.0 fork of Vault 1.14, joined OpenSSF
|
||
Jun 2025). Infisical (MIT) and Bitwarden Secrets Manager also serve no-cloud.
|
||
- **But all are servers/daemons.** A **local-first, RAM-only, single binary** with no
|
||
infrastructure is unoccupied ground. → **incredigo's core architecture.**
|
||
|
||
**C. The no-API "long tail."**
|
||
- *"Password managers won't rotate your bank login, email recovery keys, or IoT device admin
|
||
panels unless you manually initiate each one."* Enterprise PAM rotates what has an API; the
|
||
manual long tail is **explicitly out of scope**; the one consumer attempt (Dashlane) failed.
|
||
→ **incredigo's guided worklist.**
|
||
|
||
**D. OSS rotation specifically (not storage).** Even among OSS tools rotation is the weak spot
|
||
(Infisical retry/failure gaps; GCP "write your own function"; AWS native only first-party DBs).
|
||
|
||
---
|
||
|
||
## 6. Who incredigo should be tailored for
|
||
|
||
**Primary persona — "the security-literate solo dev / small-team lead."**
|
||
- Has secrets scattered across `.env`, `~/.aws`, `~/.netrc`, `~/.ssh`, `docker-compose.yml`,
|
||
`k8s/*.yaml`, plus a gopass store.
|
||
- Distrusts (or can't afford / can't legally use) a SaaS secrets hub. Wants self-custody.
|
||
- Comfortable on the CLI; wants **headless automation in CI** *and* an interactive TUI.
|
||
- Job-to-be-done: *"Find every credential I have, back them up safely, rotate the ones a script
|
||
can rotate, and give me a clean checklist for the rest — without anything ever leaving my
|
||
machine."*
|
||
|
||
**Secondary personas:**
|
||
- **Privacy/sovereignty buyers** (journalists, activists, infosec consultants, regulated EU
|
||
shops who can't ship secrets to US clouds) — value RAM-only / no-cloud + the PGP-as-root-of-trust model.
|
||
- **Homelab / self-hosted operators** — rotate Postgres/Redis/SSH/router/NAS creds with one tool.
|
||
- **Incident responders / pentest cleanup** — after a leak, *discover + mass-rotate + audit* on a
|
||
host quickly. (Aligns with the GitGuardian "8 copies per secret" reality.)
|
||
|
||
**Explicit non-targets (for now):** Fortune-500 PAM, machine-identity-at-scale, compliance-cert
|
||
checkboxes (SOC2/FedRAMP managed service). Those are the incumbents' moats.
|
||
|
||
**Positioning line:** *"The local-first credential rotator: discover the secrets sprawled across
|
||
your machine, back them up, rotate what's automatable, and get a guided worklist for the rest —
|
||
RAM-only, no cloud, no server, one binary."*
|
||
|
||
---
|
||
|
||
## 7. Extension vectors (ranked by leverage vs. white space)
|
||
|
||
Tied to the gaps above, not feature-for-feature parity with PAM.
|
||
|
||
1. **Breadth of self-hostable rotation drivers** (the credibility multiplier). After postgres:
|
||
**MySQL/MariaDB, Redis, SSH `authorized_keys`, Gitea/GitHub/GitLab PATs, AWS IAM access keys
|
||
(moto-tested), HTTP basic-auth / reverse-proxy htpasswd, S3-compatible keys.** Each is a
|
||
self-contained `Rotator` — exactly the homelab/solo-dev surface incumbents skip.
|
||
2. **Consumer-grade reset-flow engine** (the highest-leverage *category* move): a generalized,
|
||
declarative **"email/OTP reset-flow" runner** for the long tail — site recipe = change-URL +
|
||
form selectors + (human-supplied) OTP step. Human-in-the-loop, never bypasses MFA. This is the
|
||
space Dashlane vacated and Chrome only half-fills.
|
||
3. **"Eliminate, don't rotate" recommender.** Where a credential *can* be replaced by something
|
||
that needs no rotation (passkeys, OIDC/SSO, short-lived certs, SSH certificates, cloud
|
||
workload identity), **recommend the elimination** instead of rotating. This rides the
|
||
industry's actual direction (passkeys) and is a differentiator no rotator markets.
|
||
4. **Consumer propagation / blast-radius closeout.** After rotating a secret, update the places
|
||
that consume it (.env, CI variables, k8s secrets) — the read-only `blast` map already finds
|
||
them; the next step is *guided* (not silent) propagation.
|
||
5. **GitOps / IaC rotation** — rotate a secret and open a PR that updates the encrypted value
|
||
(SOPS/age) in the repo. Serves the "59% of leaks are in CI/CD runners" reality.
|
||
6. **Standards plumbing** — RFC 7009 token revocation, RFC 8693 token exchange, SCIM for
|
||
user-store rotation, ACME for TLS cert rotation. Each widens automatable coverage.
|
||
|
||
**Recommended next two:** finish the **driver ladder** (#1 — proves the core works broadly and is
|
||
low-risk) and prototype the **reset-flow engine** (#2 — the actual unoccupied market). #3
|
||
(eliminate-don't-rotate) is the cheapest *positioning* win and worth a small advisory module.
|
||
|
||
---
|
||
|
||
## Caveats on data quality
|
||
|
||
- **PAM market sizes differ materially by analyst** (Mordor vs Fortune vs Precedence) — cite the
|
||
firm with each figure.
|
||
- The **`.well-known` adoption (12.2% / 33.8%)** and **111-site automation study** come from
|
||
**arxiv 2511.10111**; some per-metric numbers in the HTML preprint were redacted — treat the
|
||
fine-grained automation percentages as **directional** and verify against the final PDF before
|
||
quoting precisely.
|
||
- **Doppler's funding/valuation** was not found in public trackers; needs a dedicated dig if required.
|
||
- Acquisition values/dates (CyberArk/PANW, HashiCorp/IBM) are as announced in 2025; confirm close
|
||
status before citing as completed.
|
||
|
||
## Sources
|
||
|
||
- IBM/HashiCorp: https://www.hashicorp.com/en/blog/hashicorp-officially-joins-the-ibm-family · https://siliconangle.com/2025/02/27/ibm-completes-6-4b-hashicorp-acquisition-following-regulatory-approvals/
|
||
- Vault pricing/license: https://infisical.com/blog/hashicorp-vault-pricing · https://envmanager.com/blog/hashicorp-vault-pricing
|
||
- CyberArk/PANW: https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-announces-agreement-to-acquire-cyberark--the-identity-security-leader · Conjur pricing: https://infisical.com/blog/cyberark-conjur-pricing
|
||
- Akeyless: https://www.akeyless.io/secrets-management/ · https://www.prnewswire.com/news-releases/akeyless-raises-65m-to-provide-secrets-management-as-a-service-for-devops-and-multi-cloud-environments-301679894.html
|
||
- Doppler/Infisical: https://www.doppler.com/blog/infisical-doppler-secrets-management-comparison-2025 · https://securityboulevard.com/2025/06/infisical-vs-doppler-secrets-management-comparison-for-2025/
|
||
- AWS/Azure/GCP: https://www.pulumi.com/blog/secrets-management-tools-guide/ · https://www.techleague.io/blog/security/aws-secrets-manager-vs-azure-key-vault-vs-gcp-secret-manager-2026/ · https://dev.to/kazuya_dev/aws-reinvent-2025-zero-touch-secret-rotation-now-available-for-your-third-party-secrets-sec230-fne
|
||
- PAM market: https://www.mordorintelligence.com/industry-reports/privileged-access-management-pam-market · https://www.fortunebusinessinsights.com/privileged-access-management-market-112360 · https://www.precedenceresearch.com/privileged-access-management-market
|
||
- PAM leaders: https://techcloudpro.com/blog/cyberark-vs-delinea-vs-beyondtrust-pam-comparison/ · https://www.beyondtrust.com/resources/competitor-comparisons/delinea-alternative
|
||
- Consumer auto-change: https://www.cloudwards.net/dashlane-review/ · https://thehackernews.com/2025/05/google-chrome-can-now-auto-change.html · https://developer.chrome.com/docs/identity/automated-password-change
|
||
- Academic study: https://arxiv.org/abs/2511.10111 (HTML: https://arxiv.org/html/2511.10111v2)
|
||
- RFC 8615 / change-password URL: https://www.rfc-editor.org/rfc/rfc8615.html · https://www.w3.org/TR/change-password-url/ · https://web.dev/articles/change-password-url
|
||
- Secrets sprawl: https://thehackernews.com/2026/03/the-state-of-secrets-sprawl-2026-9.html · https://snyk.io/articles/state-of-secrets/ · https://www.doppler.com/blog/what-is-secrets-sprawl-and-how-to-prevent-it-in-2025
|
||
- OSS/no-cloud: https://openssf.org/blog/2025/06/17/openbao-joins-the-openssf-to-advance-secure-secrets-management-in-open-source/ · https://infisical.com/blog/open-source-secrets-management-devops
|
||
- Long tail: https://lifetips.alibaba.com/tech-efficiency/automated-password-rotation-for-personal-accounts
|