Organizations are adopting AI agents, cloud-native applications, and automation at an unprecedented pace. As the number of non-human identities grows faster than human users, security teams must govern identities, automate certificate management, and prepare for evolving cryptographic threats without slowing innovation.
Vault 2.2, now generally available, expands identity-based security for AI agents and non-human identities while automating more of the certificate lifecycle and strengthens cryptographic readiness with new post-quantum capabilities. Deeper IBM ecosystem integrations, broader platform support, and usability improvements help organizations reduce risk, simplify operations, and scale security across the autonomous hybrid cloud.
»Secure AI agents and non-human identities
AI agents, applications, services, and workloads all depend on identities to access systems and data. Yet many organizations still rely on governance models designed primarily for human users, creating blind spots, identity sprawl, and increased security risk.
SCIM, available in Vault 2.2, automates user and group lifecycle management across leading identity providers – adding Microsoft Entra to SailPoint and Okta since the SCIM beta, reducing administrative overhead, and helping ensure that access remains aligned with enterprise identity systems. Vault's Agentic IAM enhancements help customers govern identities with confidence by combining verified agent registration, delegated authorization boundaries, and ephemeral per-request authorization. Every agent is tied to a trusted identity, governed by defined ceiling policies that establish maximum permissions, and authorized based on the specific task being requested rather than broad, long-lived access rights. By requiring rich authorization details for each request, Vault evaluates authorization in context, creates a clear and auditable record of every agent's action, and enforces least-privilege access by default. This approach reduces the risk of over-authorization, strengthens accountability, and enables organizations to confidently scale AI agents.
Figure 1: A high-level overview of the SCIM identity provisioning workflow into Vault.
With these enhancements, Vault users extend least-privilege access and auditability to AI agents and non-human identities and reduce identity sprawl to keep every access decision aligned with business and security policy. As a result, organizations gain accountability and confidence to scale AI adoption while simplifying compliance.
An additional way Vault 2.2 helps organizations govern identities with confidence is by eliminating the long-standing Secret Zero challenge for on-prem workloads. With new vTPM support for Linux VMs, workloads can authenticate to Vault using cryptographic proof tied to an enrolled virtual TPM rather than relying on distributed bootstrap secrets. This strengthens machine identity, reduces the risk of credential theft or reuse, and ensures that only trusted, enrolled workloads can access sensitive resources. By establishing a stronger foundation of trust for workload authentication and integrating with broader identity frameworks such as SPIFFE, Vault 2.2 gives security and platform teams greater confidence in governing, authorizing, and managing machine identities across on-prem environments at scale.
Fig. 2: A workflow for vTPM authorization in Vault that solves the Secret Zero challenge.
»Automate certificate lifecycles and improve crypto-agility
Security teams face mounting pressure to eliminate manual processes, prevent outages caused by expired credentials and certificates, and prepare for future cryptographic requirements.
Vault 2.2 helps organizations modernize PKI operations and strengthen cryptographic resilience by automating public certificate workflows, improving crypto-agility, and advancing post-quantum readiness. This release delivers capabilities that simplify certificate issuance and governance, such as automated public CA integrations and a UI enhancement that provides better visibility into certificate status and available actions for centralized certificate lifecycle management.
Fig. 3: Manage public certificates within the Vault UI with a centralized view of roles and status.
Fig. 4: View the detail on certificate orders within the Vault UI.
The availability of PQC X.509 certificate support for the PKI Secrets Engine means Vault 2.2 adds support for ML-DSA key generation, signing, key import and key export. This strengthens certificate trust chains and helps protect against certificate forgery and service impersonation in the quantum era.
Meanwhile, crypto-agility in the Transit secrets engine simplifies future migrations. Vault 2.2 also adopts NIST-approved FF1 format-preserving encryption to strengthen sensitive data protection. Together, these capabilities reduce operational risk, scale certificate management, modernize cryptographic infrastructure, and support future security and compliance requirements.
»Drive enterprise scale and adoption
As organizations expand across cloud, on-premises, and IBM environments, security and engineering teams need solutions that are easy to adopt, efficient to operate, and consistent across diverse infrastructure. Vault 2.2 improves time to value with improvements within the Vault product experience, starting with a redesigned home dashboard. To enhance discoverability and easier onboarding, feature spotlight points the user to what’s new right within the product UI. Improvements to user preferences and the delivery of dark mode add to what makes the Vault experience customizable for users. As well, a new Submit feedback button creates an in-product opportunity to share suggestions and comments to enhance the product feedback loop. A more robust Terraform code generator supplements the Visual Policy Editor released in 2.0.0 that provides code snippets for automated feature adoption. These updates make capabilities easier to discover, reduce friction to adoption, and support ongoing platform modernization.
Fig. 5: Updates to the Vault UI include enhancements to the home dashboard, dark mode and feature spotlights. Send feedback about valued features and suggested improvements from within the product with the Submit feedback button.
Improvements to Azure dynamic service principals are part of this release. With automated credential rotation, Vault reduces eventual consistency delays within the Azure Secrets Engine, working around the limitation of having a delay before a newly rotated credential can be used. Automated rotation via Vault’s Rotation Manager now fully handles the lifecycle of static credentials even if Azure Secrets Engine does not support automated rotation. Azure access token vending is another way to handle how a newly created credential can be used, resolving the eventual consistency delay. Applications can now directly access tokens which are immediately consistent. Enhancements to LDAP are also generally available in this release. Credential drift and blind spots - that were previously created by the inability to detect if a managed account has been locked or revoked by the target directory – are now resolved with the ability to unlock accounts from Vault manually or automatically during rotation. Health checks for the LDAP Secrets Engine are now also made possible by configuration validation. Non-disruptive, on-demand configuration validation endpoints for Vault resources are now available, which means Vault customers can proactively discover that Vault has successfully connected and authenticated, with configured external systems instead of only being discovered at rotation failure or when application downtime is reported.
Finally, Vault 2.2 extends consistent identity and secrets security across IBM and hybrid infrastructure. Support for Vault CLI and Vault Secrets Operator on IBM Power, Azure AKS Workload Identity integration, secret recovery for KV v2 and Secrets Sync enhancements help organizations standardize security practices across cloud-native applications, IBM platforms, Kubernetes environments, and traditional infrastructure.
Standardizing security practices across cloud, on-premises, IBM, and Kubernetes environments helps organizations reduce operational silos and tool fragmentation. Teams gain more consistent governance, visibility, and control while lowering administrative overhead. This foundation enables the business to scale identity, secrets, certificate, and key management as its technology environment evolves.
»Building the foundation for the autonomous hybrid cloud
As organizations move toward more autonomous and distributed operating models, identity becomes the foundation for securing applications, workloads, infrastructure, AI agents, and cryptographic systems.
Vault 2.2 gives organizations a stronger foundation for securing autonomous and distributed environments. By unifying identity governance, lifecycle automation, cryptographic readiness, and platform improvements, this release helps customers reduce operational risk and scale security with greater consistency.
See how Vault 2.2 can strengthen security across your AI agents, applications, and enterprise workloads. Review the Vault developer documentation to explore the platform, then use the upgrade guidance to plan, test, and begin your move to Vault 2.2.
