NVIDIA, SAP back OpenBao as secrets tool gains ground

ControlPlane said OpenBao has gained backing and adoption from NVIDIA, SAP, GitLab and Broadcom, describing the open source project as an increasingly credible option for secrets management in large organisations.

OpenBao is an open source fork of HashiCorp Vault, stewarded by the Open Source Security Foundation. Secrets management tools protect passwords, encryption keys, certificates and access tokens that let applications, systems and machines access data and services.

The support cited by ControlPlane points to a wider shift in infrastructure software as companies reassess how they manage sensitive credentials across cloud systems, software delivery pipelines and artificial intelligence workloads. As IT environments become more distributed and automated, the number of machine identities and credentials has grown, making governance more difficult.

Among the examples highlighted, GitLab's 19.0 release uses OpenBao as the engine for its native secrets manager. Broadcom has integrated OpenBao into vSphere Supervisor as part of VMware Cloud Foundation 9.0, while NVIDIA's adoption was linked to its broader open source work.

SAP was also named among the large technology groups using or supporting the project, though no further detail was given on the nature of that involvement.

Security focus

Rob Kenefeck, field CTO at ControlPlane, said the project's growth reflects changes in how organisations approach security operations in modern computing environments.

"Secrets management is now a core part of cyber resilience. Modern systems rely on it to connect applications, services and infrastructure. As cloud and AI environments become more complex, organisations need better visibility and control over how those secrets are created, stored, rotated and accessed," Kenefeck said.

That view is gaining weight as companies increase spending on AI, cloud and data centre infrastructure while facing tighter governance demands. The issue is not limited to human users. Machine identities, application credentials and automated service accounts now sit behind many digital systems, increasing the operational burden on security teams.

ControlPlane launched Enterprise for OpenBao earlier this year in response to demand for support services in Australia. The offering includes migration planning, architecture and configuration work, integration with identity and security systems, and technical support.

The company has also appointed Alex Scheel as head of OpenBao development. Scheel chairs the OpenBao Development Working Group and previously served as chair of the OpenBao Technical Steering Committee.

His background includes work across open source cryptography, HashiCorp Vault and enterprise secrets management. ControlPlane said the appointment connects its support work with deeper involvement in the project's technical direction.

Market confidence

Scheel said the level of activity around OpenBao reflects the rising importance of secrets management as more systems rely on automated identities.

"Secrets management has never been more critical with the explosion of agentic identities, and the OpenBao community is where serious secrets management work is happening right now. I'm excited to be joining ControlPlane to help organisations across the region and the globe get this right," Scheel said.

He also pointed to the effect support from large technology vendors can have on adoption across the wider market.

"When major technology providers begin building around open source infrastructure, it gives the wider market confidence that these platforms are mature, credible and ready for serious operational environments," Scheel said.

OpenBao's emergence follows a period of debate in the infrastructure software market over licensing, portability and control. For some enterprise users, open source projects offer a way to avoid dependence on a single vendor while retaining access to community-led development and clearer visibility into how security tools operate.

In Australia and across the wider Asia-Pacific region, that discussion is becoming more relevant as companies expand their use of containerised applications, Kubernetes platforms and AI systems. Each of those environments depends on large volumes of credentials and cryptographic material, increasing the need for tools that can store, rotate and monitor secrets consistently.

Kenefeck said the shift should be seen as part of a broader operational change rather than a simple replacement of one product with another.