Rapid digitalisation without architectural hygiene¶
In recent years, ministries, NGOs, SMEs and grandma-run charities alike have been busily bolting on cloud migrations, SaaS platforms, shadow IT and remote access for everyone and their cat, while budgets for lifecycle management, threat modelling, or consolidating the resulting mess rarely followed. Europe has, in effect, built a digital IKEA wardrobe and skipped the screws that make it stand upright.
The clerk’s brief¶
From the clerks, for the Patrician’s eyes
Compiled September 2026. Newest first; settled patterns sink into the core sample at the end. The clerks would note that this file concerns the things organisations do not know they have, which makes it, by definition, incomplete.
March 2026: Keys under the mat¶
GitGuardian’s secrets sprawl report, published March 2026, counts 28.65 million new hardcoded secrets reaching public GitHub in 2025, a 34 per cent rise and the largest single-year jump in GitGuardian’s records. Roughly 64 per cent of credentials confirmed valid in 2022 were still valid when retested in January 2026. More than three years, the clerks observe, is a long time to leave a key under a mat that everyone knows about.
December 2025: Bought in¶
ENISA’s NIS Investments report, published December 2025, finds security spending held at about the previous year’s level, 9 per cent of IT budgets, and going increasingly on technology and outsourcing rather than internal cybersecurity teams. The clerks note that the organisation buys the tools and rents the hands.
April 2025: The machines that escape the inventory¶
CyberArk’s identity security landscape, published April 2025 from a survey of 2,600 security decision-makers in twenty countries, six of them European, finds machine identities outnumbering humans by more than 80 to 1 and nearly half holding sensitive or privileged access. It calls them “mostly unknown and uncontrolled”. The inventory illusion extends past the systems to the credentials the systems use to talk to each other.
The core sample¶
The founding stratum is dated March 2020: the remote-work scramble whose ad hoc home offices hardened into infrastructure. Since then the sprawl has been measured rather than mended: secrets accumulating in public repositories year on year, machine identities multiplying past any lifecycle process. A platform becomes debt when nobody knows what depends on it, who administers it, where its data lives or how to leave.
The clerks’ standing assessment: the wardrobe has not fallen over, which is being read upstairs as evidence that it will not. The clerks read it as evidence that nobody has yet leaned on it.