IT AI Index
Index › Identity and access › Secrets › Small business › September 2026 Edition

Secrets management for small business buyers

Asked as “secrets management tool”, and as “secrets vault for applications and infrastructure”, on behalf of a small B2B company. 56 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Doppler
Clear leader
46% of first choices, clear leader.
ShowinginAll 67 categories →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
Small businessDoppler46%Clear leaderThis pageMid-marketDoppler33%ContestedStanding →EnterpriseHashiCorp Vault75%Clear leaderStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Doppler46%3%59endorsed leader
02Infisical25%4%50accepted challenger
031Password9%2%41accepted challenger
04Bitwarden Secrets Manager7%0%35accepted challenger
05HashiCorp Vault5%70%66criticized challenger
06AWS Secrets Manager4%25%52criticized challenger
07Azure Key Vault2%21%29accepted challenger
Show the three products at 0%, ordered by negative rate
08Google Secret Manager0%29%28criticized challenger
10OpenBao0%27%11criticized challenger
09Akeyless0%9%11accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
Head to head
Doppler vs HashiCorp VaultDoppler vs InfisicalHashiCorp Vault vs Infisical

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative60%
Key
01Doppler46%
02Infisical25%
031Password9%
04Bitwarden Secrets Manager7%
05HashiCorp Vault5%
06AWS Secrets Manager4%
07Azure Key Vault2%
08Google Secret Manager0%
09Akeyless0%
10OpenBao0%

02What they warned about

Three of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2 and GLM 4.7 FlashX changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
HashiCorp Vault
70%
46 of 66 labels negative · 12 of 12 models · 18 hard negative
“that often means **HashiCorp Vault** unless you already have a platform/security team ... makes it a poor fit for many small businesses without dedicated ops support” Perplexity Sonar, negative prompt
AWS Secrets Manager
25%
13 of 52 labels negative · 8 of 12 models · 3 hard negative
“Tools to Avoid for Small B2B ... limited multi-cloud support and can get expensive with per-secret pricing.” Kimi K2, direct prompt
Google Secret Manager
29%
8 of 28 labels negative · 6 of 12 models
“avoid cloud-provider-native tools like AWS Secrets Manager, GCP Secret Manager, and Azure Key Vault as your primary secrets store” Claude Haiku 4.5, negative prompt
Azure Key Vault
21%
6 of 29 labels negative · 5 of 12 models
“sometimes cloud-native managers like ... Azure Key Vault ... if you are not primarily on that cloud” Perplexity Sonar, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

60 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 700 links across 161 sites, every framing counted. Ranked by the number of answers carrying the site or page.

startwithidentity.com
31 answers · 39 citations · 9 models
blog.gitguardian.com
vendor site · GitGuardian31 answers · 31 citations · 10 models
envmanager.com
vendor site · EnvManager29 answers · 31 citations · 10 models
infisical.com
vendor site · Infisical25 answers · 28 citations · 11 models
doppler.com
vendor site · Doppler21 answers · 33 citations · 9 models
cybervendorguide.com
20 answers · 24 citations · 8 models
geekflare.com
20 answers · 20 citations · 8 models
safeguard.sh
vendor site · Safeguard18 answers · 23 citations · 9 models
pickmysoft.com
16 answers · 16 citations · 8 models
g2.com
15 answers · 21 citations · 9 models
cycode.com
vendor site · Cycode14 answers · 15 citations · 7 models
akeyless.io
vendor site · Akeyless12 answers · 15 citations · 6 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

blog.gitguardian.com/top-secrets-management-tools
31 answers · 10 models
envmanager.com/blog/best-secrets-management-tools
28 answers · 10 models
startwithidentity.com/rankings/best-secrets-management-tools
27 answers · 9 models
geekflare.com/cybersecurity/best-secret-management
20 answers · 8 models
cybervendorguide.com/guides/secrets-management
18 answers · 8 models
pickmysoft.com/blog/best-secrets-management-tools
16 answers · 8 models
infisical.com/blog/best-secret-management-tools
15 answers · 11 models
cycode.com/blog/best-secrets-management-tools
14 answers · 7 models
doppler.com/blog/secrets-management-tools-2025
12 answers · 7 models
g2.com/categories/secrets-management-tools/small-business
12 answers · 8 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best secrets management tool for a small B2B company?”Paraphrase“Which secrets vault for applications and infrastructure would you recommend to a small business that sells to other businesses?”Comparative“What are the top secrets management tools for a small team and how do they differ?”Budget-constrained“What is the best secrets management tool for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a secrets management tool. What should we look at?”Negative“Which secrets management tools should a small business avoid or be cautious about?”
Claude Haiku 4.5no first choiceAWS Secrets Manager, Azure Key VaultChanged
One alternativeHashiCorp Vault
Doppler
Five alternativesAWS Secrets Manager, Azure Key Vault, Bitwarden Secrets Manager, Google Secret Manager, Infisical
against: 1PasswordBitwarden Secrets Manager
Three alternatives1Password, OpenBao, SOPS
no first choiceagainst: AWS Secrets Manager, Azure Key Vault, Google Secret Manager, HashiCorp Vault
GPT-5.4 mini1Password, Doppler
Three alternativesAWS Secrets Manager, Azure Key Vault, Google Secret Manager
against: HashiCorp VaultAWS Secrets Manager, HashiCorp VaultChanged1Password, Doppler
Three alternativesAWS Secrets Manager, Azure Key Vault, Google Secret Manager
against: HashiCorp VaultInfisical
Five alternativesAWS Secrets Manager, Azure Key Vault, Google Secret Manager, OpenBao, SOPS
against: HashiCorp Vaultno first choicenothing named
Gemini 3.5 FlashDoppler
Four alternatives1Password, AWS Secrets Manager, Google Secret Manager, Infisical
against: HashiCorp Vault, OpenBaoDoppler, InfisicalChanged
Five alternatives1Password, AWS Secrets Manager, Azure Key Vault, Bitwarden Secrets Manager, Google Secret Manager
against: HashiCorp VaultDoppler
Five alternatives1Password, AWS Secrets Manager, Bitwarden Secrets Manager, Google Secret Manager, Infisical
against: HashiCorp VaultAWS Systems Manager Parameter Store, Bitwarden Secrets Manager
Two alternativesInfisical, SOPS
against: AWS Secrets Manager, Doppler, HashiCorp Vault, OpenBaoDoppler, Infisical
Two alternatives1Password, Bitwarden Secrets Manager
against: AWS Secrets Manager, Google Secret Manager, HashiCorp Vaultagainst: AWS Secrets Manager, CyberArk, Delinea Secret Server, Google Secret Manager, HashiCorp Vault, Kubernetes Secrets, OpenBao, SOPS, git-crypt
Perplexity Sonar1Password, Infisical
Three alternativesAWS Secrets Manager, Azure Key Vault, Google Secret Manager
against: HashiCorp Vault1Password, DopplerChanged
One alternativeAWS Secrets Manager
against: HashiCorp VaultDoppler
Four alternatives1Password, AWS Secrets Manager, Bitwarden Secrets Manager, Infisical
against: HashiCorp VaultBitwarden Secrets Manager, Infisical
Three alternatives1Password, Doppler, OpenBao
against: Cloud-native managers, HashiCorp Vaultno first choiceagainst: AWS Secrets Manager, Azure Key Vault, CyberArk Conjur, Google Secret Manager, HashiCorp Vault
Grok 4.1 FastDoppler
One alternativeInfisical
against: AWS Secrets Manager, HashiCorp VaultDopplerHeld
Three alternatives1Password, AWS Secrets Manager, Infisical
against: Azure Key Vault, Google Secret Manager, HashiCorp VaultDoppler, Infisical
Two alternatives1Password, Bitwarden Secrets Manager
against: HashiCorp VaultInfisical
Four alternativesAkeyless, Bitwarden Secrets Manager, Cloud-Native, Doppler
against: HashiCorp VaultDoppler, Infisical
Two alternativesAWS Secrets Manager, HashiCorp Vault
against: AWS Secrets Manager, Azure Key Vault, Google Secret Manager, HashiCorp Vault, Infisical, Kubernetes Secrets, Sealed Secrets
Mistral Small1Password, Doppler
One alternativeBitwarden Secrets Manager
against: HashiCorp VaultDopplerChanged
One alternativeHashiCorp Vault
Doppler
Two alternatives1Password, Infisical
against: HashiCorp VaultInfisical
Three alternativesDoppler, Google Secret Manager, HashiCorp Vault
no first choiceagainst: HashiCorp Vault, Infisical
DeepSeek V4 FlashDoppler, Infisical
Two alternativesAWS Secrets Manager, Bitwarden Secrets Manager
against: HashiCorp VaultDopplerChanged
Two alternativesAWS Secrets Manager, Infisical
against: HashiCorp VaultDoppler, Infisical
Two alternativesAWS Secrets Manager, Google Secret Manager
against: HashiCorp VaultDoppler, Infisical
Four alternativesAkeyless, Bitwarden Secrets Manager, OpenBao, SOPS
against: HashiCorp VaultDoppler, Infisical
Two alternativesAWS Secrets Manager, Google Secret Manager
against: HashiCorp Vaultagainst: AWS Secrets Manager, HashiCorp Vault, KeePass, LastPass
Llama 4 MaverickDoppler, InfisicalHashiCorp VaultChangedDoppler
One alternativeHashiCorp Vault
no first choiceno first choiceagainst: HashiCorp Vault
Qwen 3.7 FlashDoppler
Two alternativesAWS Secrets Manager, Infisical
against: HashiCorp VaultDopplerHeld
Three alternativesAWS Secrets Manager, Akeyless, Azure Key Vault
against: HashiCorp VaultDoppler
Four alternatives1Password, AWS Secrets Manager, Azure Key Vault, Bitwarden Secrets Manager
against: CyberArk, HashiCorp VaultDoppler
Three alternativesAWS Secrets Manager, Bitwarden Secrets Manager, Infisical
Doppler
Four alternatives1Password, AWS Secrets Manager, Bitwarden Secrets Manager, Google Secret Manager
against: HashiCorp Vaultagainst: AWS Secrets Manager, Broadcom Privileged Identity Management, CyberArk, Dashlane, Delinea Secret Server, HashiCorp Vault, IBM ACF2, LastPass, SOPS
Kimi K21Password
Three alternativesBitwarden Secrets Manager, Doppler, Infisical
against: AWS Secrets Manager, HashiCorp VaultDopplerChanged
Two alternativesAWS Secrets Manager, Infisical
against: Azure/GCP vaults, CyberArk Conjur, HashiCorp VaultDoppler, Infisical
Three alternatives1Password, Bitwarden Secrets Manager, Cloud-Native Options
Infisical
Three alternativesBitwarden Secrets Manager, OpenBao, SOPS + age
against: AWS Secrets Manager, Doppler, HashiCorp VaultDoppler
Two alternatives1Password, Infisical
against: HashiCorp Vaultagainst: AWS Secrets Manager, Azure Key Vault, Google Secret Manager, HashiCorp Vault
GLM 4.7 FlashXDoppler
Four alternatives1Password, AWS Secrets Manager, HashiCorp Vault, Infisical
against: CyberArk ConjurBitwarden Secrets ManagerChanged
Two alternativesAWS Secrets Manager, Infisical
Doppler, Infisicalagainst: HashiCorp VaultDoppler, HashiCorp Vault
Three alternativesAWS Secrets Manager, Azure Key Vault, Infisical
no first choiceagainst: HashiCorp Vault
MiniMax M2.5Doppler
Two alternativesHashiCorp Vault, Infisical
DopplerHeld
Three alternativesAWS Secrets Manager, Azure Key Vault, Infisical
against: HashiCorp VaultDoppler
Four alternativesAWS Secrets Manager, Bitwarden Secrets Manager, HashiCorp Vault, Infisical
Doppler, Infisical
One alternativeHashiCorp Vault
no first choiceagainst: AWS Secrets Manager, Akeyless, Azure Key Vault, CyberArk Conjur, Delinea Secret Server, Google Secret Manager, HashiCorp Vault
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 14:05no04 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:18no05 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:15yes1321 s
Direct recommendationPerplexity Sonarsonar2026-09-17 10:37yes208 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:56yes1810 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 12:30yes1010 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:33yes812 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:33yes52 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:35yes522 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:00yes2535 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:28yes2387 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:33yes1033 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:16no05 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:15yes36 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:02yes1222 s
ParaphrasePerplexity Sonarsonar2026-09-17 14:07yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:15yes4216 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 09:22yes55 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:28yes1817 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:05yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 14:07yes535 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:31yes920 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:16yes2953 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:05yes1537 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:13yes99 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:59yes711 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:17yes1020 s
ComparativePerplexity Sonarsonar2026-09-17 12:38yes208 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:54yes2813 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 14:05yes56 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:21yes1719 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:22yes52 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:20no037 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:54yes1037 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:06yes920 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:34yes1035 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:20yes97 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 14:06yes37 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:26yes2121 s
Budget constrainedPerplexity Sonarsonar2026-09-17 12:29yes206 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:26yes1611 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 11:35yes56 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:24yes1014 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:55yes53 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:59yes525 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:21yes933 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:50no082 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:36yes1025 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:42no05 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:32no06 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:41yes1224 s
Scale constrainedPerplexity Sonarsonar2026-09-17 10:57yes207 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:57yes1410 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 13:35no07 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:49yes1037 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:05yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:01no038 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:22yes1024 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:07yes15176 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:20no012 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:29yes158 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:19no05 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:34yes924 s
Negative framingPerplexity Sonarsonar2026-09-17 09:30yes207 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:02yes2112 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 12:01yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 11:45yes2020 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:49yes52 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:10yes523 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:14yes2959 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:23no015 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:40yes1966 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
Bitwarden read as Bitwarden Secrets Manager
Bitwarden (Business) read as Bitwarden Secrets Manager
Thycotic read as Delinea Secret Server
Unresolved, counted raw
AWS/Azure/GCP Secrets Manager
AWS/GCP/Azure Secrets Manager
Azure/GCP vaults
Broadcom Privileged Identity Management
Cloud-Native Options (AWS/GCP/Azure Secrets Managers)
Cloud-native managers
IBM ACF2
Infisec
SOPS + age
Discontinued, still offered
No shut-down product was recommended here.

Also in identity and access

The other categories of this function, with the leader in each.
← PAMWorkforce identity →