Wiz: 56% of company-impacting secret leaks sat in employees' personal repos

Wiz Research says it found verified secret leaks in 65% of the Forbes AI 50, and that 56% of the company-impacting secrets it identified were sitting in employees' personal repositories rather than in org-owned ones ^[1][2]. Taking that second figure at face value, more of the exposure that actually hurt companies fell outside the enterprise scanning surface than inside it ^[14].

The mechanism is unglamorous. Wiz describes the same engineer pushing to a GitHub Enterprise organization by day and maintaining side projects, forks and experiments under a personal account by night, frequently on the same GitHub account, toggling between a context the employer governs and one it does not ^[4]. Corporate code or a credential gets copied into a personal public repo, usually by accident and in a hurry ^[5]. Nothing in the control stack notices, because a personal public repo is not org-owned, so it never enters inventory, and an asset you do not know exists cannot be scanned ^[3].

That is a perimeter problem, not a detection problem. Secret scanning inside the org boundary is answering a question about assets when the risk travels with a person. Wiz's own framing agrees: the unit of risk is the path from a specific person, to a specific exposed credential, to a specific asset that credential unlocks, which requires correlating developer identity with repositories inside and outside the organization ^[12]. Its product does that correlation, validates which exposed secrets are exploitable, and tracks a fix ^[11].

Two supporting details matter more than the headline percentage. First, timing: Wiz says attacker bots monitor public GitHub commits in near real time, and a secret can be picked up in minutes, sometimes seconds, and used immediately ^[6]. Discovery-to-abuse windows that short make weekly scan cadences decorative. Second, blast radius: in Wiz's State of SDLC 2026 report, validated secrets found in public repositories frequently grant infrastructure-level rather than application-only access, including cloud provider credentials, CI/CD tokens, third-party API keys and AI service credentials ^[7]. Wiz also reports that four of the top five most frequently leaked validated secrets are for AI services ^[8], and argues that AI-assisted development increases code volume, reuse and automated change propagation, so existing secrets spread faster than review can keep up ^[10].

The caveats are structural. This is a single vendor's research, published on that vendor's blog alongside the product that addresses the finding ^[15]. The post does not publish a sample size, a definition of "company-impacting", or the denominator behind 56% ^[16]. Wiz is right that a detector produces a string match, not a risk, and that validated means confirmed active and usable at the time of discovery ^[9]; the same scepticism should be applied to its own aggregate.

There is also a cost the post does not price. Correlating staff to their personal accounts means an employer enumerating what engineers do on their own time, which is an HR and works-council conversation before it is a tooling decision. Buying the capability without settling that is how a control becomes a grievance.

What to watch: whether the State of SDLC 2026 report ships with methodology and denominators for the 56% claim ^[7][2]; whether AI service providers move to short-lived credentials, given their share of leaked validated secrets ^[8]; and whether identity-side correlation produces tracked fixes or just a larger backlog, which Wiz itself concedes is the default outcome without context ^[13].