Some quick points as a very early adopter of Vault: - Absolutely take an incremental approach, there is a learning curve - Use a high availability backend. I

Some quick points as a very early adopter of Vault: - Absolutely take an incremental approach, there is a learning curve - Use a high availability backend. I started out with just consul, but have since went with consul for HA, and cockroachdb as the data store. - Practice your disaster recovery a many times before you go all in - use a combo of paper plus offline digital storage for the unseal keys and root tokens - be diligent about roles/policies - rely on tokens more than any other auth method(username/pass, certs) - don’t be afraid to use many vault instances that can talk to a core instance for things like transit auto unseal All that said, I absolutely think it’s worth the investment if you have the infrastructure to back it(aka a cluster without a SPOF) The PKI backend is phenomenal, and it makes a great sidecar for any app that needs auth, secrets, or general crypto stuff using the transit backend. I really want to create a user friendly Password Manager/TOTP front end backed by vault. Someday…