Some quick points as a very early adopter of Vault:

- Absolutely take an incremental approach, there is a learning curve

- Use a high availability backend. I started out with just consul, but have since went with consul for HA, and cockroachdb as the data store.

- Practice your disaster recovery a many times before you go all in

- use a combo of paper plus offline digital storage for the unseal keys and root tokens

- be diligent about roles/policies

- rely on tokens more than any other auth method(username/pass, certs)

- don’t be afraid to use many vault instances that can talk to a core instance for things like transit auto unseal

All that said, I absolutely think it’s worth the investment if you have the infrastructure to back it(aka a cluster without a SPOF)

The PKI backend is phenomenal, and it makes a great sidecar for any app that needs auth, secrets, or general crypto stuff using the transit backend.

I really want to create a user friendly Password Manager/TOTP front end backed by vault. Someday…