Time-based rotation changes credentials on a fixed schedule, whether or not they are in active use. On-demand rotation happens only when a specific event or condition justifies it, such as a suspected exposure or a workflow trigger. Time-based rotation is simpler to govern, while on-demand rotation can better match operational need and reduce unnecessary churn.
Why Time-Based Rotation Alone Is Not Enough
Fixed-schedule rotation is easy to explain and audit, which is why many teams start there. The problem is that time alone is a weak signal for risk: a credential can be unused for weeks and still be safe, or be exposed minutes after issuance and remain valid until the next cycle. That gap matters because NHI credentials often support automation, service-to-service access, and pipeline execution, where compromise can spread fast.
For practitioners looking at the broader problem set, NHIMG’s Guide to the Secret Sprawl Challenge and the OWASP Non-Human Identity Top 10 both reinforce that stale secrets and weak lifecycle discipline are recurring failure modes. NHIMG’s 2024 report found that only 19.6% of security professionals are strongly confident in their organisation’s ability to securely manage non-human workload identities, which is a useful indicator of how immature many rotation programmes still are.
In practice, many security teams discover the weakness of fixed schedules only after a secret has already been exposed or reused outside its intended workflow.
How On-Demand Rotation Changes the Operational Model
On-demand rotation ties credential change to an event, not a calendar. Typical triggers include suspected leakage, privilege elevation, deployment completion, failed authentication spikes, a decommissioning event, or a workflow that intentionally forces a fresh secret before execution. The main advantage is precision: the credential changes when the risk changes, not when an arbitrary timer expires.
That approach works best when rotation is connected to the identity lifecycle and the systems that issue or consume secrets. NHIMG’s NHI Lifecycle Management Guide is useful context here, because rotation is only one control in a larger lifecycle that includes provisioning, usage, monitoring, and revocation. It also aligns with the operational reality described in Ultimate Guide to NHIs — Static vs Dynamic Secrets, where short-lived, dynamic credentials reduce the blast radius of exposure.
In practice, strong on-demand rotation usually depends on automation, event detection, and a reliable inventory of where credentials are used. A mature implementation often includes:
- clear trigger conditions for rotation, such as leak detection or workflow completion
- automated re-issuance and revocation to avoid manual delays
- asset-to-secret mapping so downstream dependencies are updated safely
- logging that proves when the old credential was disabled and the new one became active
Where this guidance breaks down is in highly distributed environments with weak dependency mapping, because on-demand action can break services that still rely on the old credential.
Where the Tradeoff Becomes Operationally Real
Tighter rotation often increases coordination overhead, so organisations have to balance security gain against service stability and engineering effort. Time-based rotation is simpler to schedule and explain, but it can create unnecessary churn for low-risk credentials and still miss the actual moment of exposure. On-demand rotation reduces that mismatch, yet it demands better detection, stronger orchestration, and more confidence in downstream automation.
Current guidance suggests using time-based rotation for credentials with predictable renewal requirements, then layering on-demand rotation for high-risk, high-blast-radius, or frequently exposed paths. NHIMG’s Guide to NHI Rotation Challenges and the Guide to NHI Rotation Challenges show why rotation programmes often fail when teams treat every secret the same. The better pattern is risk-based: rotate on a schedule where governance requires it, and rotate on demand where exposure, privilege, or workflow state makes it necessary.
For teams with secrets sprawl, the practical question is not which method is theoretically better, but which one their inventory, automation, and recovery processes can actually support without causing avoidable outages.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Addresses credential rotation discipline and stale secret exposure risk. |
| NIST CSF 2.0 | PR.AC-1 | Rotation changes access validity and supports controlled credential lifecycle management. |
| NIST AI RMF | GOVERN | On-demand rotation depends on governance, ownership, and response triggers. |
| CSA MAESTRO | IAM-04 | Covers ephemeral credential handling in autonomous and cloud-native workloads. |
| NIST Zero Trust (SP 800-207) | SC-7 | Rotation supports limiting trust duration under zero trust principles. |
Use time-based rotation for baseline hygiene and trigger on-demand rotation when exposure or misuse is detected.
Related resources from NHI Mgmt Group
- What is the difference between privilege reduction and secret rotation?
- What is the difference between a rules-based secret scanner and a hybrid scanner?
- What is the difference between repository-based discovery and external attack surface discovery for DAST programs?
- What is the difference between proxy-based access for on-prem apps and direct native integration?
