Manual rotation does not scale well in large, distributed environments. Teams must constantly update, delete, and verify credentials across many systems, which is time-consuming and error-prone. The result is often stale access, shared secrets, policy drift, and lingering accounts that continue to expose infrastructure long after they should have been removed.
Why Manual Rotation Breaks at Scale
Manual password and ssh key rotation fails because access control becomes a human coordination problem instead of a system property. As environments spread across clouds, CI/CD, bastions, servers, and third-party services, the number of secrets that must be changed, tracked, and verified grows faster than teams can safely manage. That gap creates stale access, duplicated credentials, and inconsistent enforcement that attackers can exploit.
This is exactly the kind of failure pattern documented in NHIMG research on Guide to the Secret Sprawl Challenge and the Guide to NHI Rotation Challenges. When rotation depends on tickets, runbooks, and people remembering every downstream dependency, credentials linger far beyond their intended life. The practical result is not just operational friction. It is a widening exposure window that makes privilege cleanup unreliable and incident response slower.
In practice, many security teams discover that rotation is broken only after an old key is reused, not during the intended access review.
How the Failure Shows Up in Day-to-Day Operations
Manual rotation tends to fail in predictable places: shared service accounts, embedded credentials in scripts, SSH keys copied between hosts, and application owners who are not notified when a secret changes. A password update can also trigger service outages if no one knows which jobs, daemons, or automation pipelines still depend on it. That means teams often postpone rotation to avoid breaking production, which defeats the security objective.
The deeper issue is that manual rotation treats secrets as static artefacts instead of short-lived proof of access. Current guidance from the OWASP Non-Human Identity Top 10 and NIST control families such as NIST SP 800-53 Rev 5 Security and Privacy Controls points toward stronger lifecycle discipline, but the operational translation is straightforward:
- rotate credentials automatically, not by calendar reminders;
- bind each secret to a specific workload or system owner;
- verify that downstream systems received the update before disabling the old value;
- revoke unused keys and accounts as soon as they are no longer needed;
- log every change so drift can be detected quickly.
NHIMG research shows the scale of the cleanup problem in practice, including the 2025 State of NHIs and Secrets in Cybersecurity finding that 91% of former employee tokens remain active after offboarding. That same pattern appears in machine access: if revocation is manual, abandonment becomes normal. These controls tend to break down when credentials are embedded in legacy automation because the dependency map is incomplete and no one can prove every consumer was updated.
Where the Real Risk Lives After Rotation Fails
Tighter rotation often increases operational overhead, requiring organisations to balance security gains against outage risk and maintenance cost. The strongest risk is not the password change itself but the uncertainty around what still uses the old secret. Once a key or password is copied into multiple places, manual rotation can create false confidence while leaving shadow copies active in code, tickets, shells, and backup systems.
That is why best practice is evolving toward ephemeral credentials, workload identity, and policy-driven access rather than periodic secret replacement alone. Where teams must keep SSH in use, they should shorten credential lifetime, limit scope, and pair rotation with inventory and detection. Where the environment allows it, move toward dynamic credentials and centralised lifecycle management instead of long-lived shared secrets. NHIMG’s broader guidance in NHI Lifecycle Management Guide and Top 10 NHI Issues reflects that shift: reduce secret lifetime, reduce secret reuse, and reduce the number of places a secret must be updated. Manual rotation breaks down most sharply in highly distributed environments with unmanaged scripts, because the organisation cannot reliably prove that every dependent system has moved to the new credential.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Manual rotation failures stem from weak NHI lifecycle and secret handling. |
| NIST CSF 2.0 | PR.AC-1 | Stale SSH keys and passwords are access control failures needing governance. |
| NIST SP 800-63 | Credential assurance and lifecycle rigor matter when secrets are reused manually. | |
| NIST Zero Trust (SP 800-207) | AC-4 | Manual rotation clashes with dynamic, policy-enforced access decisions. |
| NIST AI RMF | GOVERN | Governance must assign ownership for secret rotation and revocation risk. |
Define accountability for secret lifecycle risks and measure rotation exceptions as governance gaps.
Related resources from NHI Mgmt Group
- What breaks when organisations rely on identity tokens for fine-grained access control?
- What breaks when organisations rely on NLA as their main access control?
- What breaks when organisations rely on manual access reviews for NHIs?
- What breaks when organisations rely on one AI gateway for content, routing, and access control?
