TL;DR: Password rotation remains a table-stakes defence for IT, OT and cloud environments, but manual processes, legacy systems and weak synchronisation leave organisations exposed to credential abuse, brute force, credential stuffing and lateral movement, according to Xage Security research. The control only reduces risk when rotation is automated, event-driven and integrated into broader PAM governance.
At a glance
What this is: Xage Security says password rotation still matters across IT and OT, but manual handling and weak synchronisation leave exploitable windows for credential abuse.
Why it matters: IAM, PAM and OT security teams need to treat rotation as a lifecycle control, because stale credentials and inconsistent enforcement undermine both access governance and operational resilience.
By the numbers:
- According to the 2026 Verizon Data Breach Investigations Report, credential abuse accounts for 13% of initial access in breaches and appears at some point in 39% of breach attack paths.
Context
Password rotation is the practice of replacing credentials on a schedule or after specific events so that one compromised password does not remain useful for long. In mixed IT and OT environments, that sounds simple but often breaks down because legacy systems, uptime constraints and manual handoffs all extend the time a credential stays valid.
The governance problem is not whether rotation exists, but whether it is enforced consistently across human-administered systems, industrial systems and cloud-connected access paths. When rotation is inconsistent, privileged access outlives the business event that should have invalidated it, and attackers inherit a longer window to abuse valid credentials.
Key questions
A: Manual rotation usually fails at scale. Teams miss accounts, introduce delays, and create change errors that can disrupt applications or leave credentials unchanged for too long. The biggest control gap is inconsistency, because attackers only need one stale credential to gain a foothold. Automation helps, but it must be governed and logged.
Q: Why do long-lived passwords increase lateral movement risk?
A: Long-lived passwords give attackers more time to reuse a stolen or guessed credential before defenders change it. That matters most in privileged environments, where one valid account can open multiple systems and let an intruder move from the initial compromise to broader access.
Q: How do security teams know if credential rotation actually worked?
A: They need proof that every consumer rejected the old credential, every dependent workflow has moved to the replacement, and no residual access path still functions. A rotation is not complete until validation shows the old secret is dead everywhere it mattered. Without that verification, response teams are guessing.
Q: Should password rotation be managed separately from PAM?
A: No. Rotation without PAM usually becomes a local hygiene task with weak enforcement, while PAM provides the vaulting, session control and governance needed to make changes consistent. When the two are separated, policy intent and actual credential state drift apart.
Technical breakdown
Why manual password rotation fails in mixed IT and OT estates
Manual rotation depends on people executing the change, recording it correctly and synchronising it everywhere the credential is used. That model fails when PLCs, RTUs and other OT assets do not support modern workflows, when administrators bypass steps to keep operations running, or when a password changes in one place but not another. The result is not just inconvenience. It is drift between the credential state the programme thinks exists and the one attackers can still use.
Practical implication: replace human-run rotation with automation that can enforce the same change across every dependent system.
How event-driven rotation shortens credential exposure windows
Scheduled rotation only limits risk on a calendar. Event-driven rotation is more precise because it can trigger after credential checkout, privileged use, suspected compromise or login completion. In identity terms, that matters because the attack window is defined by credential validity, not by policy intent. The shorter that validity window, the less useful stolen credentials become for brute force reuse, credential stuffing or post-compromise movement.
Practical implication: tie rotation to privileged events, not just to a recurring timer.
Password rotation as part of PAM and cross-system synchronisation
Rotation is only reliable when it sits inside a broader privileged access workflow that also covers vaulting, session control and least-privilege access. Without synchronisation across IT, OT and cloud access paths, one control plane updates while another lags, creating hidden reuse risk. That is why rotation should be treated as lifecycle governance for credentials, not as a standalone hygiene task. A PAM programme is what turns rotation from a local action into an enforceable access state.
Practical implication: govern password rotation through PAM so credential state, session state and access state stay aligned.
Threat narrative
Attacker objective: The attacker wants durable valid access that can be reused across systems before defenders rotate or revoke the credential.
- Entry begins when attackers obtain a valid password through credential stuffing, brute force or a prior breach, then try it against a critical system.
- Escalation occurs when the credential remains valid long enough to access privileged tooling or pivot into OT-adjacent assets with broader reach.
- Impact follows when one reused password enables lateral movement, insider-style access or operational disruption inside the environment.
Breaches seen in the wild
- Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Credential validity, not password strength alone, is the control variable that matters. Password rotation works because it collapses the reuse window, not because it makes every secret harder to guess in isolation. In mixed estates, the governance question is whether a credential can still be used after the business event that should have invalidated it. The implication is that lifecycle state is part of security state, especially where operational systems and IT systems share access patterns.
Manual rotation creates assurance gaps that audit language often hides. A policy saying passwords are rotated is not the same as a control that actually reaches PLCs, RTUs, workstations and cloud-connected admin paths. When those systems are not synchronised, the organisation believes the credential has changed while the attacker may still be using an older version. Practitioners should read this as a control integrity issue, not a documentation issue.
Event-driven rotation is the practical form of least privilege for credentials. If a password is checked out, used for admin work, or exposed to a higher-risk session, its security value changes immediately. A fixed calendar cannot reflect that change, which is why rotation tied to access events is more defensible than rotation tied only to time. The field should stop treating rotation as a maintenance chore and start treating it as dynamic entitlement control.
Password rotation is a PAM discipline, not a standalone hygiene measure. Rotation only closes the exposure gap when vaulting, session control and access enforcement remain in sync. That is the named concept here: credential exposure window. The shorter that window, the less room attackers have to convert a guessed or stolen password into lateral movement. Practitioners should evaluate password management as part of privileged lifecycle governance, not as a separate checklist item.
The OT exception is no longer a reason to exempt rotation, but it does change the operating model. Legacy industrial assets often require protocol-aware handling and tighter operational planning, which means blanket IT-style rules will fail. The lesson is not to weaken governance for OT, but to recognise that identical policy language does not produce identical control behaviour across environments. Teams need one governance standard with environment-specific enforcement.
From our research library:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- Read next: Guide to NHI Rotation Challenges
What this signals
Credential exposure window: The important design question is how long a password remains usable after it should have been retired. Organisations that can reduce that window through event-driven rotation and synchronised enforcement materially lower the chance that one stolen secret turns into broader access.
In mixed IT and OT estates, the governance test is not whether a password policy exists, but whether the policy reaches every asset that can still accept the credential. That is why rotation has to be paired with access lifecycle controls and tested across legacy systems, not just documented in security policy.
For practitioners
- Implement event-driven rotation for privileged credentials Trigger password changes after checkout, privileged use, account provisioning and suspected compromise so credentials do not survive the event that made them high risk.
- Synchronise rotation across IT and OT access paths Map every place a credential is accepted, then ensure the same change reaches engineering workstations, legacy OT assets and cloud-connected admin paths at the same time.
- Move rotation into PAM workflow enforcement Use vaulting, session control and approval boundaries so the credential state is governed by the access workflow rather than by manual updates.
- Audit whether old passwords still work after rotation Test whether rotated credentials remain valid anywhere in the estate, because any surviving path means the exposure window is still open.
Key takeaways
- Password rotation remains relevant because stale credentials still create a practical route into privileged systems and OT environments.
- The main weakness is not the concept itself but manual, unsynchronised enforcement across mixed estates.
- Rotation delivers the most value when it is automated, event-driven and governed through PAM rather than handled as a standalone task.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | This article focuses on passwords that stay valid too long across IT and OT environments. |
| NHI-05 — Overprivileged NHI | Rotated credentials are still dangerous when they retain excessive access across systems. | |
| Recommendation — Shorten secret lifetimes and automate revocation when credentials outlive their intended use. Reduce credential scope so a rotated password cannot open more systems than it should. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article directly maps password rotation to credential theft and movement inside the network. |
| Recommendation — Prioritise controls that disrupt credential access and lateral movement after one password is exposed. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Rotation is part of maintaining current access permissions and reducing stale entitlement exposure. |
| Recommendation — Revalidate access permissions when passwords rotate so entitlements stay aligned to current need. | ||
| CIS Controls v8 | CIS-5 — Account Management | Password rotation is an account management discipline across enterprise and OT systems. |
| Recommendation — Enforce account lifecycle controls that keep credentials current and remove stale access paths. | ||
Key terms
- Password Rotation: Password rotation is the regular replacement of a credential with a new one to reduce the window of exposure if it is shared, reused, or compromised. In shared environments, rotation needs automation and process discipline, otherwise it becomes a source of downtime, lockouts, and unsafe workarounds.
- Credential exposure window: Credential exposure window is the time period during which a secret remains usable, copyable, or replayable before it is revoked or replaced. The shorter that window, the less chance there is for abuse. In database governance, reducing this window is often more important than merely storing the secret securely.
- Event-triggered rotation: Event-triggered rotation changes credentials when a risk event occurs, such as exposure, suspicious activity, role change, or offboarding. It replaces fixed calendar rotation with a policy tied to actual security signals, which is a better fit for modern identity governance.
- Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or PAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org