Topic starter
19/10/2026 5:09 pm
TL;DR: Truffle Security says 64,024 unique leaked AWS keys were verified from public code, container images and datasets, and 88% were still active, with 84% carrying full administrator access and many lingering for years. Blast-radius visibility, not just secret discovery, becomes the decisive control when leaked credentials can still authenticate and assume more access.
Editorial analysis by NHI Mgmt Group, based on content published by Truffle Security: “TruffleHog AWS Analyze press release â Truffle Security Co.”.
By the numbers:
- 88% still were active, showing that most leaked AWS keys had not been remediated when found.
- Among the keys researched closely, 84% carried full administrator access.
Key questions
Q: What breaks when a leaked AWS key is still active?
A: When a leaked AWS key is still active, the compromise is no longer about disclosure alone.
Q: What is the difference between finding a leaked AWS key and knowing its effective blast radius?
A: Finding a leaked AWS key tells you a credential has been exposed.
Q: How can security teams tell whether a leaked key is still a real risk?
A: They need to confirm whether the credential still authenticates, whether it is tied to active automation, and whether it can assume additional roles or access sensitive services.
Practitioner guidance
- Map leaked keys to effective AWS permissions Trace each exposed credential to the IAM user or role it represents, the permissions attached to that identity, and any roles it can assume before deciding on containment priority.
- Rotate and revoke in the right order Handle exposed credentials as active access paths, not stale secrets, and remove the credential after confirming the dependent workload can recover without reintroducing the same key.
- Inventory keys by runtime use, not just existence Separate credentials that are still used by automation from those that are merely present in inventory, then retire anything that no longer has an accountable owner or valid business purpose.
Bottom line: Leaked AWS keys remain a governance problem because many are still active long after exposure and can continue to authenticate.
What's in the full announcement
Truffle Security's full post covers the operational detail this post intentionally leaves for the source:
- How TruffleHog AWS Analyze maps leaked AWS credentials to users, roles, and assumable permissions
- The operational difference between a secret that is exposed and a secret that is still active in AWS
- Examples of public code, container images, and datasets where leaked keys were verified
- How teams using multi-cloud environments can prioritise remediation across AWS, SaaS, and Google Cloud
👉 Read Truffle Security's analysis of leaked AWS keys and remediation context →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/10/2026 5:11 pm
Blast-radius visibility is now the real remediation control for leaked AWS keys: discovery alone does not tell a responder what the credential can reach. When a key can authenticate, assume roles, and inherit broad permissions, the security question shifts from "was it exposed" to "what did it unlock." That is the control gap Truffle Security's research makes visible, and it is why remediation order should follow effective access, not alert order.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should teams do when leaked credentials include full administrator access?
A: Treat them as high-priority compromise events, not routine secret hygiene tasks. Full administrator access means the credential can alter policies, create new access paths, or disable monitoring, so response should focus on containment, owner identification, and safe revocation before broader remediation continues.
👉 Read our full editorial: Leaked AWS keys expose blast radius faster than teams can trace