Topic starter
14/07/2026 4:23 pm
TL;DR: Only 7 of 20 credential configurations across 19 major platforms expire by default, 5 are documented to never expire, and 8 have no documented default expiration at all, according to Identra.ai. Default lifetime is still a governance control point, not a convenience setting, because credential persistence shapes blast radius and accountability.
Editorial analysis by NHI Mgmt Group, based on content published by Identra.ai: “Keys That Never Die: We Audited 20 Credential Configurations Across 19 Major Platforms”.
Key questions
Q: What breaks when a platform still relies on default credentials?
A: Default credentials destroy the trust boundary before any deeper control can help.
Q: Why do forever keys increase IAM and NHI risk?
A: Because they outlive the assumption that access will be periodically re-justified.
Q: What do security teams get wrong about token expiration in JWT authentication?
A: Teams often assume that short expiration alone solves token risk.
Practitioner guidance
- Inventory every credential class with no stated default expiry Separate confirmed forever keys from credentials whose documentation is silent on lifetime, then assign an owner, business purpose, and review cadence to each one.
- Enforce maximum lifetime wherever the platform allows it Use org-level or authentication-policy controls to cap credential duration, and remove or restrict token types that cannot be bounded centrally.
- Prefer short-lived credential types over legacy long-lived ones Choose the newer credential format when a vendor offers both, because the newer type is more likely to carry an enforced expiry and a clearer lifecycle boundary.
Bottom line: The core problem is not just long-lived credentials, but platform designs that make lifetime optional, undocumented, or fully manual.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:31 pm
Credential lifetime is an identity governance control, not a platform preference: The audit shows that default expiry is still inconsistent across major credential types, which means lifecycle governance remains uneven by design. That matters because a credential that persists without review becomes standing authority, and standing authority is the condition identity programmes are supposed to eliminate. Practitioners should treat expiry policy as part of identity architecture, not as a usability option.
A question worth separating out:
Q: Should organisations prioritise short-lived credentials over legacy tokens?
A: Yes, when the platform supports both. Short-lived credentials reduce the duration of misuse and force periodic re-validation, while legacy long-lived tokens tend to persist until someone notices them. The right sequencing is to shrink standing access first, then tighten review and revocation around whatever remains.
👉 Read our full editorial: Forever keys still dominate across major credential platforms