Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: Dynamic secrets, just-in-time access, and rotation can reduce credential exposure across initial access, persistence, privilege escalation, and exfiltration, according to Akeyless. The deeper issue is that standing credentials and secrets sprawl still create attacker entry points and re-entry paths that conventional control cadences struggle to close.
NHIMG editorial — based on content published by Akeyless: MITRE ATT&CK mapping for secrets management and credential defence
Questions worth separating out
Q: What breaks when secrets remain valid after exposure?
A: Reusable credentials turn a single leak into a persistence mechanism.
Q: Why do long-lived service account credentials increase attacker reach?
A: Because they let an attacker keep using the same trust object after initial access.
Q: How do security teams know whether key rotation is actually reducing risk?
A: Rotation is working when compromised or stale keys can no longer be used, the replacement process is documented, and revocation is measurable across the estate.
Practitioner guidance
- Inventory every credential path Map where passwords, API keys, tokens, certificates, and service-account secrets are created, stored, injected, and reused across pipelines and workloads.
- Replace standing secrets with dynamic issuance Use session-bound credentials for privileged and machine access so exposed values expire before they can be reused for persistence or escalation.
- Reduce secrets manager fragmentation Consolidate duplicated vaults and hidden secret stores so rotation, revocation, and audit coverage apply across the full credential estate.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Stage-by-stage examples of how dynamic secrets and rotation map to Initial Access, Persistence, and Privilege Escalation.
- The article's full chart of Akeyless features against MITRE ATT&CK tactics for implementation teams.
- Additional detail on the glossary items, including RBAC, zero-knowledge security, and machine identity management.
- The complete overview table that links each ATT&CK stage to a specific secrets-management control.
👉 Read Akeyless's MITRE ATT&CK mapping for secrets management and credential defence →
MITRE ATT&CK and secrets management: are your controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/09/2026 10:11 am
Standing credential persistence is the real control failure behind many ATT&CK-mapped identity incidents. The article correctly ties initial access, persistence, and privilege escalation to secrets management, but the deeper problem is that long-lived credentials remain valid after the moment of exposure. That makes identity a reusable attack surface rather than a controlled lifecycle. Practitioners should treat credential lifetime as an attack-path variable, not a housekeeping detail.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Should organisations prioritise JIT access before secrets rotation?
A: No, the two controls should be implemented together. JIT reduces the time a credential can be used, while rotation limits the value of any credential that is exposed. If one is present without the other, attackers still have too much room to act. The stronger programme combines both.
👉 Read our full editorial: MITRE ATT&CK mapping for secrets management shows where controls break
