Notifications
Clear all
Topic starter
25/06/2026 5:07 pm
TL;DR: Secrets rotation reduces the useful lifetime of passwords, API keys, and tokens, but Entro Security argues that automation, dual-secret cutovers, and centralized control are what make rotation workable at enterprise scale. The real issue is not changing secrets more often, but removing the trust assumptions that let static credentials linger and spread.
NHIMG editorial — based on content published by Entro Security: The art of secrets rotation - mastering automation and strategies
By the numbers:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
- 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits.
Questions worth separating out
Q: How should teams reduce risk from long-lived secrets in production systems?
A: Start by identifying every secret that can be reused across environments, applications, or teams.
Q: Why do duplicated secrets make rotation less effective?
A: Duplicated secrets create multiple valid copies of the same access path, so rotating one instance does not eliminate the others.
Q: When should organisations prioritise secret rotation over other NHI controls?
A: Prioritise rotation when a secret is exposed, shared across systems, or tied to a high-value workload that cannot tolerate persistent credentials.
Practitioner guidance
- Inventory every secret copy Build a single inventory for passwords, API keys, tokens, and certificates across vaults, code repositories, tickets, and collaboration tools.
- Automate dual-secret handovers Use automation to create a new secret, verify downstream updates, and only then disable the old one.
- Treat offboarding as revocation first When an employee, contractor, or vendor relationship ends, revoke associated tokens and service access before you close the administrative record.
What's in the full article
Entro Security's full blog covers the operational detail this post intentionally leaves for the source:
- Automation flow for generating, distributing, and retiring secrets without manual handoff errors
- Dual-secret rotation sequence details for avoiding downtime during production cutovers
- Centralised secrets control plane guidance for tracking multiple vaults and usage patterns
- Practical lifecycle controls for identifying and deactivating old credentials after rotation
👉 Read Entro Security's analysis of secrets rotation and automation strategies →
Secrets rotation and static credentials: is your governance keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 5:37 pm
Secrets rotation is not a hygiene task. It is a control over credential lifespan. The article is really about whether organisations can make credentials temporary enough to be governable. When secrets are duplicated, shared, or left active after offboarding, the control stops being about rotation frequency and starts being about whether the credential ever truly dies. The practitioner conclusion is simple: treat secret retirement as part of identity governance, not a back-end maintenance job.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- A separate finding shows that 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits.
A question worth separating out:
Q: What frameworks help teams govern secrets and workload credentials?
A: OWASP Non-Human Identity Top 10 and NIST Cybersecurity Framework are both relevant because they connect credential lifecycle, access control, and operational governance. For teams managing distributed vaults, the key is to align rotation with ownership, inventory, and revocation rather than treating it as an isolated maintenance task.
👉 Read our full editorial: Secrets rotation exposes the governance gap behind static credentials
