Both matter, but credential governance becomes urgent once attackers are already inside. If exposed credentials, default logins or backend secrets are present, patching alone may only slow the next attempt. The decisive question is whether a compromise can still pivot from one service into another without fresh authentication.
Why the First Decision Is About Blast Radius, Not Just Vulnerability Closure
The right order depends on whether the campaign created a live path for reuse, lateral movement, or persistence. If attackers already had valid access, the most important question is not only whether the flaw can be patched, but whether stolen credentials, sessions, API keys, or backend secrets can still reach other services before or after the fix.
That is why credential governance often becomes the first containment priority in an active intrusion. Patching removes one entry point, but it does not revoke trust that has already been abused. Where access can still be extended with the same secret or token, the compromise can survive the patch.
Useful context on secrets sprawl and rotation pressure is available in NHIMG’s Secrets Management Guide, which is directly relevant when exposed secrets are the mechanism that keeps a campaign alive.
When Patching Is the Faster Risk Reducer
Patching should be first when the issue is still primarily exposure, not confirmed credential compromise. If the vulnerable component is Internet-facing, remotely exploitable, and not yet tied to misuse of valid accounts, closing the flaw can be the fastest way to stop new compromise attempts.
This is especially true when the vulnerable service is the choke point for many users, or when the exploit path does not require an existing credential. In that case, the patch removes the attacker’s entry mechanism, while credential work can follow as a parallel hardening task rather than the first emergency action.
For teams managing API-style access paths, NHIMG’s API Key Management Guide is useful because it frames when exposed bearer credentials must be revoked, scoped, or replaced rather than merely monitored.
Why Credential Governance Usually Wins After an Intrusion
Once a campaign has reached internal systems, credential governance is usually the higher-value control because it changes what the attacker can still do right now. Rotate or revoke the secrets that can authenticate to production systems, invalidate sessions where feasible, and remove default or shared credentials that could be reused elsewhere.
The key judgment is whether authentication material can still pivot from one service into another without fresh approval. If the answer is yes, then the compromise is not fully contained even if the original vulnerability is patched. That is why long-lived secrets, weak scoping, and reused credentials create more operational danger than the original bug alone.
NHIMG’s Guide to NHI Rotation Challenges helps when the urgent work is less about the first secret and more about how to rotate at scale without breaking dependent systems.
Risk and Threat Considerations
When attackers are already inside, the main risk is not just reinfection, it is continued use of valid access paths. A patch may stop the original exploit, but it does not automatically remove tokens, passwords, keys, sessions, service credentials, or trust relationships that the attacker can still abuse.
Failure mechanism: The adversary keeps operating through reused or unrevoked credentials, or pivots into another service that still trusts the same authentication material. In other words, the exploited flaw closes, but the access chain remains intact.
Impact: The organisation can suffer follow-on data access, privilege escalation, persistence, or repeated re-entry even after remediation begins. The patch reduces exposure, but credential governance determines whether the incident is actually contained.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Exposed secrets are central to post-compromise containment. |
| NHI-07 — Long-Lived Secrets | Long-lived credentials extend attacker persistence after intrusion. | |
| Recommendation — Rotate and revoke leaked secrets before attackers can reuse them. Replace long-lived secrets with shorter-lived credentials and tighter expiry. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and revocation are key to stopping reused access. |
| Recommendation — Remove or reset compromised accounts and shared logins immediately. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential rotation and revocation are the core response to exposed auth material. |
| AC-2 — Account Management | Accounts and access paths must be disabled when compromise is suspected. | |
| Recommendation — Invalidate compromised authenticators and rotate secrets that enabled access. Disable or restrict compromised accounts until trust is re-established. | ||
Practitioner Guidance
What to prioritise: If you have evidence of valid credential use, rotate or revoke first for the identities, secrets, and sessions that can still authenticate to production or adjacent systems. Treat patching as urgent, but do not let it delay containment of active access paths.
What to verify: Confirm whether the exposed material is reusable, whether it is shared across environments, and whether it unlocks downstream services or admin functions. If the same secret can still move laterally, the incident is still open.
Decision rule: If the campaign involved stolen credentials, default logins, or backend secrets, credential governance takes precedence for containment. If the issue is a vulnerable edge service with no evidence of credential compromise, patching can lead.
Practitioner takeaway: The best first move is the one that removes the attacker’s current power, not just the original weakness. In an active campaign, that usually means cutting off trusted access paths before or alongside patching.
Related resources from NHI Mgmt Group
- Should organisations prioritise external exposure or internal credential governance first?
- Should organisations prioritise patching or identity hardening first after active exploitation is detected?
- Should organisations prioritise AI credential governance or prompt safety first?
- Should teams prioritise runtime patching or workload isolation first after runC vulnerabilities appear?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 21, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org