What do security teams get wrong about manual key rotation?

Why This Matters for Security Teams

Manual key rotation is often treated as a hygiene task, but for NHIs it is really a control over exposure windows, blast radius, and ownership drift. Once secrets are copied into tickets, chat, wikis, and code, the rotation problem stops being a calendar reminder and becomes a lifecycle failure. That is why Astrix Security & CSA research on NHI security matters: 45% of organisations cite lack of credential rotation as the top cause of NHI-related attacks. It is not that teams do not know rotation is important. It is that they underestimate how quickly manual processes break when identities multiply, services never sleep, and ownership is unclear. Security teams also miss the fact that manual rotation does not fix secrets sprawl by itself. If the same token is embedded in multiple tools or reused by several applications, rotating one copy leaves the others active. Current guidance from OWASP Non-Human Identity Top 10 aligns with this view: secret handling, rotation, and lifecycle control must be treated together, not as isolated tasks. In practice, many security teams discover their rotation gaps only after a token has already been exposed or overused, rather than through intentional governance. Guide to the Secret Sprawl Challenge helps explain why.

How It Works in Practice

Effective rotation starts by deciding where the secret lives, who owns it, how long it should exist, and what breaks when it changes. Manual rotation usually fails because each of those steps depends on people remembering to update downstream systems in the right order. A better model is lifecycle management: issue, use, monitor, revoke, replace, and verify. That means tracking the secret as a governed asset, not as an isolated value. The NHI Lifecycle Management Guide and Guide to NHI Rotation Challenges both point to the same operational reality: rotation succeeds when it is wired into provisioning, vaulting, deployment, and revocation workflows. Practitioners usually need four controls working together:

• short TTLs so credentials expire before they become persistent risk
• automated revocation so old credentials stop working when replaced
• dependency mapping so every consumer is updated during rotation
• ownership and approval paths so no token is left to tribal knowledge

This is also where static versus dynamic secrets matters. If a workload can receive ephemeral credentials on demand, there is less to rotate manually in the first place. The Ultimate Guide to NHIs — Static vs Dynamic Secrets is useful here, especially when paired with the OWASP guidance on secret exposure paths. Manual rotation breaks down when secrets are hardcoded into legacy apps, copied across many vaults, or shared by multiple services because the replacement chain becomes too brittle to execute reliably.

Common Variations and Edge Cases

Tighter rotation often increases operational overhead, so organisations have to balance lower exposure against higher coordination cost. Best practice is evolving here, especially for mixed environments where some workloads can use dynamic secrets and others still depend on static credentials. The practical compromise is to prioritise the secrets with the highest blast radius first: production api key, shared service accounts, and tokens that have already appeared outside approved storage. Top 10 NHI Issues is a useful reference for that triage. There are also edge cases where rotation alone does not solve the underlying problem. If an application cannot tolerate frequent secret replacement, the real fix may be workload identity, JIT credential provisioning, or a redesign that removes the secret from the workflow entirely. That is why guidance from Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs should be read alongside the Schneider Electric credentials breach case context. The lesson is not simply “rotate faster.” It is that manual rotation is a fragile control in environments with shared secrets, parallel deployments, and multiple downstream consumers. These controls tend to break down in fast-moving CI/CD pipelines because secret updates and application releases are rarely coordinated end to end.

Related resources from NHI Mgmt Group

• What do security teams get wrong about secret rotation?
• What do security teams get wrong about session tokens and MFA?
• What do teams get wrong about AI security and access management?
• What do security teams get wrong about OAuth and connected apps?