When those controls are missing, a lost device, shared note, or compromised temporary password can become a direct path into user accounts and connected applications. That increases the chance of unauthorised access, audit findings, and avoidable help desk burden. It also leaves organisations unable to prove they enforce basic credential hygiene across the user lifecycle.
Why Skipping Rotation Turns Temporary Credentials Into Persistent Access
When end users are allowed to keep the same password indefinitely, a temporary credential can outlive the purpose for which it was issued. That creates a bigger blast radius than many teams expect, because the credential can survive device loss, note leakage, mailbox compromise, or a reused shared secret long after the original event.
It also weakens the organisation’s ability to distinguish a legitimate first login from a credential that has already been exposed. A control that is supposed to narrow exposure ends up behaving like long-term access, especially when users reuse the same password across connected applications or delay changing it after first sign-in.
That is why lifecycle discipline matters alongside password quality. Lifecycle processes for managing identities are only effective when credential change is treated as part of the identity handoff, not as an optional follow-up task.
Why First-Use Change Controls Matter for User Onboarding
First-use change controls reduce the chance that an initial password becomes a standing secret. They force the user to replace a temporary or centrally issued credential before normal use begins, which is especially important when passwords are distributed by help desk, onboarding mail, or any other channel that can be copied, forwarded, or observed.
Without that step, the organisation has no clear boundary between account provisioning and account activation. The result is a wider attack window, because anyone who sees or intercepts the first password can often use it before the real user has a chance to secure the account. This is one reason first-use change belongs in the same conversation as password hygiene and shared-account reduction. Password security and password manager guidance helps teams see how rotation, password reuse, and shared passwords interact in practice.
For organisations that also manage machine or service credentials, the same pattern appears in a different form: a secret that never changes quickly becomes a recovery problem. Rotation challenges for non-human identities illustrate why stale credentials are dangerous even when they were originally issued for convenience.
What Breaks Operationally When These Controls Are Missing
The immediate failure is access exposure, but the operational damage is broader. If a password is handed out and never changed, help desk teams become the de facto control for credential lifecycle exceptions, and security teams lose confidence that first login marks a clean handoff to the end user.
Auditors also tend to view the gap as a sign that basic identity hygiene is not being enforced consistently. That can complicate access reviews, exception handling, and evidence collection, because the organisation may be unable to prove that temporary credentials are actually temporary. In environments with shared notes, remote onboarding, or rapid joining and transferring, the control gap scales quickly and becomes easy to overlook.
At that point, the issue is not just password policy. It is proof of control. A system that cannot show first-use change enforcement can also struggle to show timely deprovisioning, revocation, and account ownership discipline. Top 10 NHI Issues is useful here because it frames rotation, ownership, and stale access as lifecycle problems rather than isolated credential events.
Risk and Threat Considerations
Missing rotation and first-use change controls increase the odds that a password becomes a durable attack path. The risk is highest when a temporary credential is exposed through a lost device, a forwarded message, a shared note, or a support workflow that reveals the initial secret to more than one person.
Failure mechanism: An attacker, or even an unintended recipient, can use a still-valid initial password to access the account before the user changes it, then pivot into connected applications or reset flows that trust the same identity.
Impact: The result can be unauthorised access, account takeover, audit findings, and a wider incident response burden because the organisation must treat the credential as compromised rather than merely outdated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers password lifecycle, rotation, and expiry for user authenticators. |
| IA-2 — Identification and Authentication (Organizational Users) | User password controls are part of authenticating organizational users. | |
| Recommendation — Enforce IA-5 to require first-use change and timely rotation of user passwords. Apply IA-2 to ensure user authentication begins with controlled enrollment and activation. | ||
| ISO/IEC 27001:2022 | A.5.17 — Authentication information | Requires secure handling of authentication information such as passwords and temporary secrets. |
| Recommendation — Protect authentication information so temporary passwords are changed before normal use. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle controls include onboarding, credential activation, and access removal. |
| Recommendation — Use account management controls to enforce first-login password changes and expiry. | ||
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | A temporary password that is not changed becomes a long-lived secret. |
| Recommendation — Reduce long-lived secret exposure by forcing first-use password changes and rotation. | ||
Practitioner Guidance
What to verify: Confirm that every newly issued end-user password has a forced change at first use, and that temporary credentials expire if the user does not activate the account within a defined window. If the process depends on a help desk exception, require a documented reason and a visible expiry date.
What good looks like: The initial password is never treated as a working password, shared setup channels are minimised, and support staff can evidence when the user completed the first change. That makes the onboarding event auditable and reduces the chance that a forgotten temporary secret becomes standing access.
Practitioner takeaway: Treat first-use change as a control that closes the onboarding window, not as a convenience feature. If a password can survive past initial access, it can usually survive into compromise.
Related resources from NHI Mgmt Group
- Should organisations prioritise secrets rotation or policy controls first for agents?
- How should organisations decide where to use continuous controls monitoring first?
- What should organisations prioritise first: expanding agentic AI use or strengthening data security controls?
- Should organisations use continuous monitoring or stronger password complexity first?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
