{
 "slug": "revocation-latency-framework",
 "topic_id": "TOPIC-209",
 "cluster": "Machine, Agent & Signing Identity",
 "tier": "Tier A",
 "title": "Ninety-one percent of leaked secrets still work five days later",
 "summary": "Security programmes measure rotation cadence. Attackers measure time-to-exploit, which is minutes. The gap between exposure and revocation is where every credential-driven breach lives, and almost nobody measures it.",
 "lede": "Rotation is a schedule. Revocation is an event. Programmes report the first and experience losses determined by the second, and the two are not related in the way the reporting implies.",
 "date": "2025-11-13",
 "category": "Developer",
 "author_id": "desmond-okafor-hale",
 "tags": [
  "secrets management",
  "revocation",
  "credential rotation",
  "secrets sprawl",
  "incident response",
  "metrics"
 ],
 "image_title": "Revocation Latency Framework",
 "schema": "Article",
 "key_takeaways": [
  "2026 secrets research reported that the overwhelming majority of leaked credentials remained valid days after exposure, and that only about a fifth of organisations have a formal process for revoking machine credentials at offboarding.",
  "Rotation cadence is a hygiene metric. Revocation latency is the metric that determines loss, and it is almost never instrumented.",
  "Four tiers of target latency, and a migration path from long-lived secrets to short-lived bounded delegations."
 ],
 "body": [
  {
   "type": "h2",
   "text": "The two clocks"
  },
  {
   "type": "diagram",
   "kind": "chain",
   "alt": "Two clocks, measured by different parties",
   "caption": "One is measured in days and reported. The other is measured in minutes and not.",
   "nodes": [
    {
     "label": "Secret exposed",
     "sub": "commit, log, paste",
     "note": "t=0"
    },
    {
     "label": "Attacker exploits",
     "sub": "automated scanning",
     "note": "minutes",
     "bad": true
    },
    {
     "label": "Exposure detected",
     "sub": "scanning or report",
     "note": "hours to days",
     "bad": true
    },
    {
     "label": "Revocation effective",
     "sub": "everywhere",
     "note": "the metric nobody has",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "There are two clocks running after a credential leaks and only one of them is on your dashboard."
  },
  {
   "type": "p",
   "html": "The first is your rotation clock: every ninety days, every thirty days, whatever the policy says. It is scheduled, reportable, and entirely unrelated to when the leak happened."
  },
  {
   "type": "p",
   "html": "The second is the attacker's clock, which starts when the credential reaches them and runs until the credential stops working. Automated scanning of public repositories means the first minutes matter, and exploitation frequently precedes discovery."
  },
  {
   "type": "h2",
   "text": "What the 2026 research found"
  },
  {
   "type": "p",
   "html": "The 2026 State of Secrets Sprawl reported tens of millions of leaked credentials, with secrets associated with AI services growing sharply year over year. Related 2026 analysis reported that only around a fifth of organisations have a formal process for offboarding and revoking API keys, and that the overwhelming majority of exposed secrets remained valid days after exposure."
  },
  {
   "type": "p",
   "html": "Read the second finding as an operational statement rather than a statistic. It means that for most organisations, leak detection is not connected to revocation by any process, and the gap is filled by someone noticing."
  },
  {
   "type": "h2",
   "text": "The Revocation Latency Framework"
  },
  {
   "type": "p",
   "html": "Define the metric precisely, because ambiguity here produces flattering numbers."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">Revocation latency</strong> is the interval from the moment a credential becomes available to an unauthorised party to the moment it can no longer be used. Not the moment you rotated it. Not the moment you detected it. The moment it stopped working."
  },
  {
   "type": "table",
   "caption": "Four tiers. Assign each credential class to one and instrument accordingly.",
   "head": [
    "Tier",
    "Target latency",
    "Achieved by"
   ],
   "rows": [
    [
     "T1",
     "Under 60 seconds",
     "Short-lived credentials with automatic expiry; revocation is not required because validity is minutes"
    ],
    [
     "T2",
     "Under 1 hour",
     "Central revocation with propagation, exercised regularly"
    ],
    [
     "T3",
     "Under 24 hours",
     "Manual revocation with a known runbook and a maintained dependency map"
    ],
    [
     "T4",
     "Unbounded",
     "Long-lived static secrets with no dependency map — the current default"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Most estates are T4 for the majority of credentials and do not know it, because the question has never been asked in this form."
  },
  {
   "type": "h2",
   "text": "Instrumenting it"
  },
  {
   "type": "p",
   "html": "You cannot measure the true start time, because you do not know when a credential reached an attacker. Use a defensible proxy and be explicit about it."
  },
  {
   "type": "ol",
   "items": [
    "<strong style=\"font-weight:600\">Proxy start:</strong> the earliest evidence of exposure — commit timestamp for a committed secret, log timestamp for an exposure event.",
    "<strong style=\"font-weight:600\">End:</strong> verified ineffectiveness, tested rather than assumed. Attempt to use the credential and confirm failure.",
    "<strong style=\"font-weight:600\">Report:</strong> the distribution, by credential class, with the proxy stated.",
    "<strong style=\"font-weight:600\">Exercise:</strong> run a revocation drill quarterly on a non-incident credential and measure. Real incidents are too rare and too chaotic to produce a reliable series."
   ]
  },
  {
   "type": "p",
   "html": "Step four is where most of the value is. An organisation that has never rehearsed revocation discovers during a drill that revoking a credential breaks four services nobody documented — which is exactly what it would discover during an incident, at greater cost."
  },
  {
   "type": "h2",
   "text": "Why the dependency map is the real work"
  },
  {
   "type": "p",
   "html": "Revocation is slow not because the API call is slow but because nobody knows what will break. A credential with unknown consumers is one that a responder hesitates to revoke at 3am, and hesitation is the latency."
  },
  {
   "type": "p",
   "html": "That is why accountable ownership and revocation latency are the same programme viewed from two angles. An identity with a named owner who can be asked <em>what breaks if we kill this</em> has a dramatically shorter revocation latency than one without."
  },
  {
   "type": "h2",
   "text": "The migration that removes the metric"
  },
  {
   "type": "p",
   "html": "The strongest position is one where revocation latency is structurally bounded because credentials expire on their own."
  },
  {
   "type": "p",
   "html": "Short-lived credentials issued under a delegation with an explicit expiry make T1 the default: a leaked credential is useless within minutes regardless of whether anyone noticed. That does not eliminate the need for revocation — the delegation itself must be revocable — but it moves the bulk of the estate out of the unbounded tier."
  },
  {
   "type": "h2",
   "text": "Four latencies worth measuring"
  },
  {
   "type": "table",
   "caption": "Decompose the gap",
   "head": [
    "Latency",
    "Typical",
    "Improvable by"
   ],
   "rows": [
    [
     "Exposure to detection",
     "Hours to days",
     "Scanning at push, not at scan time"
    ],
    [
     "Detection to decision",
     "Minutes to hours",
     "A clear owner and playbook"
    ],
    [
     "Decision to revocation issued",
     "Minutes",
     "Automation"
    ],
    [
     "<strong style=\"font-weight:600\">Revocation issued to effective</strong>",
     "<strong style=\"font-weight:600\">Unknown in most estates</strong>",
     "<strong style=\"font-weight:600\">Checking at the point of effect</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The fourth is the one that surprises people. A revoked credential can remain usable for as long as a cached token, a running process or a poll interval says it is, and most organisations have never measured how long that actually is."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“We rotate every ninety days.”</strong> Which bounds how long a secret exists, not how long a leaked one works. Those are different numbers and only the second matters during an incident."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Revocation is instant in our identity provider.”</strong> The record changes instantly. Whether every consumer notices depends on cache TTLs, token lifetimes and poll intervals. Measure it rather than assuming it."
  }
 ],
 "faq": [
  {
   "q": "Is rotation cadence useless?",
   "a": "No. It bounds the lifetime of a credential that leaked without detection, which is real value. It simply does not measure the thing that determines loss when a leak is known."
  },
  {
   "q": "How do we measure the start time honestly?",
   "a": "Use a documented proxy — commit timestamp, log timestamp — and state it. An unstated proxy makes the metric unfalsifiable."
  },
  {
   "q": "What if revocation breaks production?",
   "a": "That is the finding. A credential you cannot revoke without an outage is a credential with unbounded latency, and the dependency map is the remediation."
  },
  {
   "q": "Do short-lived credentials remove the need for this?",
   "a": "They bound it structurally for the credentials they cover. The delegations issuing them still need revocation, so the metric survives at a different layer."
  },
  {
   "q": "Isn't rotation cadence the right metric?",
   "a": "It bounds how long a secret exists, not how long a leaked one works. Only the second matters during an incident."
  },
  {
   "q": "Why measure revocation-to-effective?",
   "a": "Because a revoked credential can keep working for as long as a cached token or poll interval permits, and most estates have never measured it."
  },
  {
   "q": "How do you measure it?",
   "a": "Revoke a test credential and time how long until it actually stops working everywhere."
  }
 ],
 "sources": [
  {
   "t": "OWASP Secrets Management Cheat Sheet",
   "u": "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
  },
  {
   "t": "Federal Reserve — Fedwire Funds Service",
   "u": "https://www.frbservices.org/financial-services/wires"
  },
  {
   "t": "CISA — known exploited vulnerabilities and incident reporting",
   "u": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
  },
  {
   "t": "Cloud provider documentation on short-lived credential issuance."
  },
  {
   "t": "OWASP — Non-Human Identities Top 10",
   "u": "https://owasp.org/www-project-non-human-identities-top-10/"
  },
  {
   "t": "NIST SP 800-57 Part 1 Rev. 5 — key management",
   "u": "https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final"
  }
 ],
 "related": [
  {
   "slug": "accountable-ownership-test",
   "title": "Eighty machine identities per human",
   "category": "Developer"
  },
  {
   "slug": "creator-binding-offboarding",
   "title": "The engineer left; the integration did not",
   "category": "Developer"
  },
  {
   "slug": "federation-authority-analysis",
   "title": "Workload identity federation",
   "category": "Developer"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Revocation%20Latency%20Framework/1500_900/blog.jpg",
 "wordcount": 1000,
 "url": "/blog/revocation-latency-framework.html",
 "reading_time": "4 min read",
 "seo_title": "Leaked secrets still work five days later",
 "meta_description": "Security programmes measure rotation cadence. Attackers measure time-to-exploit, which is minutes. The gap is where credential incidents live.",
 "hub": {
  "slug": "topics/machine-identity",
  "title": "Machine and signing identity"
 },
 "answer": "Long enough that rotation cadence is the wrong metric. Security programmes measure how often they rotate; attackers measure time-to-exploit, which is minutes. The gap between exposure and effective revocation is where every credential incident lives, and almost nobody measures it.",
 "answer_q": "How long does a leaked secret stay usable?",
 "glossary": [
  {
   "term": "Time-to-exploit",
   "def": "How quickly an exposed secret is used, driven by automated scanning of public sources."
  },
  {
   "term": "Revocation latency",
   "def": "The interval between issuing a revocation and it taking effect everywhere."
  },
  {
   "term": "Cache TTL",
   "def": "How long a consumer holds a decision before re-checking — frequently the real floor on revocation latency."
  }
 ],
 "checklist": {
  "title": "Measuring revocation latency",
  "id": "latency",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Revoke a test credential and time it.",
    "text": "Until it actually stops working, everywhere."
   },
   {
    "name": "Measure each of the four latencies separately.",
    "text": "They have different fixes."
   },
   {
    "name": "Check revocation at the point of effect.",
    "text": "Not at a gateway that in-flight work has passed."
   },
   {
    "name": "Report the end-to-end number.",
    "text": "It is the one that describes your exposure."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav anchors every machine and agent identity to a named human through a signed delegation with scope, expiry and enforced revocation — so the chain from an action to a person survives the identity outliving its creator.",
  "href": "../docs.html",
  "label": "See delegation chains"
 }
}