# Credential Rotation Does Not Achieve Revocation

- **Artifact ID:** CHQ-SM-2026-016
- **Canonical source ID:** CHQ-ANRM-2026-013
- **Version:** v1.0
- **Status:** ISSUED
- **Public record:** https://record.cybersecurityhq.com/memoranda/chq-sm-2026-016
- **Machine-record SHA-256:** `7887218c047b7ed1192de69ae10c7e443be44a2b20995b79646f3c9989d63d4b`

## Complete structured record

```json
{
  "id": "CHQ-ANRM-2026-013",
  "aliases": [
    "CHQ-SM-2026-016"
  ],
  "title": "Credential Rotation Does Not Achieve Revocation",
  "descriptor": "Credential Rotation Does Not Achieve Revocation",
  "issued": "2026-07-24",
  "prepared": "2026-06-09",
  "classification": "Analytical Research / Non-Advisory",
  "status": "ISSUED",
  "version": "v1.0",
  "memo_type": "ANRM",
  "authority_level": "ANALYTICAL",
  "referenced_by": [
    "CHQ-SM-2026-020"
  ],
  "inherits_from": "CHQ-ANRM-2026-005",
  "related_artifacts": [
    "CHQ-SM-2026-007",
    "CHQ-SM-2026-013",
    "CHQ-SM-2026-014"
  ],
  "citable_assertion": "Credential rotation changes a credential. It does not end the access relationship the credential established. When a compromise creates access that is not fully enumerated, rotating the visible credentials closes one door while the access relationship persists, and an incident treated as closed at rotation may remain open at the access layer. Credential secrecy determines whether a credential is stolen; credential lifetime determines how long the theft remains useful, and lifetime is becoming a consequential control in its own right.",
  "purpose": "",
  "statement": "Credential rotation and access revocation are treated as the same remediation step. They are not. Rotation changes a credential. Revocation ends an access relationship. When a compromise creates an access relationship that is not fully enumerated, rotating the visible credentials closes one door while the access relationship persists.\n\nThe standard remediation sequence after a credential compromise is contain, rotate, confirm, close. The sequence assumes that rotating the exposed credentials severs the attacker's access. That assumption holds only when the credential and the access are the same thing, and when the full set of access relationships established during the compromise is known. Neither holds reliably. An attacker who establishes access during a compromise can create additional access relationships that do not depend on the original credential. The rotated credential may be gone. The access may not be.\n\nThe condition is compounded by credential persistence in time. A credential harvested and held in adversarial infrastructure separates the moment of theft from the moment of use. The harvest, the dwell, and the eventual use are distinct events on the attacker's schedule, and they can be weeks apart. A remediation process calibrated to respond to a known, recent exposure does not address a credential taken weeks earlier and held until the response has concluded.\n\nUnderneath both is the longevity of the credential. A credential that remains valid long after the context that issued it has ended is a durable asset the attacker can hold, move, and reuse. Credential secrecy remains essential. What the evidence shows is that the length of time a credential remains valid is becoming a consequential control in its own right, because lifetime determines how long a theft remains useful regardless of whether the theft was ever detected.",
  "observability": "",
  "boundary": "",
  "reliance_language": "",
  "reliance_boundary": "",
  "revision_history": "v1.0 (prepared June 2026; issued July 24, 2026): Two prerequisite checks resolved at issuance. (1) Distinctness confirmed against CHQ-P-2026-007 (Certificate Lifetime Compression Does Not Alter Hardware Trust Architecture): P-007 is an architectural claim about hardware trust; this memorandum is a remediation-semantics claim about access relationships and exposure windows. The claims operate at different layers and are complementary, not duplicative. Distinctness from CHQ-P-2026-013 also confirmed: containment-scope versus remediation-semantics. (2) No underlying position is referenced by this memorandum; the dependency is null. July 2026 corroboration appended to Context at issuance.",
  "scope": "This memorandum defines a structural condition affecting incident remediation in enterprise environments. It addresses the relationship between credential rotation, the standard remediation response to a credential compromise, and the access relationship the compromised credential established.\n\nIt does not evaluate specific identity or credential-management products, recommend IAM or certificate architecture, or assess whether any organization's incident response process is adequate.",
  "context": "Two operations in this intake window documented the condition directly, and a third documented the enabling supply-side condition.\n\nThe Azure Durable Task ecosystem demonstrated the condition through recompromise. The repository at the root of a May 2026 supply chain compromise was the hub of a June 2026 supply chain campaign that reached 73 repositories across four organizations. The repository that was the origin of the first compromise was the center of the second. The most economical explanation is that the access established in May was never fully severed, and that the credentials held during the first compromise persisted through the rotation that was presumed to have closed it.\n\nA vendor namespace compromise demonstrated the persistence-in-time component. A developer account credential was harvested by an infostealer in mid-April 2026 and was not used to compromise packages until June, six to seven weeks later. The credential persisted in adversarial infrastructure across that interval. The attack did not begin when the packages changed. It began when the credential was taken and held, and by the time the compromise was visible the access had been in place for weeks.\n\nA credential theft worm spreading across exposed cloud infrastructure documented the enabling supply-side condition rather than the same mechanism. The worm harvested credentials from environment files, configuration stores, and metadata services, where the credentials were sitting with no expiry to limit their value. This does not demonstrate access surviving remediation. It demonstrates the condition that makes such survival possible: credentials persisting where they can be harvested and held indefinitely.\n\nThree further instances accumulated between preparation and issuance, each documenting the condition independently. A July compromise of multiple official npm packages proceeded through several publishing pipelines and several OIDC publishing identities in parallel; rotating any one identity would have left the others operative, because the campaign's access did not depend on any single credential. A securities filing the same month documented a corporate data plane exfiltrated through a third-party integration's standing API authority, access granted once and never re-verified, where no customer-side credential rotation would have touched the integration's delegated grant. And a cross-tenant compromise of an AI orchestration platform monetized credentials embedded in stored workflows, where the theft-to-use window, not credential secrecy, determined the blast radius.",
  "governance_condition": "Three organizational behaviors are invalidated by the evidence.\n\nFirst, that credential rotation completes incident remediation. Rotation changes the credential that was exposed. It does not enumerate and sever the access relationships established during the compromise. A remediation process that ends at rotation has addressed the credential and may have left the access in place.\n\nSecond, that an incident is closed once the exposed credentials are rotated. The Durable Task recompromise shows the access relationship surviving the rotation and being exploited weeks later. An incident treated as closed at the credential layer may remain open at the access layer, and the interval between the two compromises is not evidence that the first was resolved.\n\nThird, that credential secrecy is the variable that determines exposure. Secrecy determines whether a credential is stolen. It does not determine how long the theft remains useful. The documented operations were effective because the credentials remained valid long after they were taken, which is a function of lifetime, not secrecy. Lifetime is becoming a consequential control alongside secrecy, not a replacement for it.",
  "analytical_observations": [
    "Rotation and revocation are distinct actions treated as one. Rotation changes a credential. Revocation ends an access relationship. A remediation process that performs the first and records the second is recording an outcome it has not necessarily achieved.",
    "A credential harvested and held separates the theft from the use by weeks. Incident response calibrated to a recent, known exposure structurally cannot address a credential taken earlier and held until the response concludes. The dwell time is the part the process does not see.",
    "A credential that outlives the context it was issued for is a durable asset. The longer the validity window, the longer a single theft remains exploitable, and the wider the interval over which the harvest and the use can be separated.",
    "Short-lived credentials bound to the workload or device that uses them limit the reuse window independent of detection. A credential that has expired by the time of attempted reuse cannot be reused, which removes the dwell-and-reuse pattern regardless of whether the original theft was ever noticed. This is the one structural mitigation that does not depend on the defender having detected the compromise."
  ],
  "exclusions": [
    "Specific identity, credential-management, or certificate products, or product comparisons",
    "Recommendations for specific IAM, PKI, or secrets-management architecture",
    "Whether any specific organization's incident response or credential-lifecycle process is adequate",
    "Coordinated vulnerability disclosure timelines",
    "Attribution of specific operations to specific actor clusters beyond what publicly disclosed evidence supports"
  ]
}
```