Time-to-Revoke: The Metric CISOs Need in the AI Exploit Era
Summary: GitGuardian's State of Secret Sprawl report found that 64% of valid secrets detected in 2022 were still active and exploitable four years later, and the 2026 CrowdStrike Global Threat Report puts average eCrime breakout time at 29 minutes, with the fastest at 27 seconds and 82% of detections malware-free. The 2024 Snowflake customer campaign saw Mandiant and Snowflake notify approximately 165 potentially exposed organizations whose credentials had in many cases not been rotated for up to four years, while nearly 29 million new hardcoded secrets were detected in public GitHub commits in 2025 and 28% of secrets-related incidents originated outside source code.
What's compelling: Finding a leaked secret can now take minutes, but safely revoking it often takes days because the person who leaked it rarely owns the service account and few organizations have a complete inventory of non-human identities. With breakout times down to 29 minutes and one intrusion exfiltrating data within four minutes of initial access, the gap between detection and revocation is where the damage happens.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026