Rotated Doesn't Mean Retired

A new secret was generated, the old one kept authenticating anyway.

Rotation exists to retire a credential on schedule and replace it with a fresh one, before anything has a chance to go stale or leak. The moment rotation happens, the old secret is supposed to stop being used.

Most of the time, that's exactly what happens. When it doesn't, the failure is easy to miss, because nothing about the old secret looks broken. It still authenticates, it still works. The only way to know it should have stopped working is comparing when it was used against when it was replaced, and that's not a comparison most tools are able to make on their own. Rotating a secret on schedule and everyone actually switching to it are two different events, and only one of them shows up in most audits.

This gets even harder to catch as agent and NHI identity counts climb. A rotation policy nobody's verifying isn't really a control, it's paperwork that happens to be true some of the time.

In the demo below, we show what that looks like in a live environment: a secret rotated on schedule, still being used minutes later on its previous version, how AuthMind catches the gap, and the automated workflow that responds the moment it does.

<iframe width="1053" height="592" src="https://www.youtube.com/embed/dbNuGn_rNjw" title="Detecting Previous Secret Versions Still in Use | AuthMind Secrets Security Demo" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>

If you're not sure whether a rotated secret in your own environment actually gets adopted, or just gets rotated, that's usually worth checking.