A credential can be exposed in seconds. Retiring it safely can take far longer.
That is because revocation is not a button. It is a control loop. A team needs an accountable owner, a usable view of dependencies, a replacement path, and evidence that the old access path is closed. Remove any one of those conditions and a credential may be discovered, rotated, or reported—but it is not reliably revocable.
Detection finds the string. Control retires the access.
GitGuardian’s 2026 *State of Secrets Sprawl* release reports that 64% of valid secrets from 2022 remained unrevoked in 2026. GitGuardian is a vendor of secrets and non-human-identity security products, so that figure is a vendor-reported finding rather than a population-wide claim. The useful question is still structural: can the organisation prove that an old credential no longer opens anything?
Scanning answers where a credential appeared. It does not determine who may accept the disruption of changing it, which workload will fail first, how the replacement reaches that workload, or what evidence closes the change.
The four-question control loop
Who owns it now?
Not who created the credential. The accountable service owner who can decide to rotate it and accept the operational change.
What breaks when it changes?
A dependency map does not need to be perfect. It needs to identify the workload, the first observable failure signal, and the team that can see it.
What replaces it?
Rotation only reduces exposure when the new path is designed: narrower authority where possible, a deliberate handoff, and no rollback that quietly preserves both secrets.
How do we prove the old path is closed?
“Rotated” is an activity. A failed authentication attempt for the retired credential alongside a healthy replacement path is a control result.
What to govern
Do not begin with the loudest finding. Begin where the loop is incomplete: unclear ownership, wide dependencies, weak expiry, or no practical proof of closure. Those are distinct operating conditions, so they require different interventions.
A security function should set the policy. Service teams should execute the rotation with a repeatable owner record, tested replacement path, and verifiable closure check. Central policy. Local execution. Clear evidence.
The practical test is simple. Choose one credential that matters this week and ask the four questions. The answer tells you whether you have secret detection—or credential control.
Source and method
SRC-01: GitGuardian, *State of Secrets Sprawl 2026 release*, 17 March 2026. Vendor research; used here only for the publisher’s reported finding, with its self-interest disclosed. <https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/>
Method: This companion article turns the episode’s systems argument into a portable diagnostic. It does not make a claim about any named organisation’s security posture.