Work out rotation window risk as exposure days over rotation period, plus manual rotation effort, storage cost and a recommended period.
Rotation caps the damage window at the rotation period, and detection caps it at the detection time, so the real exposure is whichever is shorter. The ratio between them tells you which control is doing the work: below 1 you find leaks before rotation would have helped, at or above 1 you are relying entirely on the calendar. A ninety-day rotation period sounds diligent until you notice that credentials leak to public repositories in minutes and are used within hours — the period only bounds the tail, and the recommended figure here is half the detection window so a leaked secret expires before it is worth selling.
Secrets Rotation
Rotation window risk ratio = days a leaked secret goes undetected ÷ rotation period. A ratio of 1 or more means rotation, not detection, is what ends the exposure.
Risk scoring
Risk score = 30 × min(2, ratio) + 0.3 × (100 − automatic rotation coverage) + min(40, 0.5 × effective window days), where the effective window is min(exposure days, rotation period).
Rotation window risk ratio = days a leaked secret goes undetected ÷ rotation period. A ratio of 1 or more means rotation, not detection, is what ends the exposure. Rotation caps the damage window at the rotation period, and detection caps it at the detection time, so the real exposure is whichever is shorter. The ratio between them tells you which control is doing the work: below 1 you find leaks before rotation would have helped, at or above 1 you are relying entirely on the calendar.
A ninety-day rotation period sounds diligent until you notice that credentials leak to public repositories in minutes and are used within hours — the period only bounds the tail, and the recommended figure here is half the detection window so a leaked secret expires before it is worth selling.
This calculator takes 8 inputs: Secrets under management, Rotation period, Days a leaked secret goes undetected, Secrets on automatic rotation, Engineer time per manual rotation, Engineer hourly cost, Secret storage price, Failed rotations per year. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No — it trades one risk for another. Every rotation is a chance of an outage, and a team that gets paged by rotation failures will quietly widen the period or disable it. Fix the failure rate first, automate second, then shorten. A reliable 30-day rotation beats an aspirational 7-day one that is switched off.
Where you can, yes. An IAM role with 15-minute credentials or an OIDC-federated workload token has no rotation problem because there is nothing long-lived to rotate. Reserve stored secrets for the cases that genuinely cannot federate, such as third-party API keys and legacy database users.