> In the 2025 report, we showed that nearly 70% of credentials confirmed as valid in 2022 were still valid as of January 2025, meaning they have not been rotated or otherwise remediated. When we retested the same dataset in January 2026, the validity rate remained over 64%. That persistence is not a rounding error. It is an operational signal that remediation, not detection, is still the industry’s limiting factor.
> In the end there is always some long lived secret. What changes is just where and how it is stored, secured and used.
Obviously. The point here is to reduce the number of them
Don't get me wrong but data shows that you will likely fail to keep that api key a as secret and you will also fail to revoke when it becomes necessary. You will definately not going to rotate it frequently as you should.
Good thing about the OAuth2/OIDC is these things will not put the trust on the bearer of the api key, but on actual identity that needs to have the access.
I guess you mean putting some backing data but without making it too complicated, in an easy-to-understand way. A short and simple but informative page with infographics and everything.
For clearance, we didn't put any ads on the video. And we took his directorial comments in account so we are actually shortening the video right now and doing some other improvements on it. Also working on the landing page to display more information about the app itself. But more feedback about the app itself and the concept will be beneficial for us till we update the page.
> In the 2025 report, we showed that nearly 70% of credentials confirmed as valid in 2022 were still valid as of January 2025, meaning they have not been rotated or otherwise remediated. When we retested the same dataset in January 2026, the validity rate remained over 64%. That persistence is not a rounding error. It is an operational signal that remediation, not detection, is still the industry’s limiting factor.
> In the end there is always some long lived secret. What changes is just where and how it is stored, secured and used.
Obviously. The point here is to reduce the number of them