A platform discovers that an attacker has held valid credentials for an unknown period. What does the response require beyond containment, and what determines how well it goes?

What the response requires

1. Containment without destroying evidence. The instinct is to revoke everything immediately. That is usually right, and it must be done in a way that preserves logs and system state for investigation — because the most important question is not "have we stopped them" but "what did they access, and for how long", and that question is answered from evidence that containment can destroy.

2. Scope determination, which is the hard part. Which credentials, which systems, which data, over what period. This depends entirely on telemetry that either exists or does not:

• Authentication logs with sufficient retention.
• Data access logs — not just "who logged in" but "what did they read". Most organisations have the first and not the second, so they can establish presence and not impact.
• Network flow logs for exfiltration analysis.
• Immutable audit trails the attacker could not have modified.

Retention is decisive here. If the compromise lasted four months and logs are retained for thirty days, the scope is unknowable, and the organisation must disclose that it cannot determine impact — which is a far worse position than disclosing a known impact.

3. Credential rotation, comprehensively. Not only the compromised credential but everything it could have reached: service accounts, API tokens, signing keys, deployment credentials, and any secret it could have read. This is where an accurate inventory pays for itself.

4. Persistence hunting. An attacker with a long dwell time will have established other access — a new account, a modified authorised key, a scheduled task, an added OAuth application, a modified pipeline. Rotating the original credential without finding persistence means they return.

5. Disclosure, with timing and content shaped by regulation, contracts and honesty. The consistent lesson is that being early and incomplete beats being late and complete, provided the incompleteness is stated plainly.

What determines how well it goes

Almost entirely what was built beforehand:

• Log retention longer than a realistic dwell time. Months, not days.
• Data access logging for sensitive data, so impact is determinable.
• An asset and credential inventory, so rotation is complete rather than approximate.
• Immutable audit trails, so the record can be trusted.
• A tested rotation capability — rotating every credential quickly is a capability that must exist before it is needed.
• A rehearsed decision path for disclosure, including who decides.

The uncomfortable finding

Most organisations discover during their first serious incident that they can establish that an attacker was present and cannot establish what was taken. That gap is not an investigative failure; it is an architectural one, decided months earlier by retention settings and by whether reads of sensitive data were logged.

The question worth asking before an incident: if an attacker had valid credentials for ninety days, could we determine what they accessed? For most systems the honest answer is no, and it is fixable in advance.