Revocation in 4.2 seconds: anatomy of a containment
We measured the path from anomaly to full revocation across every system an agent could reach. This is where the seconds go, and why they matter.
Containment is a latency problem
The value of revocation is measured in seconds, because an attacker's value is measured in seconds. Between the moment you decide an agent is compromised and the moment its access is gone everywhere, it can still act. That window is the whole game.
We instrumented the full path — detect, decide, propagate, confirm — and drove it down to a median of 4.2 seconds to full revocation across every downstream system the agent held a credential for.
Where the seconds go
Detection is not in the 4.2 seconds; that is your monitoring's problem and it varies. Our clock starts at the revoke action. Most of the budget is propagation: telling every issuer and gateway to reject this identity, and confirming they did.
Short-lived credentials help enormously here. Because tokens already expire in minutes, revocation only has to outrun the remaining TTL and block reissue. There is no year-long key to hunt down across forgotten systems.
Revoke first, investigate second
The design principle is that containment should be cheap enough to be your first move, not your last resort. If revoking an agent is a careful, multi-team operation, people hesitate — and hesitation is what the attacker is counting on.
One action invalidates the agent's identity, credentials and scopes at once, and writes the whole thing to the audit log. You contain now and reconstruct later, on the record, instead of debating in the moment while the clock runs.
- #revocation
- #incident response
- #containment
More field notes
The 80:1 problem: machine identity is now the perimeter
For every human on your team there are roughly eighty machine identities acting on their behalf. Almost none of them have an owner. That ratio is the whole security problem.
Daniel Osei · Security Engineer
6 min read