SSH Keys: The Most Powerful Credential You're Probably Ignoring

This article warns that unmanaged SSH keys are a pervasive enterprise risk and recommends governance: inventory and discovery, ownership metadata, periodic rotation (e.g., every 90 days for high-privilege keys), vaulting private keys, remediating orphaned keys, and moving toward ephemeral SSH certificates (e.g., Netflix BLESS, HashiCorp Vault); it cites tools like CyberArk and SailPoint and references past breaches to emphasize the urgency of implementing these controls.