GitGuardian CEO on what to tell a CEO about leaked credentials
Original title: What a security leader should tell the CEO about leaked credentials
Fourrier says deleting a leaked commit does not revoke the key, and leaders should measure time to revocation.
In a Help Net Security interview, GitGuardian CEO Eric Fourrier says fear of blame can push staff to hide exposed secrets instead of revoking them. He says a security leader should show public-code monitoring, a tested outsider reporting path, and time from report to revocation. He argues activity metrics alone do not prove security improved, and that disclosure delays are justified only while risk to users remains.
Unconfirmed: The nine-in-ten figure is from GitGuardian's own research, as Fourrier notes.
- GitGuardian research found more than 90% of notified credentials still valid days later.
- A CISA GitHub exposure stayed public until CERT/CC escalation, then came down in 26 hours.
- He cites NIS2 as making leadership accountability for cyber risk clearer.
- Vendors
- GitGuardian
From the original article
6 min read at helpnetsecurity.com
In this Help Net Security interview, Eric Fourrier, CEO of GitGuardian, talks about leaked credentials and personal liability for security leaders and boards. He explains how fear of blame pushes mistakes out of sight, and what a security leader should be ready to tell a CEO about exposed keys.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.