Who decides that a credential exposure is an incident, and who tells the counterparty whose service it opened?

At 2am the hardest part of a credential exposure is rarely technical. It is that two decisions have to be made by people who are not the person holding the evidence. ## Why the finder is the wrong decider The engineer who found the value is the worst-placed person to grade it, for three reasons that have nothing to do with competence: - **They are inside the incentive.** If the leaked credential came from a carrier their own team maintains, grading it is self-assessment under pressure. - **They hold one side of the picture.** They can see what the value could reach; they usually cannot see what the organisation has already promised anyone about events of this kind. - **Grading is a distraction from containment.** Every minute spent debating severity is a minute not spent scoping and not spent finding the route. The workable split is: the finder contains, preserves and reports facts; a named decision-maker grades. That role must be reachable at 2am, which is a staffing decision, not a policy sentence. ## A threshold decided in advance The threshold has to be written down before the night it is used, because at 2am everyone argues towards the outcome that lets them go back to bed. A serviceable default is blunt: *a credential that was valid and readable by an uncontrolled audience is an incident until scoping shows otherwise*. Two properties matter more than the exact wording: 1. **It does not wait for scoping.** Declaring is what buys the people who do the scoping. Waiting for scope before declaring inverts the dependency and is the most common way an exposure is quietly handled by one tired person. 2. **It can be downgraded on evidence, not on effort.** "We replaced it quickly" is effort. "The value was never valid" or "it carried no rights anywhere" is evidence. | Decision | Who owns it | What it must not wait for | |---|---|---| | Is this an incident? | A named decision-maker, on call | Completed scoping | | Contain now or preserve first? | The same decision-maker, advised by the finder | A meeting | | Contact the counterparty | One named voice, using a pre-agreed channel | The investigation finishing | | Tell parties further downstream | The role that owns external communication | The counterparty's own findings | ## Telling the counterparty is an investigative step This is the part that gets mis-filed as etiquette. The service on the other end holds the only record of what was actually called with the exposed credential, and in most arrangements you do not see it by default. So the contact is doing three jobs at once: it asks them to withdraw acceptance of the old value on their side, it asks for the usage record over the exposure interval, and it discharges whatever obligation you have to tell them. Delaying it until the investigation is complete delays the investigation, because the evidence is theirs. It still goes through one voice. A single addressee, agreed in advance, prevents three engineers opening three threads with three different accounts of scope — which, from the counterparty's side, reads as an organisation that does not know what happened. What that voice sends should be narrow and checkable: which credential, when it became public, what it was entitled to, what you have done, and precisely what you are asking them for. ## Who tells anyone further downstream If the rights the credential carried reach material belonging to other people, a second decision appears, and it belongs to whoever owns external communication rather than to security or to engineering. Two rules keep it honest: say what the credential *could* reach and what the records *do* show, as separate statements; and never let the first outward message be one that a later, better-scoped message has to contradict. The gap between "exposed" and "demonstrably used" is exactly the gap that unobserved intervals create, and stating which side of it you are on is the difference between a communication that survives and one that gets re-issued. ## The failure modes worth pre-empting - **The quiet fix.** One engineer replaces the value, closes the page and tells nobody, and the organisation loses the record, the route and the chance to ask for the usage evidence. - **The threshold argued at 2am.** No written default, so the grading depends on who is awake. - **The many voices.** Several people contact the counterparty separately with different scopes. - **Waiting for certainty.** Contact is delayed until the scope is final, which is the moment their retention window is most likely to have expired. The principal-level judgment is where to set the threshold at all. Set it low and you pay in fatigue and in people learning to route around the process; set it high and a scoped, real exposure is handled as hygiene by whoever happened to find it. The test of the setting is not how many declarations it produces but whether the ones it suppresses are ones you would have been content to read about later.