The Most Expensive Vulnerability Is a Token Nobody Rotated
Ozempic – the injection a great many people are getting thin on overnight. One token. Somebody forgot to rotate it on GitHub. And a drug worth billions simply walked out of the door.
No sophisticated SQL injection. No state-level attack with three APT teams. Nothing. Just a developer who pushed code with a secret inside it, and nobody noticed.
Honestly, that is the most common story I see in the field.
Twenty years of finding the same thing
I have been running penetration tests for more than twenty years, and in almost every project I find secrets nobody knew existed. Old tokens pasted into the code. Passwords forgotten in an internal repository. API keys somebody put there “just for a minute” three years ago, and that minute is still going.
And it is slightly funny. When people talk about cyber, everyone pictures a hacker in a hoodie cracking encryption in a dark room. The truth is far more boring. The most expensive vulnerability in the world is not some brilliant exploit. It is a token somebody forgot to rotate.
Think about it for a second. A pharmaceutical company pours billions into research, into patents, into a decade of work. And all of it is exposed because of one line in a config file the developer never intended to see daylight.
This is the point I have been making to clients for years
Resilience is not only about hunting for the most sophisticated attack. Sometimes the most dangerous thing in your organisation is what somebody forgot to delete.
Preventing it takes one automated scan across the repositories and a key rotation on a schedule. Five minutes of work. Almost free.
And discovering that your product’s formula is circulating freely on the internet? There is no price for that.
The most expensive security is not the security you bought. It is the security you forgot to do.
I first shared a version of this as a LinkedIn post on 2026-07-08. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula
