Credential health

A vault full of secrets is only as safe as the secrets in it. Kutrion continuously assesses the health of what you store, watches for known breaches, and — on brokered sessions — catches secrets leaking into terminal output as it happens. All of it is audited.

Health scoring

The health scanner evaluates stored secrets and flags the ones that put you at risk:

• Weak secrets that are too short or low-entropy to stand up to guessing.
• Reused secrets that appear on more than one record.
• Old secrets that have not been rotated in a long time.

Flagged secrets feed straight into the guided rotation workflow described in Sharing and rotation, so a finding turns into a fix.

Breach monitoring

Beyond scoring, Kutrion checks stored passwords against the Have I Been Pwned breach database to see whether a password has appeared in a known breach corpus.

• When a stored password matches a known breach, Kutrion raises a CREDENTIAL_BREACH_DETECTED event.
• The event lands in the audit trail, so the finding is on the record and can drive alerting or rotation.

Exposure detection

The most distinctive health check applies to brokered terminal sessions. Kutrion watches the SSH broker’s terminal output in real time for secrets that leak into the stream — for example a credential echoed to the console.

When a secret is detected in brokered output, Kutrion:

• raises a CREDENTIAL_EXPOSURE_DETECTED event in the audit trail, and
• stores the finding with a redacted sample, so the exposure record itself does not carry the secret.

Detection does not edit the live terminal output. If the session is being recorded, the same detectors also filter the stored copy: a secret they recognise is replaced in the session recording with a marker such as [redacted: aws_access_key]. The session recording page lists exactly which secrets are recognised and which are not. A secret the detectors do not recognise is not flagged here and stays in the recording as it appeared on screen. Either way the secret was shown on a terminal, so rotate the exposed credential.

Entitlement

Scanning runs on every organization unless an organization admin turns it off. Filtering of stored recordings has its own switch, also on by default, and runs whether or not scanning is on. A suppression silences findings for a pattern but does not stop that pattern being filtered out of recordings. Reviewing, resolving and suppressing findings is a PRO+ capability, gated by the exposure_detection entitlement. Health scoring and breach monitoring remain available to flag problems on every plan.

Where to go next

• Turn findings into fixes with Sharing and rotation.
• See the events these checks raise in Audit logs.
• Understand how brokered output is captured in Session recording.