Theory
Credential reset at scale is required and almost never rehearsed
Serious intrusions usually end with rotating every credential, key, token, certificate, and service account. Most organisations have never attempted this even partially. Full rotation is disruptive, which is why it is skipped, but a bounded drill on one class of secret shows what breaks before an intrusion forces the issue.
Why it is skipped
Claim: inference
A full rotation drill is disruptive, crosses every team, and surfaces undocumented integrations that break. Those are the reasons it is avoided and precisely the reasons it is valuable.
A bounded version is available: rotate one class of secret across the estate, time it, and record what broke.