Small anecdote that might help. Rotate credentials on a calendar, not only after incidents. The real cost driver was reprocessing, not inference.