Key rotation
Regularly replacing encryption keys — so a leaked key only exposes limited data.
Best practice: API keys 90 days, signing keys yearly, database creds 24-72 hours (dynamic). KMS (AWS, Azure, GCP, Vault) automates. "Envelope encryption": data is encrypted with a DEK, the DEK with a KEK — only the KEK needs rotation.