2,900 sign-in attempts a minute is the part defenders can actually act on: even without knowing the secret was stolen, that rate against a normal tenant baseline should trip anomaly detection. Rotating API secrets on a schedule, not just after an incident, shortens the window a stolen one stays useful.