Authenticator revocation is the process of disabling a compromised password, token, session, or other login factor so it can no longer be used. In practice, this means forcing sign-out, invalidating refresh tokens, rotating credentials, and removing any trusted session state tied to the affected account.
This matters because many intrusions start with valid access rather than malware. If an attacker steals a password or session cookie, they can often act like a normal user until the authenticator is revoked. Rapid revocation limits that window, cuts off persistence, and helps stop data theft through email, cloud storage, or exposed applications. Defenders usually pair it with password resets, MFA, access review, and monitoring for any remaining sessions or tokens that may still be active.