---
title: Dynamic Password Update Flow for Standard Scanning Accounts
slug: kronpam-how-to-guides/dynamic-password-update-flow-for-standard-scanning-accounts
docTags: 
createdAt: 2025-10-14T15:39:55.678Z
---

This process defines how **Kron PAM Vault** and **Tenable Security Center (TSC)** synchronize account credentials when the password for a scanning account is dynamically rotated. The flow ensures that Tenable continues to perform authenticated scans without interruption, even after password changes.

### Password Rotation and Trigger Activation (Kron PAM Vault)

1. **Schedule Password Rotation**

:::Paragraph{indent="1"}
The Kron PAM Vault automatically rotates the password of the designated scanning account (Credential User) at defined intervals.
:::

:::Paragraph{indent="1"}
The Vault updates the new, randomly generated password on the target system, maintaining compliance with security policies.
:::

![Password Rotation](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/mtS7iTNGNeWj_vuutm8Xw-20251014-154358.png "Password Rotation")

2. **Application Trigger Execution**

:::Paragraph{indent="1"}
After a successful password change, the Application Trigger associated with that specific Credential User account is automatically activated.
:::

:::Paragraph{indent="1"}
This trigger initiates the synchronization process with Tenable Security Center to ensure that the updated password is reflected there as well.
:::

![Application Trigger](https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/QC8s63p5n3OZYumGnQA-X-20251014-154528.png "Application Trigger")

### Tenable Security Center Synchronization

1. **Credential Record Identification**

:::Paragraph{indent="1"}
The Application Trigger retrieves the newly rotated password from the Kron PAM Vault and searches all Credential records in Tenable Security Center.
:::

:::Paragraph{indent="1"}
It compares the Description field values to identify the record corresponding to the updated Vault account.
:::

2. **Credential Update**

:::Paragraph{indent="1"}
Once the correct Credential record is found, the Trigger updates the main password field (PASSWORD) in Tenable Security Center with the new value retrieved from the Vault.
:::

3. **Uninterrupted Scan Operations**

:::Paragraph{indent="1"}
The updated credentials are immediately utilized by Tenable for subsequent scans, ensuring continuous and authorized access to target systems without manual intervention or scan failures.
:::