The PTA can perform automatic password change as a type of remediation in case of a suspected credential theft security event.According to the CyberArk documentation1, 'Rotate credentials - for OverPass the Hash attack and Suspected credentials theft events.'1This means that the PTA can initiate a password change request to the CPM for the affected account, which will generate a new random password and update it on the target system and the Vault. This way, the PTA can prevent the attacker from using the stolen credentials to access the target system or launch further attacks.Reference:

Configure PTA Remediations - CyberArk, section ''Remediation Initiation''