They should do it whenever a credential is used by more than one person, team, or vendor, or when it grants administrative access to a business-critical system. Shared credentials destroy attribution, complicate offboarding, and widen blast radius, so the default should be individually attributable access unless a technical exception is unavoidable.
When shared credentials should give way to named access
shared credentials are a temporary convenience, not a stable operating model. Once a credential is used by more than one person, team, or vendor, or when it protects a business-critical administrative path, the cost of not knowing who did what becomes material. Individually attributable access is the safer default because it preserves accountability, narrows blast radius, and makes revocation practical.
That principle is especially important for secret and credential lifecycle management, where shared values tend to persist long after the original need has changed. Teams should treat shared access as an exception that requires a clear business reason, a compensating control, and a plan to retire it.
What changes when access is named instead of shared
Named access changes the security model in three ways. First, it restores attribution, so audit logs, approvals, and incident reviews can be tied to a specific user or vendor representative. Second, it makes offboarding deterministic, because access can be removed without forcing a credential reset for unrelated users. Third, it reduces lateral abuse, because compromise of one person does not automatically expose everyone else who knows the same secret.
Shared credentials also create hidden ownership problems. When multiple people rely on the same login, no one fully owns rotation, usage review, or exception handling, which is how stale credentials survive in production. In practice, the question is not whether a shared credential is technically usable, but whether the loss of individual accountability is acceptable for the system it reaches.
Where shared credentials become a control failure
Shared access becomes especially weak when it is used for privileged or business-critical systems, because the same secret often unlocks configuration, data, or operational actions. In that situation, one compromised credential can hide both the actor and the path of misuse, which makes containment and forensic review much harder.
Named access also matters when vendors are involved. A shared login across an internal team and a third party makes it difficult to prove who handled the system, what changed, and whether access ended when the relationship ended. That is why shared credentials should be reserved for narrow technical exceptions, not for routine convenience.
Risk and Threat Considerations
Shared credentials increase exposure because they weaken attribution, delay revocation, and enlarge the number of people who can misuse or accidentally disclose the same secret. If that secret reaches an administrative interface or sensitive business workflow, compromise or misuse can persist unnoticed longer than a named account would allow.
Failure mechanism: Multiple users rely on one secret, so logs and approvals no longer map cleanly to a person, and revocation often requires disruptive rotation rather than simple account removal. That breaks accountability and increases the chance that stale access survives after role changes or vendor offboarding.
Impact: Incident response becomes slower, blast radius grows, and the organisation may be unable to prove which individual performed an action. In regulated or high-trust environments, that loss of traceability can become an operational, audit, and recovery problem, not just an access-control issue.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Shared credentials make offboarding and revocation hard to scope to one actor. |
| NHI-05 — Overprivileged NHI | Shared admin credentials often concentrate excessive privilege in one secret. | |
| NHI-07 — Long-Lived Secrets | Shared credentials usually persist too long and resist clean lifecycle management. | |
| Recommendation — Replace shared credentials with individually revocable access before vendor or staff offboarding. Reduce shared admin access and scope named accounts to the minimum needed privilege. Shorten secret lifetime and move high-value access to named, rotating credentials. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Shared credentials are a lifecycle and revocation problem for authenticators. |
| IA-2 — Identification and Authentication (Organizational Users) | Named access is the control pattern that restores user-level attribution. | |
| AC-6 — Least Privilege | Shared privileged logins often grant broader access than a named role should. | |
| Recommendation — Manage authenticators individually so they can be rotated, revoked, and traced. Assign unique identities so actions can be authenticated and attributed to one user. Split privileged duties into named accounts with least-privilege access paths. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Named access is a direct access-control improvement over shared credentials. |
| A.5.16 — Identity management | Replacing shared credentials requires unique identity ownership and lifecycle. | |
| A.8.2 — Privileged access rights | The question is most acute for administrative shared credentials. | |
| Recommendation — Define access rules that require individual accountability for sensitive systems. Issue and retire access per named identity rather than per shared secret. Limit privileged access to named accounts and review those rights regularly. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account management is the operational control family for replacing shared access. |
| Recommendation — Eliminate shared accounts and manage access through named, reviewable accounts. | ||
Practitioner Guidance
What to prioritise: Replace shared credentials first where the account is privileged, reaches production data, or is used by more than one person or external party. Those are the cases where attribution and revocation gaps create the highest risk.
Decision rule: If a credential can affect administration, finance, customer data, or security tooling, treat named access as the baseline and allow sharing only with a documented exception and a retirement date.
What to verify: Confirm that the replacement design preserves individual ownership, auditability, and offboarding without forcing collateral resets for unrelated users. If you cannot remove access cleanly by person or vendor, the model is still too shared.
Practitioner takeaway: The right test is not whether a shared credential is convenient, but whether the system can still answer who acted, who approved, and how to remove one actor without disturbing everyone else.
Related resources from NHI Mgmt Group
- How should security teams run access reviews for non-human identities?
- How should security teams govern non-human identities that have persistent access?
- How should security teams govern API keys used for generative AI access?
- How should security teams manage database and infrastructure access without relying on shared secrets or standing credentials?