Enterprise Password Manager Buyer's Guide

An enterprise password manager concentrates every remaining workforce password in one service, so a weak choice turns a productivity tool into a single point of compromise. Passwords will not disappear overnight: legacy applications, third-party portals and break-glass accounts still need them, and NIST SP 800-63B-4 now requires verifiers to allow password managers and autofill. This vendor-neutral buyer's guide covers human workforce password managers: requirements, capability areas, an evaluation table, vendor questions, red flags and a proof of concept plan. Machine credentials, API keys and other non-human identity secrets are out of scope and belong in a secrets manager; see the Secrets Management Buyer's Guide. It is written for security architects, IAM teams and procurement leads.

Key takeaways

Treat the vendor's server as untrusted. "Zero knowledge" has no strict technical meaning, and a 2026 academic analysis found 31 attacks against four cloud password managers under a malicious server model, so ask for design documents and independent assessments rather than accepting the label.
Unencrypted metadata is part of the risk. In the 2022 LastPass breach, stolen vault backups left URLs unencrypted and weak master passwords open to offline guessing.
Identity integration decides control. SSO, automated provisioning and deprovisioning, and enforced MFA on the vault itself matter as much as the encryption model.
Passkeys change the scope. Many managers now store passkeys, so check portability, export and how the product fits a passwordless roadmap rather than buying for passwords alone.
Keep machine secrets out. Workload credentials in human vaults inherit human endpoint risk; that is exactly how the LastPass attackers reached cloud backup keys.

Define requirements

Write down what problem you are solving before you look at feature lists. Most enterprise purchases are driven by one or more of these:

Unique passwords everywhere: reduce reuse that feeds credential stuffing (MITRE ATT&CK T1110.004). See the Password Spraying and Credential Stuffing Defence Guide.
Get corporate passwords out of personal browser profiles: in the Cisco breach of 2022, an employee's corporate password synced to a personal account was the starting point.
Controlled sharing: team access to shared logins with audit, instead of spreadsheets and chat messages.
Offboarding: remove vault access and recover business credentials when someone leaves.
Compliance evidence: NIST SP 800-53 Rev. 5 IA-5(18) Password Managers and IA-5(1) Password-based Authentication, and NIST CSF 2.0 PR.AA-01 for credential management.

Then set scope boundaries. Decide whether browser-built-in managers remain allowed on managed devices (the NCSC considers them safe on your own devices, and they are the easiest option for many users), which user populations are in scope, whether privileged and break-glass credentials stay in your PAM platform (see the PAM Buyer's Guide), and whether you need cloud, self-hosted or both. Align policy with NIST SP 800-63B-4 (final, published 31 July 2025): a minimum of 15 characters for single-factor passwords, at least 64 characters accepted, no composition rules, no periodic forced change, and blocklist screening. See the Password Policy Guide (NIST-aligned).

Capability areas

Cryptographic architecture

Client-side encryption of vault items with keys derived from the master password (and, where offered, an additional device secret), with the key derivation function and its parameters documented.
Which fields are encrypted: item names, URLs, notes, folder names and attachments. Anything stored in clear text is exposed if backups are stolen.
Integrity protection of the vault, so a compromised server cannot silently modify items, inject entries or downgrade encryption settings.
How organisation sharing keys and admin recovery keys are distributed, and whether the server can substitute a public key during sharing.

Identity and access integration

SSO to the vault through your identity provider, and how SSO coexists with end-to-end encryption (where the decryption key lives when there is no master password).
SCIM or directory sync for joiner, mover and leaver events, with immediate suspension on deprovision.
MFA on the vault, ideally phishing-resistant FIDO2. See the Phishing-Resistant MFA Guide.

Administration and policy

Policies for master password strength, generator defaults, export restrictions, personal vault separation, and allowed client platforms.
Account recovery that does not hand administrators silent access to user vaults.
Granular sharing with folders or collections, read-only and hide-password options.

Client and endpoint behaviour

Autofill that matches only the exact origin, user interaction before fill, and protection against fill into hidden fields or iframes. Origin-bound autofill is also why the NCSC notes managers help against phishing.
Deployment through your UEM with managed configuration and forced updates. See the UEM Buyer's Guide.
Vault lock on idle, on sleep and on browser close; memory handling while unlocked (infostealers target unlocked vaults, ATT&CK T1555.005 Password Managers).

Passkeys and portability

Storage and use of passkeys, and support for the FIDO Alliance credential exchange specifications for moving passwords and passkeys between providers.
Full, encrypted export for exit planning.

Monitoring and audit

Event logs for logins, vault unlocks, item access, sharing changes, exports and policy changes, streamed to your SIEM.
Reuse, weak password and breached credential reporting at organisation level without revealing passwords to administrators.

Evaluation criteria

Criterion	What good looks like	Evidence to request	Weight (suggested)
Encryption scope	All item fields, including URLs and names, encrypted client-side	Security whitepaper listing encrypted and unencrypted fields	High
Malicious-server resilience	Vault integrity, authenticated key exchange for sharing, no server-controlled KDF downgrade	Independent cryptographic review; response to published research	High
Master password protection	Memory-hard or high-cost KDF, enforced minimum length, upgrade path for old accounts	KDF name and parameters; migration of legacy settings	High
Identity integration	SSO, SCIM, enforced vault MFA including FIDO2	Integration docs for your IdP; test in PoC	High
Offboarding and recovery	Immediate revocation; business items recoverable without admin access to personal data	Recovery design; demonstration	Medium
Audit and SIEM	Item-level access and export events via API or syslog	Event schema; sample logs	Medium
Endpoint deployment	Managed install and policy via UEM; browser extension pinning	Admin templates or MDM profiles	Medium
Passkey support and portability	Passkey storage; encrypted export; credential exchange support	Roadmap and current release notes	Medium
Vendor assurance	Recent independent audits and penetration tests, public disclosure programme, transparent incident history	Reports under NDA; security advisories page	High

Map the shortlisted product to your control framework before contract: NIST SP 800-53 IA-5(18) and IA-2(1)/(2) for MFA to the vault, CSF 2.0 PR.AA-03 for authentication, and ATT&CK T1555.005 and T1555.003 (Credentials from Web Browsers) for the threats you are reducing.

Questions to ask vendors

Which data fields are not end-to-end encrypted, including URLs, item titles, icons, folder names and metadata?
If your servers were fully compromised, what could an attacker read or change? Describe vault integrity protection and how public keys are verified when sharing.
How have you responded to the 2026 ETH Zurich and USI analysis of cloud password managers, and which findings applied to your product?
Which key derivation function and parameters do you use, and do existing accounts with older settings get upgraded automatically?
With SSO enabled, where is the vault decryption key held, and can your staff or our administrators obtain it?
How does account recovery work, and who can trigger it? Is every recovery logged and alerted?
How quickly does a SCIM deprovision revoke access on devices that are offline with cached vaults?
Can we block personal vaults or export on managed accounts, and stop corporate items moving to personal accounts?
Which independent assessments (cryptographic review, penetration test, SOC 2 Type II or ISO/IEC 27001 certificate) cover the product, and when were they performed?
What incidents have you had, and what did the post-incident report say?

Red flags

"Zero knowledge" or "military-grade encryption" offered as the whole security answer, with no published design.
URLs or item names stored in clear text on the server.
Low or legacy KDF settings left in place on old accounts with no forced upgrade.
Administrators can silently read or reset into user vaults.
No item-level audit trail, or logs only viewable in the console.
Sales encouraging storage of API keys, cloud access keys and service account credentials in human vaults. That is the pattern behind the LastPass breach of 2022, where a DevOps engineer's vault held the keys to cloud backups.
No export path, or export only in plain text.

Proof of concept

Pick a pilot of 30 to 100 users across IT, finance and a business unit with heavy SaaS use, on each client platform you support.
Integrate SSO and SCIM with your identity provider; enforce FIDO2 MFA on the vault.
Deploy clients and browser extensions through UEM; confirm policies apply and users cannot remove the extension.
Test autofill against a look-alike domain and a page with a hidden form; the manager should not fill.
Run a leaver: deprovision a test user, then open the client offline and confirm access is lost at next sync and cached data is wiped or locked.
Test recovery and shared folder access with read-only and hidden-password settings.
Stream events to the SIEM and confirm item access, export and policy changes appear with user and device.
Export a vault and import into a second test tenant to prove exit is possible.
Measure adoption: percentage of pilot users active weekly, reused and weak password counts before and after, and help desk tickets per 100 users.

How NHI Mgmt Group can help

We provide independent requirements, RFP and evaluation support for authentication and credential tools. Browse vendors in our NHI and AI products directory or contact us. If your roadmap is moving away from passwords, see the Passwordless and Passkeys Guide.

Password Manager Buyer’s Guide: Evaluating Enterprise Password Managers