Enterprise password management is not enough against common attacks

At a glance

What this is: Island argues that enterprise password management helps with password hygiene, but it does not stop the main attack paths that steal credentials or hijack sessions.

Why it matters: IAM teams need to treat password controls as only one layer, because browser, device, and session protection determine whether those credentials can actually be abused.

Context

Enterprise password management is a control layer for creating, storing, and retrieving credentials, but it is not the same thing as controlling the environment where those credentials are used. In this article, the primary governance gap is that password-centric hygiene does not cover browser compromise, session hijack, or device exposure.

The article frames the issue in enterprise IAM terms because users still need passwords for legacy and third-party systems outside the identity provider. That means password managers reduce friction and improve uniqueness, but they do not remove the attack paths that target the browser, the endpoint, or the authenticated session.

Key questions

Q: What breaks when enterprise password managers are treated as the whole control model?

A: Credential risk persists because storage does not govern sharing, offboarding, or access that lives outside SSO and centrally managed workflows. Teams still need ownership, lifecycle rules, and visibility into where credentials are used. Without those controls, a password manager can reduce password weakness while leaving the organisation exposed to unmanaged access paths.

Q: Why do password breaches remain dangerous even when users have unique passwords?

A: Unique passwords stop simple replay across sites, but they do not protect against direct disclosure through phishing, malware, or a compromised browser session. If the attacker captures the live secret or session token, uniqueness no longer matters. The real risk is that authentication can be bypassed without ever cracking the password.

Q: What are the signs that password controls are failing in day to day use?

A: Common warning signs include frequent password resets, repeated purchase abandonment, password reuse across services, and people sharing credentials with family, colleagues, or friends. Another signal is the continued use of weak or written down passwords despite policy reminders. These behaviours show that the control is not aligned with how users actually work.

Q: How should teams balance password managers, MFA, and browser security?

A: Password managers should improve credential hygiene, MFA should raise assurance, and browser security should protect the session itself. None of those layers replaces the others. If the browser or device can be compromised, authentication controls lose much of their value, so the practical answer is layered control, not tool substitution.

Technical breakdown

Why password complexity does not stop credential theft

Password complexity reduces the success of brute-force attacks, but it does nothing once a credential is disclosed through phishing, malware, or reuse after a site breach. A strong password can still be captured at entry, copied from a breach dump, or harvested from a compromised device. In practice, the security property changes from resisting guessing to resisting disclosure, and those are different controls. The article’s core point is that password strength is only effective against one attack class, not the full lifecycle of credential abuse.

Practical implication: separate password strength controls from controls that prevent disclosure, because one does not substitute for the other.

How session hijacking bypasses password policy

Session hijacking is a browser-layer attack, not a password-cracking attack. Once an attacker can exfiltrate cookies, tokens, cache, or memory, they can impersonate the user without knowing the password at all. That means the login event is no longer the only security boundary; the active session becomes the asset. This is why password managers can preserve credential quality while still leaving the enterprise exposed when the browser or endpoint is compromised. The article correctly treats session integrity as a separate control plane from password generation.

Practical implication: harden browser session storage and endpoint protections, because password policy cannot defend an already-authenticated session.

Why MFA still leaves residual risk in the login flow

The article distinguishes between stronger MFA methods and weaker ones such as SMS codes. SMS can be defeated through phone-number takeover or advanced phishing that persuades users to share the one-time code. Even when MFA is present, the assurance level depends on the factor type and the channel used to deliver it. The governance lesson is that authentication strength is not binary. Enterprises need to judge whether the second factor meaningfully resists social engineering and interception, especially where high-value access is involved.

Practical implication: treat SMS-based MFA as a lower-assurance control and prefer phishing-resistant methods for critical access paths.

Threat narrative

Attacker objective: The attacker wants durable access to enterprise applications and data through credentials or sessions that remain usable after the initial password control has failed.

1. Entry occurs when attackers use brute force, phishing, malware, or a breached password set to obtain valid credentials or session material.
2. Credential access is achieved when reused passwords, captured login details, or browser-stored session artifacts give the attacker usable access.
3. Escalation happens when the attacker reuses the same credentials across unrelated systems or hijacks an authenticated browser session without re-entering the password.
4. Impact follows when the adversary reaches enterprise applications and data through an access path that password hygiene alone never governed.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password managers solve credential hygiene, not control-plane exposure: The enterprise password manager is useful, but it only addresses password creation and storage. The security problem in this article is that the attack surface shifts after the password is entered, into the browser, endpoint, and session layer. Practitioners should stop treating password hygiene as equivalent to authentication assurance.

Session integrity is the real boundary in modern password abuse: Once cookies or cached session state are stolen, the password itself is no longer the control point. That means identity governance has to account for authenticated state as a governed asset, not just the secret used to create it. The practitioner conclusion is that session protection belongs alongside password policy, not underneath it.

MFA quality matters more than MFA presence: The article is right to separate SMS-based MFA from phishing-resistant factors such as FIDO2 and WebAuthn. Enterprises often describe themselves as MFA-enabled without asking whether the factor can survive social engineering or number-porting abuse. The governance implication is to measure factor assurance, not checkbox adoption.

Browser and device posture are part of identity assurance: A password manager is only as trustworthy as the environment that stores or transmits the credential. If the browser can be tampered with or the device can exfiltrate local data, password controls remain incomplete. The practitioner conclusion is that identity assurance now depends on endpoint and browser trust as much as on the password itself.

Password reuse creates identity blast radius: A single breached credential set can become a cross-service access pathway when users repeat passwords across systems outside central identity control. That is not a user education problem alone; it is a governance failure to account for unmanaged access surfaces. Teams should treat reuse risk as a lifecycle issue spanning every account class, not just primary workforce identities.

From our research library:

• The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.

What this signals

Password control now spans three layers: Password managers affect credential generation and storage, MFA affects login assurance, and browser security affects whether the authenticated session can be stolen. Teams that treat those as one problem will continue to overestimate their actual protection.

The practical shift is to govern the full path from credential creation to session use. That means identity programmes should include browser trust, endpoint posture, and phishing-resistant factors in the same control conversation rather than handing each issue to a separate team.

For practitioners

• Enforce phishing-resistant MFA for critical access Replace SMS-based verification with phishing-resistant factors such as FIDO2 or WebAuthn for high-value applications and admin access paths.
• Harden browser and endpoint session storage Prevent local exposure of cookies, cache, and keystroke buffers on managed and unmanaged devices used for enterprise login flows.
• Reduce password reuse across non-IdP systems Require unique credentials for legacy and third-party systems that sit outside the central identity provider and are still reachable by staff.
• Treat browser compromise as an identity risk Include vulnerable browsers, cookie theft, and session hijack in identity threat modeling rather than treating them as separate endpoint problems.
• Segment access by device posture Block or limit authentication when the device cannot meet minimum security conditions such as encryption, patching, and local storage restrictions.

Key takeaways

• Enterprise password management improves password hygiene, but it does not control the browser, device, or session layer where many attacks succeed.
• The article shows that password reuse, phishing, malware, and session hijacking all bypass password strength in different ways.
• Practical defence requires layering password management with phishing-resistant MFA, browser protection, and endpoint trust checks.

Key terms

• Password Manager: A password manager is a system that creates, stores, and fills credentials so users do not need to remember or reuse them. In governance terms, it reduces secret sprawl, supports unique passwords per account, and creates a more auditable path for sharing and revocation.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Password reuse: Password reuse is the practice of using the same password across multiple accounts. It turns one successful compromise into a much larger account takeover problem because the attacker can try the stolen credential elsewhere, widening the blast radius beyond the original target.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.