TL;DR: Traditional password management leaves four gaps open across SSO coverage, vault adoption, browser visibility, and response, with 37% of enterprise apps outside SSO and risky passwords often used while employees are not in their password manager, according to Dashlane. The real control problem is that credential risk now lives in the browser, where existing identity and endpoint tools do not fully see or act in time.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Dashlane's blog post: Traditional password management leaves four credential-risk gaps, with SSO coverage, vault adoption, browser visibility, and response all failing to close exposure.
Why it matters: Identity teams need to treat password management as only one layer of control, because unmanaged apps and browser-based credential use create gaps that neither SSO nor endpoint tooling fully closes.
By the numbers:
- 37% of enterprise apps fall outside SSO coverage, making them invisible to the identity stack that is supposed to govern access.
- When a risky password is used, there is a 53% chance the employee is not logged into their password manager at that moment.
Context
Traditional password management was designed for a narrower environment than most organisations now run. When identity, application access, and user behaviour all move into the browser, the control boundary shifts faster than the tools that were built around a central vault and a fixed login pattern.
The governance gap is not simply weak passwords. It is the gap between where credentials are used and where identity teams can actually observe, enforce, and remediate them. That gap widens when shadow IT and shadow AI introduce access paths that never enter the formal identity stack.
Key questions
Q: How can organisations reduce the risk of credential theft from web browsers?
A: Reduce it by managing browser password storage, enabling phishing-resistant authentication, and protecting endpoints where browsers hold session data and saved secrets. Attackers steal credentials from web browsers to hijack accounts and bypass reset controls. Use endpoint monitoring for suspicious access to browser profiles, review extension risk, and clear local secrets on shared or high-risk systems.
Q: Why does SSO coverage not eliminate identity risk?
A: SSO coverage does not eliminate identity risk because the SSO boundary only centralises authentication, not all downstream entitlements, privileged sessions, or recovery paths. Accounts outside SSO, local logins, legacy apps, break-glass access, and weak account recovery still create exposure. Human identities still need joiner-mover-leaver controls, MFA, access reviews, and PAM for privileged access.
Q: How does password manager adoption affect enterprise credential security?
A: Password manager adoption improves enterprise credential security by keeping secrets in a protected vault, generating unique passwords, and reducing reuse across accounts. Risk remains for credentials copied outside the vault and outside its protections, such as browser-saved passwords, shared files, hard-coded secrets, or phished master credentials. Rotation, MFA, and secret discovery still matter.
Q: What is the best way to respond to risky password use?
A: The best response to risky password use is to revoke access, reset credentials, and replace the exposed secret wherever it may have been reused. That includes changing the password, invalidating active sessions or tokens, checking for privilege escalation, and reviewing whether the account needs tighter controls such as MFA or PAM. Reuse makes one compromise spread quickly.
Technical breakdown
Why SSO coverage leaves access gaps
Single sign-on centralises authentication, but it does not automatically bring every application under governed access. If apps sit outside the IdP boundary, teams lose policy enforcement, offboarding confidence, and auditability for those access paths. The technical issue is coverage, not just authentication quality. Every unmanaged app becomes a parallel access channel with its own credential lifecycle and review burden, which breaks the assumption that the identity layer sees the full entitlement surface.
Practical implication: Map and reduce applications that sit outside federated access before relying on SSO coverage as a control statement.
Why vault adoption does not equal credential control
A password vault only governs credentials that employees actually store and use through it. In practice, adoption is uneven, which means a large share of credential activity can remain outside the vault and outside its protections. That creates a split estate: managed credentials inside the tool and unmanaged credentials everywhere else. The security problem is behavioral dependency, because the control works only after users have changed how they log in. See the Password Manager Buyer's Guide.
Practical implication: Treat vault adoption as partial coverage until you can measure what percentage of logins still happen outside it.
Why browser-based phishing bypasses traditional visibility
Many credential events now happen inside the browser rather than in email or on the endpoint itself. That matters because SIEM, endpoint tooling, and email security each see only part of the journey. If a user enters credentials into a spoofed site in-browser, the event may never trigger the controls that were designed for inbox delivery or device telemetry. The blind spot is not the phishing message alone, but the absence of inspection at the point of credential entry. See the Enterprise Browser and Browser Security Guide.
Practical implication: Add controls that inspect login activity where it occurs, not only after an alert appears in downstream logs.
NHI Mgmt Group analysis
The browser has become the real credential control plane. SSO, endpoint monitoring, and email filtering each govern a slice of the problem, but none of them fully owns the moment a user enters a secret into a web session. That means credential risk now forms at the interaction layer rather than the directory layer. Practitioners should treat browser-mediated login as the primary governance surface, not a secondary event.
Access review processes are being asked to certify a surface they never fully see. Traditional review models assume the organisation has a reasonably complete inventory of applications and sessions to assess. Dashlane's framing shows that this assumption fails once shadow IT and shadow AI create access paths outside central control. The implication is that recertification quality is limited by discovery quality, not by review cadence alone.
Credential risk is drifting from identity policy into user behaviour. A password manager can reduce exposure, but only if users actually store and use the credential there. That creates a governance dependency on adoption, which is weaker than policy enforcement and harder to assure. Password security remains necessary, but the operational question is whether the programme controls the login path or merely offers a safer option.
Response time is now part of credential security. Reactive resets and manual cleanup turn detection into a delay, and delay expands the damage window. That is why the important control question is no longer just whether a risky login can be found, but whether the organisation can act on it before reuse or lateral reuse occurs. Teams should measure how quickly they can move from detection to containment.
From our research library:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
What this signals
Browser visibility is becoming a core identity control requirement. Identity programmes that stop at SSO and endpoint telemetry will continue to miss the moment credentials are entered. The next control boundary is the browser, because that is where users increasingly authenticate, reuse secrets, and encounter phishing content that never passes through traditional inbox filters.
Credential governance is shifting from static policy to runtime observation. Coverage claims based on having a vault or an IdP are no longer enough. Security teams need to know which logins are actually governed, which remain outside the managed path, and how quickly they can intervene when a risky password appears in use.
Password security now depends on the quality of exception handling. Every unmanaged app, off-vault login, and manual reset workflow creates a gap that attackers can exploit faster than administrators can close it. Organisations that cannot observe and remediate those exceptions in near real time will keep treating credential risk as an after-the-fact problem.
For practitioners
- 3cstrong3eInventory apps outside SSO3c/strong3e Build a current map of applications that sit outside federated access, then track which teams own them and whether they can be offboarded and audited cleanly.
- 3cstrong3eMeasure vault adoption against real logins3c/strong3e Compare password manager usage with actual authentication events so you can see how much credential activity still occurs outside the vault.
- 3cstrong3eClose the browser blind spot3c/strong3e Assess whether your current controls can observe credential entry in the browser, not only in email, endpoint, or SIEM telemetry.
- 3cstrong3eShorten response from detection to containment3c/strong3e Replace manual reset-only playbooks with a defined process that can revoke, reset, and notify quickly when risky credential use is detected.
Key takeaways
- Traditional password management leaves important credential paths outside central control, especially when applications sit beyond SSO and users do not operate inside the vault.
- The operational blind spot is the browser, where credential use, phishing, and unmanaged logins can occur without visibility from standard identity and endpoint tooling.
- Organisations need to measure actual login paths, not just control deployment, if they want to reduce credential exposure in a meaningful way.
Related NHI Mgmt Group resources: Password Security and Password Manager Guide · Breached password checks · Password Manager Buyer's Guide · Enterprise Browser and Browser Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The post centres on authentication paths that sit outside controlled identity coverage. |
| NHI-07 — Long-Lived Secrets | Password risk persists when credentials remain usable outside vault governance for long periods. | |
| NHI-10 — Human Use of NHI | Employees are still handling credentials directly in unmanaged browser sessions. | |
| Recommendation — Review authentication paths that bypass central control and standardise governed login flows. Reduce the lifespan of unmanaged credentials and remove long-lived secret exposure paths. Limit direct human handling of secrets and move users onto governed credential flows. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article focuses on credential lifecycle, rotation, and recovery around risky password use. |
| Recommendation — Apply authenticator management controls to rotate, revoke, and recover compromised credentials quickly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Unmanaged apps outside SSO break visibility into who can access what. |
| Recommendation — Align access permissions with a complete application inventory and remove unmanaged access paths. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The threat pattern is credential theft and reuse through browser-based phishing and unmanaged logins. |
| Recommendation — Hunt for credential access activity in browser workflows and prioritise exposure at the point of entry. | ||
Key terms
- Single Sign On: Single Sign On is a login method that lets a user access multiple applications with one authenticated session. Technically, an identity provider issues a trusted authentication assertion or token after the user signs in, and connected services accept that proof instead of requiring separate passwords for each application.
- Password Manager: A password manager is a system that creates, stores, and fills credentials so users do not need to remember or reuse them. In governance terms, it reduces secret sprawl, supports unique passwords per account, and creates a more auditable path for sharing and revocation.
- Browser-based phishing: Browser-based phishing is phishing that executes through the web browser rather than the inbox, often using redirects, malicious sites, consent prompts, or extensions. It matters because the browser is where identity, application access, and session state intersect.
- Credential exposure: The condition where a secret, token, key, or certificate becomes visible to a system or user that should not have direct access to it. In AI-assisted workflows, exposure can happen through prompts, files, or agent-accessible directories, which makes containment and runtime gating essential.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org