Passbolt’s 2025 review shows credential governance maturing

At a glance

What this is: Passbolt’s year-in-review tracks how its 2025 releases moved credential management toward lifecycle governance, with SCIM beta, secret history, encrypted metadata, and role updates anchored by 50+ releases.

Why it matters: IAM and NHI teams should read this as a sign that password and secret governance is increasingly judged on provisioning, traceability, and policy alignment rather than storage alone.

By the numbers:

• Passbolt recorded 50+ new product releases during 2025.
• Passbolt says it has 700K daily active users.
• Passbolt reported tracking at 99.97% uptime, including scheduled maintenance.

Context

Credential governance is the discipline of controlling how secrets, passwords, and related access data are created, shared, rotated, reviewed, and retired. In 2025, the governing problem moved beyond secure storage and into lifecycle control, auditability, and policy enforcement across teams and environments.

Passbolt’s year-in-review is best read as a product and governance signal rather than a feature log. The release themes point to growing pressure on IAM and NHI programmes to prove that credential access can be provisioned, observed, and changed with enough structure to satisfy enterprise and regulated use cases.

For credential-heavy teams, the important shift is that operational maturity now includes metadata protection, access visibility, provisioning automation, and evidence trails. That is a broader control set than vaulting alone, and it changes how programme owners think about assurance.

Key questions

Q: Where does credential governance fail in practice?

A: It fails when teams treat the vault as the control and ignore lifecycle events around sharing, role change, metadata exposure, and offboarding. In that model, the secret may stay protected while the surrounding access path drifts out of policy. Effective governance has to cover issuance, review, change history, and retirement together.

Q: Why does secret metadata need the same scrutiny as the secret itself?

A: Because labels, notes, and descriptions can reveal ownership, purpose, environment, or usage patterns even when the secret value is encrypted. If metadata is left outside the protection model, it becomes an indirect disclosure channel. Teams should decide which contextual fields belong under the same confidentiality rules as the credential.

Q: How should IAM teams connect SCIM to credential governance?

A: They should treat SCIM as part of the access control path, not only as account synchronisation. The key test is whether joiner, mover, and leaver events update shared credential access and role assignments consistently. If they do not, IAM and secret governance remain disconnected and audit evidence becomes incomplete.

Q: What do security teams need from credential history for audits?

A: They need a visible record of who changed what, when it changed, and how group membership or role assignments affected access. That history supports certification, incident review, and accountability. Without it, a team can only report current state, which is usually insufficient for regulated or high-trust environments.

Technical breakdown

How SCIM changes credential governance

SCIM, the System for Cross-domain Identity Management protocol, automates user and group lifecycle updates between identity providers and target systems. In this article, Passbolt’s SCIM beta matters because provisioning is no longer just a human-accounts problem. When credentials are shared across teams, lifecycle events such as joiners, movers, and leavers need a consistent path into the credential layer, otherwise access drift accumulates outside the IAM source of truth. The technical issue is not simply sync speed. It is whether the credential system can receive authoritative identity changes and keep access assignments aligned with those changes.

Practical implication: treat SCIM as a governance control path, not only an admin convenience, and test whether lifecycle changes actually propagate to shared credential access.

Why zero-knowledge metadata matters for shared secrets

Zero-knowledge metadata means the server cannot read item descriptions or other unencrypted contextual fields attached to stored credentials. That distinction matters because security teams often focus on the secret value and ignore the operational metadata around it. A password name, note, or label can still expose system purpose, ownership, or usage patterns even when the secret itself is protected. By moving metadata into encrypted handling, the control boundary expands from the secret payload to the context that helps users find and manage it. That is a governance improvement, not just a privacy feature.

Practical implication: classify metadata as part of the protected credential surface and review whether labels, notes, and descriptions leak sensitive operational context.

What secret history and role management add to auditability

Secret history provides a change trail for edits, while dynamic role management defines who can do what as group membership changes. Together, they shift the system from static storage toward governable administration. For security teams, the technical value is that access events and content changes become more reviewable, which supports certification, investigation, and accountability. Without that history, teams can only see current state, not how a credential or permission set evolved. That leaves a blind spot in both internal control testing and incident reconstruction.

Practical implication: use change history and role changes as evidence sources in access reviews, incident investigations, and control validation.

NHI Mgmt Group analysis

Credential governance is becoming a lifecycle discipline, not a storage problem. Passbolt’s 2025 roadmap shows that the centre of gravity has moved from protecting a vault to governing how credentials are provisioned, described, shared, and audited. That is the correct direction for teams that need defensible access control, because the failure mode in modern environments is rarely secret storage alone. The practitioner takeaway is that credential programmes now succeed or fail on lifecycle control.

Zero-knowledge metadata is a governance boundary, not a cosmetic encryption choice. Once metadata becomes part of the protected surface, teams have to treat labels, notes, and descriptions as governed information rather than convenience fields. That matters because operational context often reveals more than the secret itself. The implication is that credential governance must extend its trust boundary beyond the secret value to the surrounding administrative context.

SCIM pushes credential governance into the identity fabric. When provisioning and deprovisioning can touch shared credential access, the credential store becomes part of the wider IAM control plane. That breaks the old assumption that secret management sits apart from identity lifecycle. The implication is that IAM and NHI teams need shared ownership of credential entitlements, not separate parallel processes.

Auditability is now a baseline expectation for regulated credential operations. Secret history, role updates, and compliance-oriented guidance such as NIS2 all point to the same shift: organizations will be expected to show how access changed, who could change it, and when. In practice, credential platforms are being judged less on whether they store secrets and more on whether they can support accountable administration. The practitioner conclusion is that evidence quality is now part of the control surface.

Credential governance is converging with NHI governance. Even when the subject is passwords rather than service accounts or tokens, the same lifecycle questions apply: ownership, access scope, change history, and revocation. That convergence matters because teams that split credential management from NHI governance create duplicate controls and inconsistent audit trails. The practical conclusion is to govern credentials as part of the broader non-human identity programme.

What this signals

Credential governance is moving into the IAM control plane: once provisioning, grouping, and review touch shared secrets, the programme can no longer treat password management as a separate admin utility. Teams should align identity lifecycle, access review, and secret administration so that one control model governs the full path from assignment to retirement.

Encrypted metadata changes the attack surface: the sensitive object is not only the secret value but also the operational context attached to it. Security teams should review whether naming, notes, and descriptions expose enough information to help an attacker even when the password itself remains protected.

For practitioners

• Map credential lifecycle ownership Assign clear ownership for creation, sharing, rotation, review, and retirement of shared credentials so no step depends on informal administrator practice.
• Test SCIM against access changes Validate that joiner, mover, and leaver events actually update shared credential access instead of only synchronising directory objects.
• Classify metadata as sensitive Review names, notes, and descriptions attached to secrets and decide whether they belong under the same protection standard as the secret itself.
• Use history in access reviews Pull secret history and group membership changes into periodic certification so reviewers can see how access evolved, not just current entitlements.
• Separate operational admin from broad access Reduce standing administrative access for credential management tasks and narrow who can change roles, groups, and sharing rules.

Key takeaways

• Passbolt’s 2025 review shows credential governance evolving from storage-centric administration into lifecycle control with auditability and policy enforcement.
• The year’s releases point to a broader control surface that includes provisioning, metadata, role changes, and evidence trails, not just the credential value.
• IAM and NHI teams should govern shared credentials as part of the identity fabric if they want traceable access and defensible audits.

Key terms

• Credential Governance: Credential governance is the discipline of controlling how secrets are issued, stored, rotated, revoked, and monitored across an environment. For NHIs, it also includes ownership and entitlement review, because a valid secret without governance becomes a standing path to misuse.
• Zero-knowledge metadata: Metadata encrypted so the service cannot read descriptive context attached to a secret. In practice, this reduces exposure of system names, notes, and labels that often leak more than the credential itself, but it also limits server-side search and administration visibility.
• Secret history: A retained record of changes made to a credential or its associated metadata over time. It supports auditability, incident review, and accountability by showing when values changed, who changed them, and whether governance processes actually executed.
• SCIM Provisioning: SCIM provisioning is a standardized way to sync identity information between systems. It helps automate account creation, updates, and removal across connected applications. Its main value is interoperability, but it still depends on accurate upstream data and governance over what access should actually be issued.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.