Password manager vault risk shows why static secrets fail

At a glance

What this is: This is an analysis of why password manager vaults create a single point of identity failure and how static secrets enable credential theft, phishing, and lateral movement.

Why it matters: It matters because IAM, PAM, and NHI teams must treat stored credentials as a governance problem, not just a user convenience problem, when deciding how to reduce credential exposure and improve lifecycle control.

By the numbers:

• In 2025, an estimated 19 billion passwords were stolen, and only 6% of these were unique.
• 22% of breaches utilized stolen credentials as the initial access vector, according to the 2025 Verizon Data Breach Investigations Report.
• Only 5.7% of organisations have full visibility into their service accounts, according to NHI Mgmt Group.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

👉 Read Unixi's analysis of password manager vault risk and universal SSO

Context

Password manager vaults are designed to reduce password sprawl by storing credentials centrally, but that design also concentrates risk. When one vault or one privileged endpoint is compromised, the attacker does not need to hunt for individual accounts, because the credential store becomes the access layer itself. That is a direct identity governance problem, not just a product risk.

For IAM and NHI programmes, the important question is whether credentials are being managed as durable secrets or as short-lived access artefacts. Static, reusable secrets are easier to store, but they also create wider exposure windows, weaker revocation, and more difficult offboarding when the same secret is reused across systems.

The article contrasts that model with on-the-fly credential derivation, which shifts the control point away from stored secrets and toward runtime access generation. That distinction matters for teams managing human identity, service accounts, and emerging AI-driven access patterns, because the governance model changes when nothing persistent exists to steal.

Key questions

Q: What breaks when a password manager still depends on a single master password?

A: A master password creates a concentrated failure point because one secret can unlock an entire credential set. If it is phished, reused, or captured, the attacker may inherit broad access rather than a single account. Organisations should treat that design as a privileged control decision, not a minor usability choice.

Q: Why do stored credentials keep showing up in breaches?

A: Because stored credentials are reusable, harvestable, and often persistent long after the original trust decision. Attackers can steal them through phishing, endpoint compromise, malware, or server-side exposure, then replay them until revocation occurs. Static secrets create a long attack window that defenders have to close manually.

Q: How should security teams reduce password risk without relying only on user training?

A: Security teams should focus on the identity flows around passwords, not just the password itself. That means tightening recovery paths, removing shared or fallback credentials, enforcing stronger authentication for sensitive access, and reviewing whether privileged accounts still depend on brittle login assumptions. Training helps, but control design decides the real outcome.

Q: What is the difference between storing secrets securely and governing them well?

A: Secure storage protects where the secret sits. Governance adds ownership, exposure history, lifecycle state, and dependency awareness so teams can decide when a secret should be rotated, revoked, or retired. In practice, the second problem is harder and more important, because it determines whether the secret is still usable by an attacker.

Technical breakdown

Why centralized vaults become a single point of failure

A password vault is an encrypted repository that aggregates credentials behind one master secret or a small set of privileged controls. That architecture reduces user burden, but it also creates a high-value compromise target: if the vault provider, server-side data, or a privileged endpoint is breached, the attacker can pivot from one compromise to many accounts. In identity terms, the failure is not only theft of a password. It is the collapse of the trust boundary around stored credentials, because the vault itself becomes the access broker for the entire environment.

Practical implication: Treat vault concentration as an access-risk concentration problem and map which accounts, endpoints, and admins can expose the widest credential set.

Static secrets, reuse, and credential-based initial access

Static secrets are reusable by design, which makes them attractive to attackers conducting phishing, token replay, malware capture, or offline cracking. Once a password or token is harvested, the attacker can often authenticate exactly as the legitimate user or system would. This is why credential theft remains one of the most common initial access patterns in breach reporting. The issue is amplified when users store weak passwords, reuse them across services, or keep them in a vault that itself can be targeted. Static storage does not eliminate the secret. It simply relocates the risk.

Practical implication: Prioritise removal of long-lived reusable secrets from the highest-value access paths first, especially admin, SSO, and application credentials.

How derived credentials change lateral movement

On-the-fly derivation changes the attacker’s problem because the credential is not stored as a persistent object in the vault. Instead, access is produced at runtime from multiple inputs and can be bound to user, tenant, system, and employee context. That means a compromise of one factor, such as a laptop or a local session, does not automatically expose the reusable secret needed elsewhere. The control value here is not just stronger crypto. It is the removal of a durable artefact that can be stolen, replayed, or shared across systems.

Practical implication: Design authentication flows so a compromise of one endpoint or one account does not expose a reusable secret for adjacent systems.

Threat narrative

Attacker objective: The attacker wants durable, reusable access that turns one compromised credential into access across multiple systems and accounts.

1. Entry occurs when an attacker compromises a user endpoint, vault server, or other privileged access point that can reveal stored credentials.
2. Escalation follows when the attacker captures a master password, vault contents, or reusable token and uses it to authenticate as the victim.
3. Impact arrives when the compromised secret enables access to multiple downstream systems, allowing lateral movement, data theft, or account takeover at scale.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static secret concentration is the core identity failure, not the vault UI. Password managers do not fail because they centralize convenience alone. They fail when durable credentials become the control plane for authentication, revocation, and reuse across many systems. That creates a blast radius problem that IAM teams should recognise immediately: the security outcome is only as strong as the most exposed secret, not the number of passwords stored.

Credential theft still dominates because identity programmes often protect storage better than they protect use. The 2025 breach data in the source article shows that stolen credentials remain a major access path, which means the weakest point is often not the vault cipher but the user endpoint, browser session, or post-authentication replay path. For practitioners, that means control design must move beyond storage to the full credential lifecycle.

Runtime credential derivation changes the governance premise for access management. A static password model assumes a secret persists long enough to be stored, distributed, reviewed, and revoked. That assumption breaks when access is derived on demand and can be made system-specific. The implication is that identity governance must distinguish between stored secrets and generated credentials, because they create very different accountability and recovery models.

Governance gaps around offboarding and revocation matter more than most teams admit. The article’s offboarding examples show that former users can retain access when shared keys, vault permissions, or organization secrets are not fully revoked. This is a lifecycle failure, not a narrow security bug. Teams should treat revocation completeness as a core control outcome, especially where shared access or group-derived credentials exist.

Human identity controls and NHI controls are converging around the same failure pattern. Whether the subject is a person using a password vault or a machine account holding a long-lived secret, the risk is the same: reusable authentication material outlives the trust decision that created it. That is why password governance, service account governance, and secret lifecycle management now need to be managed as one discipline, not separate projects.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• That visibility gap is why lifecycle-focused guidance such as Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs belongs in the same conversation as password governance.

What this signals

The next step for identity programmes is to stop treating vaults as an end state. The governance problem is not only whether secrets are encrypted, but whether the organisation can account for where they exist, who can use them, and how they are removed when trust changes.

Secret concentration debt: as organisations accumulate reusable credentials, they inherit a hidden revocation burden that grows faster than most access review programmes can absorb. That debt is already visible in overprivileged service accounts and shared access paths, which means IAM and NHI teams should prioritise reduction of durable secrets before adding more layers around them.

For teams formalising control coverage, the practical reference points are NIST Cybersecurity Framework 2.0 for access governance and OWASP Non-Human Identity Top 10 for NHI secret exposure patterns.

For practitioners

• Reduce dependence on reusable vault-stored secrets Identify credentials that are stored, copied, or reused across SaaS, cloud, and admin workflows, then prioritise removal of the highest-value secrets first. Focus on accounts where compromise would expose multiple systems rather than a single login.
• Map offboarding to secret revocation Verify that leaver and contractor exit processes revoke shared keys, vault access, recovery paths, and organization-level secrets, not only user accounts. Use a control checklist that confirms the credential cannot be reused after the relationship ends.
• Test endpoint compromise as an identity failure scenario Assume one privileged laptop, browser profile, or home workstation can become the path to vault compromise or secret capture. Build tabletop exercises around that scenario and document which accounts remain reachable if one endpoint is lost.
• Separate storage security from authentication security Review whether your programme treats encrypted storage as the main control, when the real exposure sits in credential use, replay, and lifecycle. Where possible, shift to short-lived or derived credentials so the secret is not persistently available to steal.

Key takeaways

• Password manager vaults reduce user burden, but they also concentrate identity risk into a single compromise path.
• Stolen credentials remain a leading breach mechanism, which means static secrets are still an active attack surface, not a legacy problem.
• The control answer is lifecycle governance: reduce reusable secrets, tighten revocation, and remove durable credentials wherever the business can support it.

Key terms

• Password Vault: A password vault is a central store for user credentials protected by a master secret or device. It reduces user friction, but it also concentrates risk because compromise of the vault can expose many downstream accounts and create a broad identity blast radius.
• Static Secret: A secret — such as an API key or password — that does not change automatically over time. Static secrets require manual or scheduled rotation and represent a higher security risk than dynamic secrets or managed identities.
• Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
• Secret Concentration: The practice of storing many reusable credentials, tokens, or certificates in one operational platform so it can do its job across systems. This reduces friction, but it also creates a high-blast-radius target because one compromise can expose access to many dependent services.

What's in the full article

Unixi's full article covers the operational detail this post intentionally leaves for the source:

• The article breaks down the LastPass breach phases in more operational detail, including the developer laptop compromise and the privileged engineer targeting sequence.
• It compares password manager vault storage with universal single sign-on derivation, which is useful if you are evaluating architecture options rather than just policy.
• It lists specific password manager CVEs and offboarding-related failure modes that help teams connect abstract risk to concrete product and process gaps.
• It explains the KDA derivation flow and browser-extension execution model for teams that need implementation-level context before changing controls.

👉 Unixi's full article covers the LastPass breach chain, password manager CVEs, and the uSSO derivation model.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.