Notifications
Clear all
Topic starter
07/09/2026 4:38 pm
TL;DR: Infrastructure, backup, metadata encryption, SSO, MFA, and client hardening are the focus of Passbolt’s September check-up for inherited admins, according to PassBolt. The practical lesson is that encryption protects secrets at rest, but governance, recovery, endpoint trust, and offboarding still determine whether the system remains defensible.
NHIMG editorial — based on content published by PassBolt: You’re the Admin Now: A Security Check-Up
By the numbers:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when a secrets manager is inherited without a full security review?
A: Inherited administration often leaves gaps in host hardening, backup recovery, user offboarding, and client trust.
Q: Why do backups alone not guarantee recoverability for a credential vault?
A: Because the database is only one part of restoration.
Q: How should organisations handle offboarding in a shared password vault?
A: Remove the user, then rotate the shared credentials and confirm no dependent groups or resources still rely on the departed account.
Practitioner guidance
- Map the inherited trust boundary Document where Passbolt runs, where the database lives, which reverse proxy or load balancer sits in front of it, and which systems can reach management and database ports.
- Validate restore readiness end to end Restore the database, recover the server OpenPGP key, and confirm the organisation recovery key procedure works outside production.
- Review users and rotate shared secrets after offboarding Check active users, group ownership, and recent departures, then rotate any shared secrets those users could access before access removal.
What's in the full article
PassBolt's full article covers the operational detail this post intentionally leaves for the source:
- Exact healthcheck commands and stack-specific checks for package, Docker, Kubernetes, and VM deployments.
- Step-by-step backup and restore considerations for the database, server OpenPGP key, and organisation recovery key.
- Detailed review points for metadata encryption modes, SSO fallback paths, and MFA event handling.
- Practical endpoint checks for browser extensions, local admin rights, and device encryption.
👉 Read PassBolt's security check-up for inherited Passbolt admin access →
Inherited Passbolt admin access: what security teams should review?
Explore further
07/09/2026 4:38 pm
Inherited secrets platforms create an assurance gap, not just an administration gap. The article is really about what happens when a team takes over a credential store without taking over its control history. A running Passbolt instance can still conceal unknown firewall rules, stale users, weak recovery design, and endpoint trust problems. Practitioners should treat inherited admin access as a prompt to rebuild assurance from the bottom up.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why inherited secrets platforms need governance across users, keys, and endpoints.
A question worth separating out:
Q: How do you know whether endpoint controls are strong enough for a secrets manager?
A: Look for patched devices, controlled browser extensions, enforced disk encryption, endpoint protection, and limited local administrator rights on every machine that can decrypt secrets. If any one of those controls is missing, the endpoint remains a likely path to credential exposure.
👉 Read our full editorial: Passbolt self-hosted security check-up for inherited admin access
