Topic starter
09/07/2026 3:22 pm
TL;DR: Even security-savvy users can resist moving from handwritten passwords to a password manager because emotional attachment, not just technical understanding, governs adoption, according to Bitwarden. The lesson for identity teams is that IAM change programmes fail when they treat human behaviour as a documentation problem instead of a workflow and habit problem.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “Bringing Bitwarden Home…to Mom”.
Key questions
Q: How should organisations improve password manager adoption in large environments?
A: Focus on workflow fit, onboarding support, and platform consistency.
Q: Why do people resist password changes even when they know the risks?
A: Because identity behaviour is shaped by routine, comfort, and perceived effort, not just by risk awareness.
Q: What are the signs that an identity rollout is failing?
A: Look for users reverting to handwritten credentials, stalling on setup, or abandoning the new process after the first unfamiliar step.
Practitioner guidance
- Design rollout around one visible use case Start with a single, high-frequency login that lets users experience the benefit of the new credential workflow before asking for a full migration.
- Replace technical explanation with guided action Show the new credential process in use before unpacking terminology so users associate the change with a familiar task rather than a technical concept.
- Break migration into reachable milestones Sequence onboarding so each step is small, specific, and immediately successful, instead of pushing one large import or wholesale behaviour shift.
Bottom line: The article shows that password change resistance is often driven by habit, comfort, and workflow friction rather than by ignorance of security risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:40 pm
Password adoption fails when IAM programmes confuse control quality with behaviour change: A strong credential control does not matter if users keep their secrets outside the governed workflow. The article shows that emotional comfort, not technical literacy, can block adoption even after a user understands the risk. For IAM teams, the discipline is to treat user transition as part of control design, not as an afterthought.
A question worth separating out:
Q: Should IAM teams prioritise convenience or security when changing user behaviour?
A: They should do both at once, because adoption depends on perceived utility as much as control strength. A secure workflow that feels harder to use will trigger resistance, while a convenient one that visibly improves everyday tasks is far more likely to stick. The best programmes reduce friction without weakening governance.
👉 Read our full editorial: Password change resistance shows why IAM adoption is hard