Notifications
Clear all
Topic starter
10/06/2026 11:28 pm
TL;DR: Credential security now extends beyond password storage into shared logins, third-party access, developer secrets, and provisioning workflows that often sit outside traditional SSO coverage, according to 1Password. The governance problem is no longer vaulting alone; it is whether credential lifecycle, monitoring, and secrets handling are treated as identity controls rather than convenience features.
NHIMG editorial — based on content published by 1Password: Bitwarden vs 1Password, an enterprise password manager comparison
Questions worth separating out
Q: How should security teams govern shared credentials used by contractors and auditors?
A: Treat shared credentials as governed access, not informal convenience.
Q: Why do password managers matter to NHI governance?
A: Because modern password managers increasingly store and distribute API keys, SSH keys, tokens, and other non-human credentials.
Q: What breaks when secrets management is split from access governance?
A: Fragmentation creates blind spots.
Practitioner guidance
- Map every credential type to an owner and lifecycle state Inventory passwords, shared logins, API tokens, SSH keys, and passkeys separately, then assign a lifecycle owner for each credential class.
- Review third-party sharing paths as if they were standing access channels Document how contractors, auditors, and temporary collaborators receive credentials, then verify revocation, expiration, and visibility for each path.
- Tie secret management to SIEM and audit workflows Forward sign-in attempts, item usage, and administrative events into monitoring so credential activity is reviewed alongside other identity events.
What's in the full article
1Password's full comparison covers the operational detail this post intentionally leaves for the source:
- Feature-level differences in guest access, SIEM integrations, and developer tooling that matter when selecting a platform for implementation.
- Product-specific provisioning and connector behaviour for teams that need to understand operational maintenance overhead.
- Browser extension and phishing-defense details that help teams compare day-to-day user experience and control coverage.
- Plan-level distinctions in secrets management and support that affect rollout decisions for larger organisations.
👉 Read 1Password's comparison of enterprise password managers and credential governance →
Password managers and credential governance: what IAM teams need now?
Explore further
12/06/2026 5:28 am
Password manager governance has become identity governance because credential sprawl now crosses human, NHI, and developer boundaries. The article is not really about choosing a vault, it is about where credentials live after SSO stops being the centre of gravity. Shared logins, API tokens, SSH keys, and contractor access all behave as governed identity artefacts once they can outlive the session or role that created them. Practitioners should treat this as a lifecycle and visibility problem, not a storage preference.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, 38% have no or low visibility, and a further 47% have only partial visibility, according to The State of Non-Human Identity Security.
- A separate finding from the same research shows that 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months.
A question worth separating out:
Q: How do IAM teams know whether a provisioning path is actually working?
A: Look for drift between the identity source of truth and the access state in the vault or directory connector. If removed users, role changes, or third-party exits still leave accessible credentials behind, provisioning is not enforcing policy. Healthy provisioning produces timely revocation, clear audit trails, and minimal manual repair.
👉 Read our full editorial: Password manager governance is now identity governance, not storage
