Notifications
Clear all
Topic starter
11/08/2026 3:16 pm
TL;DR: Password vaults do not stop adversary-in-the-middle phishing when users can still copy and paste credentials or tokens into a fake login flow, according to Unixi. The core problem is not secret storage but human-readable secrets, which makes hidden authentication and phishing-resistant access the more durable control model.
NHIMG editorial — based on content published by Unixi: Hidden authentication exposes the limits of password vault governance
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities , 46% confirmed, 26% suspected.
Questions worth separating out
Q: How should security teams reduce password risk when AI can scale phishing and impersonation?
A: Security teams should focus on removing reusable credentials from the identity path, not just adding stronger verification on top of them.
Q: Why do password managers still leave organisations exposed to phishing?
A: Because they protect storage, not disclosure.
Q: What breaks when legacy MFA is paired with proxy-based phishing attacks?
A: The authentication event can still succeed even though the site is malicious, because the proxy relays the legitimate challenge and captures the resulting session material.
Practitioner guidance
- Map all copyable credential paths Identify every login flow where a user can see, copy, paste, read, or relay a secret.
- Test for AiTM resistance, not just MFA presence Run controlled phishing simulations that specifically attempt token capture and session replay.
- Move privileged access to non-transferable authentication Use domain-bound, device-bound, or hardware-backed authentication for administrative and finance workflows.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- The article's explanation of Key Derived Authentication and how it is positioned as a hidden-authentication model for web access.
- The browser-extension workflow and how it changes the login experience for legacy and non-SAML applications.
- The article's discussion of cryptographic domain binding and why the author argues it resists spoofed login pages.
- The operational claims about helpdesk reduction, user friction, and insurance impact that sit beyond this post's governance focus.
👉 Read Unixi's analysis of hidden authentication and AiTM phishing →
Password vaults and AiTM phishing: are your controls keeping up?
Explore further
11/08/2026 3:28 pm
Copyable credentials are the vulnerability, not the vault. Password managers reduce storage risk, but they do not eliminate the moment of disclosure that AiTM phishing exploits. The control assumption is that a secret can be safely protected if it is encrypted at rest, but the article shows that the real failure occurs when a human can still reveal it in session. Practitioners should stop treating vaulting as an endpoint control and treat it as only one layer in a broader identity chain.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 59% of infrastructure leaders cite "confidently wrong" AI configuration as their top fear, showing that over-trust in identity automation is already a governance problem.
A question worth separating out:
Q: Which frameworks require stronger treatment of credential and session risk?
A: NIST Cybersecurity Framework 2.0, ISO/IEC 27001:2022, and NIST SP 800-63 all support stronger authentication and access control design. Teams should use them to justify phishing-resistant access for sensitive roles and to prove that identity controls are measured against attack behaviour, not policy presence alone.
👉 Read our full editorial: Hidden authentication exposes the limits of password vault governance
