Topic starter
08/07/2026 6:54 pm
TL;DR: SSO reduces login friction, but up to two-thirds of critical business applications still sit outside SSO coverage, leaving weak passwords, informal sharing, and unmanaged contractor access exposed, according to Bitwarden. The security problem is not authentication alone, but the credential layer that remains when SSO does not reach every app.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “Why SSO isn't enough”.
By the numbers:
- 53% of IT decision-makers share passwords via email, according to Bitwarden.
- 41% of IT decision-makers share passwords through chat, according to Bitwarden.
- 31% of IT decision-makers share passwords through conversation, according to Bitwarden.
Key questions
Q: What breaks when SSO does not cover every business application?
A: The enterprise loses consistent authentication, password policy enforcement, and auditability for the apps that fall outside federation.
A: Unmanaged credentials create risk because they often lack owners, rotation schedules, and audit history.
Q: What do security teams get wrong about SSO as a security control?
A: Many teams assume SSO solves both access control and password hygiene.
Practitioner guidance
- Inventory all non-SSO applications Build a living register of legacy systems, vendor portals, shadow IT accounts, and new SaaS tools that sit outside federation so each one has an explicit control owner.
- Replace informal password sharing Route shared access through governed vaults and auditable workflows so access granted by email, chat, or conversation is no longer the default.
- Separate contractor lifecycle controls Define short-term provisioning, review, and revocation steps for vendors and consultants, because SSO alone does not manage their credential lifecycle.
Bottom line: SSO improves access control for federated applications, but it does not govern the full credential estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:16 pm
SSO coverage is a governance boundary, not an enterprise security boundary. SSO reduces authentication risk only for the apps it can federate, which leaves a residual estate of legacy systems, vendor portals, shadow IT accounts, and new SaaS tools outside that control plane. The important question is no longer whether SSO is deployed, but which credentials still exist where federation does not reach. Practitioners should treat that gap as a separate governance domain.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should organisations govern contractor access when SSO is unavailable?
A: Use explicit provisioning, controlled sharing, and timed revocation for contractor credentials instead of ad hoc handoffs. Contractors should be governed through the same lifecycle discipline as other non-human or external access paths, with a clear owner, a defined end date, and an auditable record of who received what access.
👉 Read our full editorial: SSO blind spots leave credential risk outside enterprise coverage