Notifications
Clear all
Topic starter
08/07/2026 6:53 pm
TL;DR: Password, secrets, and passkey governance are converging into one identity control plane that IAM and security teams can no longer treat separately, according to Bitwarden. Bitwarden says it has surpassed 15 million users and 80,000 businesses globally while expanding into secrets management, passkeys, and AI-driven workflows, and it is increasing R&D investment by 50% as it adds a new CTO.
NHIMG editorial — based on content published by Bitwarden: leadership changes and the future of security at Bitwarden
By the numbers:
- Today, Bitwarden serves more than 15 million users and 80,000 businesses globally.
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should organisations govern passwords, passkeys, and secrets together?
A: They should manage them as one identity trust chain, not as separate security projects.
Q: When does passkey adoption create new governance risk?
A: Risk increases when organisations treat passkeys as a pure authentication upgrade and ignore recovery, device loss, and enrolment governance.
Q: Why do secrets management and IAM need to be aligned?
A: Because a secret is a form of delegated identity, not just a stored value.
Practitioner guidance
- Map shared governance across credential types Inventory where passwords, passkeys, and secrets are managed in separate processes, then align ownership, lifecycle, and exception handling so the same identity has one accountable control path across tools.
- Harden recovery and enrolment paths Test account recovery, device replacement, and re-enrolment flows for the same assurance you expect from primary authentication, especially where passkeys or stronger authenticators are being introduced.
- Tie secrets to explicit owners and expiry events Require every secret to carry an owner, a business purpose, and a revocation condition, then review those links during offboarding, application change, and workload retirement.
What's in the full article
Bitwarden's full article covers the product and organisational detail this post intentionally leaves at the strategy level:
- How Bitwarden is structuring its expanded leadership team and engineering priorities.
- The company’s own explanation of how it sees passwordless, secrets management, and AI-driven workflows fitting together.
- Why the product portfolio is being broadened now, from the publisher's perspective.
- The leadership transition details behind the CTO change and the new innovation role.
👉 Read Bitwarden's leadership update on identity security and product expansion →
Bitwarden's CTO change and what it means for identity teams?
Explore further
08/07/2026 7:15 pm
Bitwarden's expansion reflects the convergence of human identity and machine identity governance. Passwords, passkeys, and secrets management are no longer separate operational silos when the same platform must support people, services, and workflow automation. That convergence matters because lifecycle, revocation, and assurance requirements now apply across all three identity types. Practitioners should stop treating credential security as a point solution problem and start treating it as a shared governance plane.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: How can security teams govern AI-driven workflows without losing accountability?
A: They should define the workflow as a controlled access path with named identities, approved tools, and auditable completion conditions. That lets teams trace which identity initiated the action, which secret or token was used, and which policy allowed the path. Without that mapping, accountability blurs across the workflow.
👉 Read our full editorial: Bitwarden's leadership shift reflects the next phase of identity security
