Topic starter
08/07/2026 6:53 pm
TL;DR: Password, secrets, and passkey governance are converging into one identity control plane that IAM and security teams can no longer treat separately, according to Bitwarden. Bitwarden says it has surpassed 15 million users and 80,000 businesses globally while expanding into secrets management, passkeys, and AI-driven workflows, and it is increasing R&D investment by 50% as it adds a new CTO.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “Accelerating innovation at Bitwarden”.
By the numbers:
- Bitwarden says it serves more than 15 million users and 80,000 businesses globally.
Key questions
Q: How should organisations govern passwords, passkeys, and secrets together?
A: They should manage them as one identity trust chain, not as separate security projects.
Q: When do passkeys improve security but still leave governance gaps?
A: Passkeys improve security when they replace reusable secrets, but governance gaps remain if fallback authentication, recovery, or exception handling still relies on passwords or OTPs.
Q: What are the signs that secrets and human access are being managed in silos?
A: The clearest signs are duplicated entitlement reviews, inconsistent offboarding rules, separate ownership for similar access paths, and different approval standards for human and machine credentials.
Practitioner guidance
- Define one governance model for multiple credential types Map passwords, passkeys, secrets, and workflow-mediated access to a shared policy model, but keep separate lifecycle rules where control requirements differ.
- Inventory all identity artefacts under a single ownership model Track who owns each credential class, who can issue it, who can revoke it, and which team is accountable when it is used in production.
- Separate authentication design from lifecycle governance Treat passkey adoption as part of identity governance, not a standalone authentication refresh, so enrollment, recovery, and revocation stay in scope.
Bottom line: Bitwarden's leadership change is best read as a signal that identity security is broadening beyond password management into a wider governance model for credentials, secrets, and access workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:15 pm
Identity security is becoming a control-plane problem, not a point-product problem. Bitwarden's expansion across passwords, secrets, passkeys, and AI-driven workflows reflects a broader market shift in which identity governance spans human and non-human access artifacts together. The operational question is no longer which team owns which credential type, but whether policy, inventory, and revocation can be enforced coherently across them. Practitioners should plan for shared governance even when implementation remains federated.
A question worth separating out:
Q: What should organisations do before allowing AI to draft identity workflows?
A: They should validate role boundaries, approval chains, and data visibility first. Workflow drafting can be helpful, but only if the assistant stays inside the same access model the organisation already trusts. If a draft can bypass review, widen entitlements, or expose privileged context, the control design is incomplete.
👉 Read our full editorial: Bitwarden's leadership shift reflects the next phase of identity security