Notifications
Clear all
Topic starter
08/07/2026 7:04 pm
TL;DR: Startup account sprawl, shared plaintext passwords, and poor ownership tracking create handoff risk during acquisitions, according to Bitwarden’s Q&A with entrepreneur Craig Pearce, while a password manager can centralise transfer into a single vault. The lesson is that password governance is a lifecycle control, not just a convenience feature.
NHIMG editorial — based on content published by Bitwarden: a Q&A on password manager use during startup growth and acquisition handoff
By the numbers:
- My personal account has over 270 items now.
Questions worth separating out
Q: How should startups manage shared passwords during growth and acquisition?
A: Startups should keep every shared password in a managed vault, assign one accountable owner per account, and define how access is transferred during growth, sale, or staff exit.
Q: Why do plain-text password documents create governance risk?
A: Plain-text documents create governance risk because anyone with the file can copy, forward, or retain credentials without control.
Q: When should organisations move from ad hoc sharing to a password manager?
A: Organisations should move to a password manager as soon as credentials support more than one person, more than one system, or any business-critical process.
Practitioner guidance
- Eliminate plaintext credential storage Move every password, shared login, and recovery credential out of documents, chat threads, and email into a managed vault with access logging and controlled sharing.
- Assign ownership for every shared account Record one accountable owner, the business purpose, and the offboarding path for each account so access can be reviewed and transferred without guesswork.
- Build acquisition handoff runbooks Define how credentials, admin roles, and recovery factors are transferred during a sale, merger, or team exit before the event happens.
What's in the full article
Bitwarden's full Q&A covers the operational detail this post intentionally leaves for the source:
- Craig Pearce’s first-hand account of transferring hundreds of logins during an acquisition.
- The practical difference between using a password manager for personal accounts and using it for business handoff.
- The startup workflow that moved from a shared document to a single vaulted password handoff.
- The human side of account cleanup when one business is sold and another is still operating.
👉 Read Bitwarden’s Q&A on startup password handoff and acquisition readiness →
Password managers and startup acquisitions: what IAM teams should notice?
Explore further
08/07/2026 7:27 pm
Plaintext password management is a lifecycle failure, not just a bad habit. The article shows a startup using a Google document to store credentials, which removed control over who could see, copy, or retain access. That is an access governance failure because the organisation had no durable ownership model for the accounts it depended on. The practitioner lesson is to treat credential storage as part of lifecycle control, not office administration.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: What is the difference between storing passwords securely and governing access well?
A: Secure storage protects the secret itself, while access governance controls who can see it, when it changes hands, and how it is revoked. A business can encrypt a file and still have poor governance if ownership is unclear or sharing is uncontrolled. Good governance adds accountability, lifecycle management, and review.
👉 Read our full editorial: Password managers reduce startup account handoff risk during acquisitions
