Notifications
Clear all
Topic starter
09/07/2026 3:20 pm
TL;DR: Navigation in vault interfaces is being reorganised to separate personal and organisation views, add ownership cues such as a vault filter and ownership column, and reduce confusion when managing credentials, according to Bitwarden research. The broader lesson is that identity interfaces fail when ownership, scope, and administrative pathways are not visually distinct.
NHIMG editorial — based on content published by Bitwarden: the vault refresh update on user feedback, ownership clarity, and Web Vault navigation
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
- 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits.
Questions worth separating out
Q: How should security teams design vault interfaces for shared credentials?
A: Security teams should make ownership, scope, and role pathways visible at the point of use.
Q: Why do shared vaults create governance risk for identity teams?
A: Shared vaults create governance risk when users cannot clearly distinguish who owns a secret and which workflow applies.
Q: What breaks when ownership is unclear in a secrets platform?
A: When ownership is unclear, users may store secrets in the wrong vault, share them through the wrong channel, or fail to apply the right administrative process.
Practitioner guidance
- Separate ownership from access in the UI Display owner, vault scope, and sharing status together wherever a credential is viewed or edited so users can act without guessing which governance path applies.
- Route administrators through a distinct control path Place admin tools, reports, and organisation settings behind a clearly separated navigation path so operational users do not mix governance actions with day-to-day vault use.
- Test role-specific workflows before rollout Validate changes with tasks for organisation administrators, premium users, and standard members to confirm that each role understands item ownership, collections, and group relationships.
What's in the full article
Bitwarden's full post covers the design decisions and workflow changes this analysis intentionally leaves at a higher level:
- Detailed before-and-after vault navigation changes for organisation administrators and standard members.
- Prototype testing observations showing where users struggled with item ownership and page structure.
- The updated separation of subscription, billing, security, and organisation management content.
- The remaining roadmap gap around relationships between items, collections, users, and groups.
👉 Read Bitwarden's vault refresh update on ownership, navigation, and security settings →
Vault refresh and item ownership: what IAM teams should notice?
Explore further
09/07/2026 3:38 pm
Ownership ambiguity is a governance defect, not a UX inconvenience. When users cannot immediately distinguish personal items from organisation-owned credentials, the probability of mis-shared or mismanaged secrets rises. That problem is especially pronounced in shared vault environments where stewardship is split across individual users and administrators. The implication is that credential ownership must be treated as a first-class governance signal, not an optional display detail.
A few things that frame the scale:
- 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- Our research also found that 91% of former employee tokens remain active after offboarding, showing how lifecycle failures can outlast the original access event.
A question worth separating out:
Q: How can organisations reduce mistakes in vault and IAM navigation?
A: Organisations should separate end-user actions from administrative actions and test those paths with real role-based tasks before release. The aim is to ensure that users can find reports, settings, and ownership details without confusing governance functions with routine access.
👉 Read our full editorial: Bitwarden vault refresh clarifies organisation and item ownership
