Topic starter
08/07/2026 6:57 pm
TL;DR: A platform scaling through 50+ releases, SCIM beta, zero-knowledge metadata, secret history, and NIS2-aligned credential security work, alongside 50,000+ organisations using the product daily, according to PassBolt. The governance signal is clear: credential management is moving from storage to lifecycle control, auditability, and regulated operations.
Editorial analysis by NHI Mgmt Group, based on content published by PassBolt: “2025: A Year in Review”.
By the numbers:
- Passbolt recorded 50+ new product releases during 2025.
- Passbolt says it has 700K daily active users.
- Passbolt reported tracking at 99.97% uptime, including scheduled maintenance.
Key questions
Q: Where does credential governance fail in practice?
A: It fails when teams treat the vault as the control and ignore lifecycle events around sharing, role change, metadata exposure, and offboarding.
Q: Why does secret metadata need the same scrutiny as the secret itself?
A: Because labels, notes, and descriptions can reveal ownership, purpose, environment, or usage patterns even when the secret value is encrypted.
Q: How should IAM teams connect SCIM to credential governance?
A: They should treat SCIM as part of the access control path, not only as account synchronisation.
Practitioner guidance
- Map credential lifecycle ownership Assign clear ownership for creation, sharing, rotation, review, and retirement of shared credentials so no step depends on informal administrator practice.
- Test SCIM against access changes Validate that joiner, mover, and leaver events actually update shared credential access instead of only synchronising directory objects.
- Classify metadata as sensitive Review names, notes, and descriptions attached to secrets and decide whether they belong under the same protection standard as the secret itself.
Bottom line: Passbolt’s 2025 review shows credential governance evolving from storage-centric administration into lifecycle control with auditability and policy enforcement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:19 pm
Credential governance is becoming a lifecycle discipline, not a storage problem. Passbolt’s 2025 roadmap shows that the centre of gravity has moved from protecting a vault to governing how credentials are provisioned, described, shared, and audited. That is the correct direction for teams that need defensible access control, because the failure mode in modern environments is rarely secret storage alone. The practitioner takeaway is that credential programmes now succeed or fail on lifecycle control.
A question worth separating out:
Q: What do security teams need from credential history for audits?
A: They need a visible record of who changed what, when it changed, and how group membership or role assignments affected access. That history supports certification, incident review, and accountability. Without it, a team can only report current state, which is usually insufficient for regulated or high-trust environments.
👉 Read our full editorial: Passbolt’s 2025 review shows credential governance maturing