Topic starter
12/06/2026 12:23 am
TL;DR: Duke University tripled enrollment after migrating to a new password manager, while security teams still found groups sharing vaults, mixing personal and work accounts, and bypassing consistent password hygiene, according to 1Password. The lesson is that password security improves only when usability and governance are aligned, not when tools exist in name only.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “How great usability tripled Duke University's password manager adoption”.
Key questions
Q: Why do password managers fail when users do not change their workflows?
A: Password managers only reduce risk when they are actually used the same way across teams.
Q: When does password-manager adoption stop being a security improvement?
A: It stops being a meaningful security improvement when usage is optional in practice.
Q: What breaks when shared password vaults have no clear owner?
A: Accountability breaks.
Practitioner guidance
- Standardise vault ownership Require every shared vault to have a named business owner, a documented purpose, and a defined membership review process.
- Separate personal and work identities Prohibit storage of organisational credentials in personal vaults for users who handle corporate systems or data.
- Build onboarding around workflow habit Add short, role-based training that shows how to generate, save, and share passwords inside the approved workflow.
Bottom line: Duke's experience shows that password-manager rollout can improve coverage without fixing the underlying governance model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:35 am
Adoption is not governance. This case shows that password-manager rollout can improve convenience while leaving security controls inconsistent. A programme can increase enrollment and still fail to standardise account separation, vault ownership, and expected usage. The practitioner lesson is to treat adoption as a leading indicator, not evidence that the control is operating as intended.
A question worth separating out:
Q: How should IAM teams handle shared passwords and shared credentials?
A: IAM teams should treat shared passwords as a control exception that increases risk and weakens accountability. If shared access is unavoidable, it needs a documented owner, tight privilege boundaries, frequent review, and a clear plan to eliminate it. The safer default is to move to individual accountability or privileged session controls.
👉 Read our full editorial: Password manager adoption at Duke shows the security-user experience gap
This post was modified 1 day ago by NHI Mgmt Group