Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Centralized password vaults reduce password sprawl but do not control what happens after authentication, according to Unixi’s analysis of AiTM phishing, SaaS coverage gaps, and session-token theft. The real governance problem is that static secrets and post-login blind spots persist long after the login itself appears secure.
NHIMG editorial — based on content published by Unixi: password vaults and post-login risk in enterprise credential management
By the numbers:
- In April 2026, Microsoft documented an Adversary-in-the-Middle phishing campaign that targeted over 35,000 users across 13,000 organisations over three days.
- Even a fully deployed password vault typically covers only 15% to 30% of an enterprise’s actual web footprint.
- Somewhere between 50% and 85% of enterprise applications simply don’t support the SAML or OIDC standards that traditional SSO and IdPs rely on.
Questions worth separating out
Q: How should IAM teams reduce risk when password vaults do not control post-login sessions?
A: Treat the vault as one layer, not the control objective.
Q: Why do SaaS apps create identity governance gaps?
A: SaaS apps create governance gaps because access often expands through delegated permissions, shadow IT, and untracked app ownership.
Q: When should organisations move beyond password vaulting?
A: When the main risk is no longer password theft but session compromise, credential relay, or access sprawl across SaaS applications.
Practitioner guidance
- Map post-login control gaps Identify where your current IAM stack stops at authentication and does not govern the browser session, token, or application activity that follows.
- Separate federated and non-federated apps Build a distinct inventory for applications that do not support SAML or OIDC, because these are the places where reusable credentials and exceptions accumulate fastest.
- Reduce reliance on reusable secrets Target the systems that still depend on static passwords or shared credentials and move them toward dynamic, application-specific authentication where operationally feasible.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- The specific arithmetic behind the 15% to 30% application coverage estimate for password vaults and how it maps to real enterprise web footprints.
- The detailed comparison of password manager coverage against SAML and OIDC adoption gaps across SaaS applications.
- The Key Derived Authentication model and how dynamic passphrases are generated at login time without a stored central secret.
- The pricing examples and portal-by-portal coverage issues that explain why many applications remain outside traditional SSO deployment.
👉 Read Unixi's analysis of password vault limits and post-login risk →
Password vaults and post-login risk: what IAM teams are missing?
Explore further
14/09/2026 10:10 am
Static credential centralisation is not identity governance. The article exposes a common enterprise assumption that putting passwords in a vault meaningfully governs access. That assumption fails because the security boundary moves after login, and the vault has no authority over the authenticated session. Practitioners should treat vaulting as a hygiene control, not as the governance layer for access.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to the 2024 Non-Human Identity Security Report.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts.
A question worth separating out:
Q: What is the difference between protecting a password and governing a session?
A: Protecting a password means keeping the secret from being exposed or reused easily. Governing a session means controlling what happens after the user authenticates, including token use, browser activity, and downstream application access. That distinction matters because many modern attacks exploit the session outcome, not the password itself.
👉 Read our full editorial: Password vaults create a session-level blind spot for enterprise IAM
