Topic starter
14/09/2026 10:09 am
TL;DR: AiTM phishing can still steal active session tokens after login, Unixi argues, even when password vaults improve credential hygiene. Session governance must extend beyond secret storage to cover authenticated access across SaaS apps.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “Why Centralizing Passwords Just Centralizes Risk”.
Key questions
Q: Why do AiTM phishing attacks still work when organisations use password vaults?
A: AiTM attacks steal the usable session after authentication, not the password in transit.
Q: How can IAM teams tell whether vault deployment is actually reducing risk?
A: They should test whether the vault is only improving password handling or whether it also reduces exposure across the authenticated application estate.
Q: What breaks when a password vault is treated as full IAM coverage?
A: The programme stops at secret custody and leaves authenticated sessions ungoverned.
Practitioner guidance
- Define the session-control boundary Document where your vault stops and where authenticated session governance begins, including browser sessions, cookies, and token handling.
- Map unmanaged SaaS coverage Identify browser-based applications that are outside SSO, IdP, or vault-managed workflows so you can quantify the post-login blind spot.
- Separate password hygiene from session security Treat secret storage, MFA, and session protection as different control layers and verify that each is independently covered.
Bottom line: Password vaults improve credential hygiene, but they do not govern the authenticated session that follows login.
Glossary terms: Session Governance, Adversary-in-the-middle phishing, Reusable Secret, Post-Authentication Control Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
14/09/2026 10:10 am
Session governance is the real boundary password vaults fail to cross. Vaults were designed to manage credential custody, not authenticated session behaviour. That assumption fails as soon as attackers target the token or cookie emitted after login, because the enterprise has secured the secret but not the resulting identity state. The implication is that IAM programmes must treat post-login control as its own governance domain, not as an extension of password management.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: Should teams prioritise passwordless access or session governance first?
A: If workers already use shared devices, session governance often deserves attention first because it limits exposure even when authentication improves. Passwordless can reduce friction, but long timeouts and persistent sessions still create avoidable risk. The two controls work best together, but session control can cut exposure immediately.
👉 Read our full editorial: Password vaults create a session-level blind spot for enterprise IAM