Why do poor password practices still create risk even when organisations use password managers?

Why This Matters for Security Teams

Password managers reduce reuse and help keep secrets out of browser notes, spreadsheets, and shared chat threads, but they do not eliminate the behavioural and governance gaps that attackers exploit. If people still choose weak passwords, re-use credentials outside the vault, or bypass policy on unmanaged accounts, the organisation still inherits exposure. That is why password hygiene remains a control issue, not just a user convenience issue.

NHIMG research shows how quickly secret sprawl becomes operational risk: the Ultimate Guide to NHIs notes that 96% of organisations store secrets outside secrets managers in vulnerable locations, and 79% have experienced secrets leaks. For security teams, the lesson is simple: a vault helps, but it cannot compensate for weak credential culture, poor access visibility, or inconsistent enforcement. The same patterns that drive NHI compromise also show up in human password misuse, especially where policy is advisory rather than enforced.

Current guidance from the NIST Cybersecurity Framework 2.0 and NIST identity controls treats credential hygiene as part of a wider access-risk program, not a one-time tooling purchase. In practice, many security teams encounter password-manager complacency only after a reused password, unmanaged account, or phishing event has already turned into an incident.

How It Works in Practice

The practical problem is that password managers address storage and reuse, but not every cause of poor credential risk. They reduce the chance that users invent simple passwords or copy them into unsafe places, yet they do not enforce strong authentication policy across all systems, stop account sharing, or guarantee that every login is protected by MFA. That is why password management has to sit inside a broader identity program.

Security teams typically get better results when they combine vaulting with policy enforcement, visibility, and recovery discipline. A workable approach includes:

• Require unique, system-generated passwords for all managed accounts and block weak-password exceptions unless there is documented business need.
• Detect unmanaged accounts and shadow credentials that sit outside the vault, especially on SaaS platforms and legacy applications.
• Use MFA and conditional access so stolen passwords alone do not become durable access.
• Review shared accounts, service accounts, and emergency credentials under the same governance model as user passwords.
• Track password policy exceptions and remediation outcomes, not just vault adoption rates.

That wider view matters because credential risk is often a lifecycle issue. The NHI Lifecycle Management Guide and the Lifecycle Processes for Managing NHIs both emphasise that secrets must be issued, rotated, reviewed, and revoked with clear ownership. That same discipline applies to human credentials: if password hygiene is not tied to onboarding, offboarding, and periodic access review, a vault only hides the problem. The NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces this by linking authentication controls to access monitoring and account management.

These controls tend to break down in organisations with many unmanaged legacy apps because those systems cannot consistently enforce modern password policy or MFA.

Common Variations and Edge Cases

Tighter password controls often increase user friction and helpdesk demand, so organisations have to balance stronger protection against operational burden. That tradeoff becomes more visible where users already struggle with login complexity, shared devices, or third-party portals that do not support modern authentication.

There is no universal standard for every exception, but current guidance suggests treating these cases as risk-based deviations rather than normal practice. Shared accounts, break-glass credentials, and vendor-admin logins are especially important because they are often exempted from normal password-manager workflows. Those accounts should have separate owners, documented rotation rules, and monitoring for abnormal use. If a team cannot explain who owns a credential, how it is rotated, and how it is revoked, the password manager is not providing meaningful control.

Behavioural gaps matter too. Password managers do not stop phishing by themselves, and they do not prevent users from approving login prompts out of habit. They also do little for local admin accounts, service credentials, or third-party systems that sit outside central identity governance. NHIMG’s Top 10 NHI Issues highlights the same structural failure pattern: security improves only when secrets are governed across their full lifecycle, not when they are merely stored in a better place.

In the real world, password managers reduce one class of exposure, but risk persists wherever people, tools, and exceptions operate outside the controls the vault can actually enforce.

Related resources from NHI Mgmt Group

• Why do non-human identities create compliance risk even when policies exist?
• When does a short-lived API key still create material risk?
• Why do OAuth and OpenID Connect integrations create IAM risk even when they reduce password use?
• Why do self-hosted password managers still create governance risk?