Where the data actually lives today
Most organizations know where passwords should be stored. Fewer know where they actually are.
Spreadsheets on a file server. Chat messages. A text file on a technician's desktop. A shared note written four years ago that no one dares to delete because something might still need it.
The inventory process is uncomfortable but necessary, and it usually reveals how many accounts are still active despite not being used for years.
Zero Knowledge – what it means in practice
Zero Knowledge means that data is encrypted on your device before it leaves, and that the encryption keys are never held by the provider.
The consequence is concrete: even in the event of a breach at the provider, there is nothing readable to retrieve. It is worth asking about when comparing password managers, as not all of them are built this way.
Sharing is the whole point
A password manager that only protects the individual user solves half the problem. What makes a difference in an organization is controlled sharing: who gets to see what, in which team, and for how long.
You need to be able to answer who retrieved which credential and when. Without that log, neither an audit nor an incident investigation can be carried out properly.
Offboarding is the test
The day someone leaves is when you see how well your access management works.
With centralized management, access is revoked in one place. Without it, someone has to try to remember which systems the person had access to, and that list is never complete.
A forgotten account is both a security risk and an unnecessary license cost. Linked to an automation workflow , revocation becomes a part of the offboarding process instead of a task someone has to remember to do.
Password manager or documentation system?
A question we get often, especially from MSPs.
Documentation systems can handle sensitive data as part of their documentation and do it well. A dedicated password manager is built solely for that purpose and goes deeper: Zero Knowledge, granular sharing, policy management, and the handling of certificates and keys beyond just passwords.
Many run both, keeping documentation in one place and login credentials in another. The identity layer is effectively the first step in a functional security architecture.
