Business password manager: access that stays with the company

Because all it takes is a list. The company email password is a variation of the ERP one; the ERP one is the same as that of a personal online shop that suffered a data breach two years ago; that list is up for sale. All anyone has to do is try it.

The root of the problem is arithmetic. Each employee handles 30 to 80 credentials: email, management software, supplier portals, online banking, cloud applications, Wi-Fi, printers, the brand’s social networks. Nobody keeps 80 long, distinct passwords in their head, and the improvised solution is always the same, reuse them, write them on a note stuck to the monitor or create a “passwords.xlsx”.

• Team vaults Access to the tax portal, the ads account or the router belongs to the company, not to someone’s memory. A departure no longer means lost access.
• Admin console The company adds and removes users, enforces rules such as minimum length and mandatory MFA, and recovers vaults when needed.
• Usage audit A record of who opened which credential and when, information that an audit or NIS2 will ask for.
• Hygiene warnings Weak, reused or breached passwords are flagged.
• Microsoft 365 integration Sign-in uses the corporate account, and blocking that account also blocks access to the vault.

• Zero-knowledge End-to-end encryption: not even the provider can see what is in the vaults.
• Enforced MFA For all users, without exception.
• Group permissions One vault per department, with controlled access.
• On every screen Browser extension and smartphone app.
• Governance Administrative recovery and an exportable activity history.
• Data protection Company and infrastructure in the EU, or guarantees equivalent to the GDPR.
• Stable cost Per-user pricing, with no surprises.

Proven business solutions meet virtually all of these requirements. The deciding factor ends up being usability, because that is what determines real adoption. One alternative to rule out: the shared file, even if encrypted, no history, no recovery and impossible to scale.

1. Week one: foundations: choose the solution, create the organisation, integrate with Microsoft 365 and set the rules (mandatory MFA, minimum 14 characters). Open vaults per department and move across the credentials currently held in spreadsheets and on paper. Admin credentials (firewall, switches, servers, domains) go into a vault restricted to the IT team.
2. Week two: pilot group: five to ten people from different areas, including at least one member of management. A 20-minute session, installation of the extension and the app, import of passwords saved in the browser. Everything that raised questions is noted.
3. Week three: roll-out: 20-minute sessions per group and a single rule: from now on, every new password comes from the manager, and old reused ones are changed as they are used. Demanding that everything be changed on day one is a recipe for rejection.

• No explanation What is not understood gets worked around.
• The browser forgotten If old passwords remain in Chrome or Edge, the user has two sources and abandons the new one.
• No shared vaults Credentials keep circulating by email.
• Smartphone ignored Half of all access already happens on the phone.
• Browser autofill left on It competes with the manager and is less secure.

All new services and most old ones now have long, unique passwords. Nobody needs to know anyone else’s password. An employee leaving becomes a matter of minutes: the account is blocked and the shared vaults remain in the company’s hands.

Password reset requests to the helpdesk almost disappear. And when the insurer or a NIS2 process asks how credentials are managed, there is a documented answer.

It is the second layer of identity protection, right after two-step verification (MFA). MFA stops the attacker even if the password is stolen; the manager prevents the password from being weak or reused. The two measures are the starting point of the four-step Zero Trust model for SMEs and underpin the password rule described in the seven internal policies every company should have.

In managed cybersecurity contracts from DataRoad - IT Services and Consulting, implementing the manager and administering the IT vaults are included in the service.

We choose the solution with you, configure the organisation and vaults and run the sessions with your team. Find out more about our cybersecurity and managed firewalls. No-obligation proposal.

More than 10 workstations · support contract · remote, on-site and telephone support.

Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.