The password manager the enterprise has been quietly deploying has been quietly developing a second life, the life the security team has been hoping for, the life the passkey has been quietly trying to replace. The honest framing matters here, because the password manager the enterprise has been treating as the credential vault the enterprise has been deploying sits as the password manager the enterprise has been quietly evolving into the identity platform the enterprise has been needing.
What follows runs as the working version of the field guide. The shorter version is what the security team and the IT team actually have time to read.
What the password manager now does
Three things, in roughly that order of how much each one matters. The first runs as the password vault, where the vault the password manager has been providing, the vault the user has been using, the vault that stores the credential, the vault that generates the password, the vault the user has been using for years, the vault the password manager has been doing since the start. The second runs as the passkey holder, where the holder the password manager has been becoming, the holder that stores the passkey the user has been migrating to, the holder that syncs the passkey across the device the user uses, the holder the password manager has been quietly turning into the standard the user can rely on. The third runs as the identity broker, where the broker the password manager has been growing into, the broker that the user uses to log into the application, the broker that holds the credential, the broker that hands the credential to the application the user wants, the broker the user has been treating as the next step the password manager has been quietly taking.
What the password manager should do
Three things, in roughly that order of how much each one matters. The first runs as the shared credential, where the credential the team has been using, the credential the team has been sharing the way the team has been sharing the password, the shared credential the password manager has been supporting, the shared credential the password manager should be treating as the team account the password manager should be managing the way the identity provider manages the team account. The second runs as the secret rotation, where the rotation the password manager has been quietly doing for the user, the rotation the password manager should be doing for the team, the rotation the password manager should be running on the schedule the security team has been specifying, the rotation the password manager should be doing automatically without the user knowing. The third runs as the access request, where the request the user has been submitting, the request the user has been sending the way the user has been sending the email, the request the password manager should be turning into the workflow the password manager should be integrating with the ticketing system, the request the password manager should be making seamless.
How to make the second life work
Three moves if you are the security or IT team that wants the password manager the enterprise has been deploying to deliver the second life the security team has been hoping for. Pick the enterprise tier, where the tier the security team should be selecting, the tier the security team should be paying for, the tier the vendor offers the security team the management, the policy, the integration the security team has been needing, the tier the security team can deploy in a quarter. Enable the passkey sync, where the sync the IT team should be turning on, the sync the user needs to migrate to the passkey, the sync the IT team should be configuring the way the IT team configures the rest of the identity stack, the sync the IT team can enable in a day. Integrate the access request, where the request the IT team should be wiring up, the request the user submits the way the user submits the ticket, the request the IT team should be routing through the ticketing system, the request the IT team can integrate in a sprint. The team that picks the tier, enables the sync, and integrates the request serves as the team that has made the second life of the password manager actually work.
The bottom line
Password manager in 2026 sits as the tool the enterprise has been quietly evolving. The password vault, the passkey holder, the identity broker, those three are what it now does. The shared credential, the secret rotation, the access request, those three are what it should do. The enterprise tier, the passkey sync, the access request integration, those three are the moves. The team that does the three delivers the second life. The team that has the consumer tier does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
