In this article
For the board, a business password manager solves a risk and a dependency at the same time. The risk: the reused credential, which is the cheapest way into an SME. The dependency: critical access that only one person knows and that walks out of the door with them. The tool stores credentials encrypted, creates a strong and different password for each service and fills it in automatically; each employee memorises only the master password, protected by MFA. Properly implemented, it is a cybersecurity measure the team welcomes rather than works around.
Why is the reused password an SME’s biggest risk?
Because all it takes is a list. The company email password is a variation of the ERP one; the ERP one is the same as that of a personal online shop that suffered a data breach two years ago; that list is up for sale. All anyone has to do is try it.
The root of the problem is arithmetic. Each employee handles 30 to 80 credentials: email, management software, supplier portals, online banking, cloud applications, Wi-Fi, printers, the brand’s social networks. Nobody keeps 80 long, distinct passwords in their head, and the improvised solution is always the same — reuse them, write them on a note stuck to the monitor or create a “passwords.xlsx”.
What separates a business solution from a personal app?
- Team vaults Access to the tax portal, the ads account or the router belongs to the company, not to someone’s memory. A departure no longer means lost access.
- Admin console The company adds and removes users, enforces rules such as minimum length and mandatory MFA, and recovers vaults when needed.
- Usage audit A record of who opened which credential and when, information that an audit or NIS2 will ask for.
- Hygiene warnings Weak, reused or breached passwords are flagged.
- Microsoft 365 integration Sign-in uses the corporate account, and blocking that account also blocks access to the vault.
Which criteria should weigh in the choice?
- Zero-knowledge End-to-end encryption: not even the provider can see what is in the vaults.
- Enforced MFA For all users, without exception.
- Group permissions One vault per department, with controlled access.
- On every screen Browser extension and smartphone app.
- Governance Administrative recovery and an exportable activity history.
- Data protection Company and infrastructure in the EU, or guarantees equivalent to the GDPR.
- Stable cost Per-user pricing, with no surprises.
Proven business solutions meet virtually all of these requirements. The deciding factor ends up being usability, because that is what determines real adoption. One alternative to rule out: the shared file, even if encrypted — no history, no recovery and impossible to scale.
How do you get it running in three weeks?
- Week one: foundations — choose the solution, create the organisation, integrate with Microsoft 365 and set the rules (mandatory MFA, minimum 14 characters). Open vaults per department and move across the credentials currently held in spreadsheets and on paper. Admin credentials — firewall, switches, servers, domains — go into a vault restricted to the IT team.
- Week two: pilot group — five to ten people from different areas, including at least one member of management. A 20-minute session, installation of the extension and the app, import of passwords saved in the browser. Everything that raised questions is noted.
- Week three: roll-out — 20-minute sessions per group and a single rule: from now on, every new password comes from the manager, and old reused ones are changed as they are used. Demanding that everything be changed on day one is a recipe for rejection.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Why do these projects fail?
- No explanation What is not understood gets worked around.
- The browser forgotten If old passwords remain in Chrome or Edge, the user has two sources and abandons the new one.
- No shared vaults Credentials keep circulating by email.
- Smartphone ignored Half of all access already happens on the phone.
- Browser autofill left on It competes with the manager and is less secure.
What difference shows after a quarter?
All new services and most old ones now have long, unique passwords. Nobody needs to know anyone else’s password. An employee leaving becomes a matter of minutes: the account is blocked and the shared vaults remain in the company’s hands.
Password reset requests to the helpdesk almost disappear. And when the insurer or a NIS2 process asks how credentials are managed, there is a documented answer.
Where does it fit in the identity strategy?
It is the second layer of identity protection, right after two-step verification (MFA). MFA stops the attacker even if the password is stolen; the manager prevents the password from being weak or reused. The two measures are the starting point of the four-step Zero Trust model for SMEs and underpin the password rule described in the seven internal policies every company should have.
In managed cybersecurity contracts from DataRoad - IT Services and Consulting, implementing the manager and administering the IT vaults are included in the service.
Frequently asked questions
What if the password manager provider itself is attacked?
With end-to-end encryption, the attacker only gets unreadable vaults that only each user’s master password can open. That is why the master password must be long and MFA is mandatory.
Is the manager built into Chrome or Edge enough for a company?
No. It is fine for personal use, but it offers no team vaults, admin console, history or recovery, and it is tied to one browser and one individual account.
What happens if an employee forgets their master password?
A designated administrator restores their access through administrative recovery, a feature only business editions offer.
What does it cost?
As a rule, a few euros per user per month. The comparison is a single incident with stolen credentials, or losing access to the tax portal because the only person who knew the password has left.
Next step: a password manager your team actually uses
We choose the solution with you, configure the organisation and vaults and run the sessions with your team. Find out more about our cybersecurity and managed firewalls. No-obligation proposal.
More than 10 workstations · support contract · remote, on-site and telephone support.
Call +351 211 459 950* or write to sales@dataroad.pt.
*Call to a Portuguese landline.
