How IT can reduce credential risk across every department

Note __This blog is a recap of 1Password’s recent webinar, “The credential sprawl tour: Is your department leaking secrets?” [Head here](https://1password.com/webinars/secure-every-credential) to watch the complete webinar recording.__ Credential sprawl has long been an issue IT and security teams have had to grapple with, and solutions like single-sign-on (SSO) have never been able to contain it completely. Now, AI is accelerating the problem. AI agents need access to credentials at an unprecedented scale, leaving IT and security teams struggling even more to ensure that every credential, across every department, is secure. These issues were the focus of 1Password’s recent webinar: “The credential sprawl tour: Is your department leaking secrets?” During the webinar, Sebastian Cevallos, Senior Product Marketing Manager, and Graham McKelvie, Solutions Engineer, explored how 1Password’s solutions can help IT and security teams secure and govern these unapproved or unmanaged credentials. Key takeaways from the webinar: AI didn’t create credential sprawl, but it’s accelerating it Teams like product, marketing, and finance all have complex needs when it comes to managing credential sprawl Third-party contractors and vendors are their own challenge, and overprivileged access poses increasing risk to security 1Password provides IT and security teams with the tools they need to gain oversight and governance over all of the credentials that exist outside SSO Read on for an in-depth exploration of the webinar’s key themes. Password and secrets sprawl across every department The webinar provided a department-by-department overview of how credential sprawl proliferates across teams and roles. Product: Developer secrets are used across departments AI is dramatically changing how teams manage developer secrets. As McKelvie explained, “The challenge isn’t just managing passwords anymore. It’s managing every identity, credential, API key, tokens, and all of the secrets that are powering AI-driven work.” The growing use of AI means that those secrets are being used in new ways by departments outside of engineering. For example, product managers are having to move faster than ever, and a lot of that speed comes from AI tools like ChatGPT, Claude, and Gemini, which are able to help them stress test, draft PRDs, map out user flows, and more. Unfortunately, it’s entirely possible now for a product manager to paste context into an AI prompt, and that context might include things like API keys, connection strings, staging credentials, or other sensitive information. Developer secrets pose serious risks when compromised, and IT and security teams need oversight over when and how these secrets are used, but AI is changing the secrets perimeter. As Cevallos put it, “It’s not just developers anymore who are handing secrets. It’s everyone in an organization.” Demo: How 1Password manages credential access for AI agents How can teams let an AI agent or LLM-based tool see what it needs in order to work, but still keep secrets out of that LLM’s context? This is the problem 1Password has set out to solve. To show how, Cevallos shared a pre-recorded demo in which Eric Eddy, Senior Technical Marketing Engineer, demonstrated how 1Password can serve as a trusted access layer for OpenAI’s Codex. In the demo, Eddy used Codex to build a bookstore with a Stripe checkout flow. Viewers saw Codex, while building the app, connect to the 1Password Environments MCP server. From there, 1Password was in control of authorization, keeping secrets encrypted and ensuring that credentials are only requested and authorized at runtime, while staying completely outside the context of Codex. Marketing: Unmanaged passwords can put company reputation at risk Do you know who has the password to your company’s Instagram account? What about LinkedIn or Facebook pages? Is it one person? Is it five different people? Is it someone who left the company months ago? As Cevallos explained during the webinar, social media platforms are not your typical enterprise application; they don’t support SSO and can’t integrate with your identity provider. This means that marketing teams often can’t do things the “right way,” and resort to sharing platform passwords over Slack or through other unsecure channels. None of that is auditable. Moreover, if your company’s brand account gets compromised, the attack can be particularly difficult to trace or contain, as there’s often no system of record for who has access to different accounts, whether it’s current employees or former marketing agencies. Marketing accounts often seem low stakes from a security perspective, but they’re extremely attractive to bad actors, who use stolen accounts to share malware links or otherwise damage company reputations. After a recent attack targeting business Facebook accounts, security researcher Shaked Chen stated that “...access, business identity, ad reputation, and even account recovery ha

Excerpt shown under the publisher's RSS terms · 107 words · full text and figures are on the publisher's site