Ana Moore

The city of Melle, a municipality in Lower Saxony with more than 48,000 residents, is recognized for its modern approach to city administration and citizen services. The local government manages a wide range of responsibilities: urban development, education, social care, environmental protection, cultural initiatives, municipal infrastructure, and economic support for the region.

In recent years, Melle has invested heavily in digital transformation, introducing online citizen services, modernizing internal administrative workflows, and improving the technological foundation that supports daily municipal operations. The administration is known for its commitment to transparency, efficiency, and service quality — regularly receiving positive recognition from residents for its well-organized city services and proactive, solutions-oriented governance.

As a city institution, the administration is committed to upholding the highest standards of data protection and operational integrity. The city's IT team continuously seeks to implement modern technologies that streamline workflows, enhance security, and support its employees in their daily tasks. This commitment led them to reevaluate their password management approach, seeking a solution that would meet their security requirements while remaining user-friendly for employees.

Challenge: Unified password management without security risks

The city administration of Melle recognized a need to improve credential security across employee workflows. Different departments relied on various password management solutions, with most using the one integrated into Microsoft Edge. This resulted in isolated systems with limited central oversight, no visibility into user actions, and inconsistent security standards across the organization. 

Beyond security, the IT team wanted to simplify password management for employees. The city administration employs people with varying levels of technical proficiency, so ease of use was just as important as protection. 

"That was especially important to us so that we wouldn't have an additional password, another hurdle for people. So really just their Windows password and then the PIN for the browser extension at the end of the day." — Andre Kahlen, system administrator

This meant finding a solution with LDAP support — allowing users to authenticate with their existing Windows credentials and eliminating an additional barrier to adoption. This led the IT team to make a strategic decision to evaluate and introduce a centrally managed, enterprise-grade password management solution.

The main objective was to find a platform that combined three core requirements:

• Security: high security that aligns with strict data protection regulations and internal security policies.
• Usability: exceptional user-friendliness with seamless integration into existing IT infrastructure.
• Control: simple, centralized administration that keeps data accessible while providing fast technical support.

The city of Melle required a service that could unify the workflows across all departments, establish transparent access management, and ensure secure password storage.

Solution: Building a resilient infrastructure

To select a password manager, the IT team conducted a thorough analysis of the available solutions on the market. After careful consideration, they chose Passwork for its security features, granular control, and user-friendly interface — all of which closely matched their criteria.

Passwork's ability to provide centralized control while still offering a secure space for users was beneficial to the IT team. The vault structure was also considered a deciding factor.

"We want to maintain control, since we assign many people, especially those outside of IT, to deal with passwords. One of the advantages of Passwork is centralized management."

This level of control was essential for the municipality, as administrators handle a vast amount of sensitive data and require protection that effectively prevents unauthorized access to confidential information.

The team successfully tested all the declared functions and analyzed database-level security. The decision was based on an intensive three- to four-month testing phase involving about eight members of the IT department. The entire Passwork implementation process, from initial selection to final implementation, took over a year.

Technical Integration

LDAP integration was essential to minimize user friction. After testing, the city administration deployed Passwork within its infrastructure with the following setup:

• LDAP integration for centralized user management based on Active Directory
• The self-hosted solution with an additional instance for employees with heightened security requirements in an isolated network segment
• Snapshot-based and classic backups to ensure data can be quickly restored in case of an incident

"We set up LDAP integration to centrally manage user accounts and permissions, which was highly important. We decided to split the solutions into several instances. Access is heavily restricted this way."

After the successful implementation, the IT team needed to structure the employees' work in the new system.

Organizing work with data in Passwork

The goal was to build a balanced and flexible system that combined control with the freedom of personal information space for employees. The IT team established a clear governance structure:

• Centralized administration — IT admins automatically granted access to all vaults to maintain control
• Personalized training on secure password export and import procedures to ensure safe data migration
• Onboarding sessions for each user during setup to build confidence and ensure smooth adoption
• Clear guidelines on what information belongs in shared organizational vaults and personal vaults

With Passwork, users gained the flexibility to create and organize vaults based on their workflow requirements.

User onboarding

During the rollout, the IT team discovered that centralized training sessions were ineffective — many employees found it challenging to absorb the information all at once. A new method was chosen instead: a personalized approach intended to encourage users to accept the product, use strong, generated passwords, share credentials securely, and learn to use Passwork effectively.

"Passwork adoption is getting very good: employees are taking to new features easily. There is a personal briefing for every user we set up. This also covers security requirements and guides how to effectively utilize the tool. Employees are already organizing their space to fit their structure, thinking about how to design vaults." 

Staff always have access to user instructions, and the IT department provides ongoing support to address any questions that arise.

Result: Security and efficiency in workflows

After more than a year in use, the City of Melle remains highly satisfied with Passwork. The solution is actively used by office employees today. The following points were highlighted as particularly positive.

Unified secure space for data storage

The municipality has abandoned browser-based solutions: all passwords are now stored in a secure system with multi-level encryption. Access to them is strictly controlled and logged — this helps prevent leaks and enables incident investigation if necessary.

Positive user acceptance

Many employees have embraced the tool and are proactively thinking about how to structure organizational vaults.

Reliable customer support

The Passwork support team played an important role in the successful implementation and upgrade from version 6 to the recently released Passwork 7.

"Customer support has been excellent so far with its fast responses. I always have answers to my questions, always with the right scripts included or the right syntax I needed to enter, everything already prepared. Perfect." 

The City of Melle plans to continue rolling out Passwork until all users are successfully onboarded. The IT team has begun systematically gathering feature requests to refine the system to meet the specific requirements of the city administration's IT infrastructure and to ensure it aligns with their operational needs.

Conclusion

Passwork has improved the internal security at the City of Melle by creating a reliable system for password management. Through careful evaluation and a security-focused implementation strategy, the deployment proceeded smoothly. A tailored onboarding approach drove high user adoption, while the platform's reliability and responsive technical support solidified its position as an essential tool in daily administrative operations.

What is password management?

Learn what password management is, why it matters, and how it protects your accounts with encryption, secure storage, and access control.

Passwork BlogEirik Salmi

Kindernothilfe: Simplifying global employee collaboration with Passwork

Kindernothilfe (KNH) is a German non-profit organization dedicated to supporting vulnerable children in impoverished and underprivileged regions worldwide. Founded in 1959, it has made significant contributions as one of Europe’s largest charities dedicated to child aid. Operating in over 30 countries, Kindernothilfe emphasizes the importance of ensuring children’s

Passwork BlogEirik Salmi

Guide to Advanced Encryption Standard (AES)

Learn how AES encryption works, why it’s the standard for data security, and how AES-256 protects everything from passwords to TOP SECRET data.

Passwork BlogEirik Salmi

Introduction

As cyber threats continue to evolve, organizations face increasing pressure to respond quickly and effectively to security incidents. But how well do incident response plans hold up when theory meets reality? This was the central theme of the Passwork cybersecurity webinar in August 2025, featuring insights from Prince Ugo Nwume, cybersecurity consultant at Accenture, and CircleMac, host of the Passwork webinar series. 

Preparation and real-world testing

Incident response plans must be living documents, not static checklists. While tabletop exercises help teams understand their roles, only real-world simulations expose true gaps in preparedness. Annual testing is the bare minimum, in regulated industries, quarterly or biannual reviews are often required.

"Tabletop exercises are great, but you need more — actual crisis simulations and drills show what works and what doesn't" — Prince Ugo Nwume

Drills and red team challenges frequently reveal overlooked weaknesses. The cybersecurity consultant recalled a load balancer left at a disaster recovery site that unexpectedly became an entry point for attackers. Continuous improvement requires immediate after-action reviews, regular updates to playbooks, and staff training that directly addresses real-world gaps.

Coordination across teams and vendors

Clear communication and decision-making authority are critical. Effective incident response depends on cross-functional cooperation among IT, legal, HR, communications, and business units. A dedicated incident coordinator helps ensure priorities are aligned and decisions are made without delay.

"When an incident happens, every team has its priorities. You need defined lines of communication and authority — otherwise, you risk making the situation worse." — Prince Ugo Nwume

Third-party vendors, including cloud providers, add another layer of risk. Contracts should specify SLAs, audit rights, and clear escalation procedures for incident response.

"Third-party risk is always a challenge — you need to safeguard your business by demanding strong security practices from vendors" — Prince Ugo Nwume

Tools and technologies for an effective response

Technology is at the core of rapid incident response. Password managers help organizations accelerate credential resets, simplify access reviews, and contain breaches more effectively. Best practices include enterprise-wide adoption, regular audits, and immediate credential changes during an incident.

"Password managers make it easier to change credentials, monitor access, and prevent attackers from persisting in your environment" — Prince Ugo Nwume

Cloud-native environments introduce both simplicity and complexity. Shared responsibility requires clear definitions of what belongs to the organization versus the provider. Rapid communication channels and frequent contract reviews are essential for compliance and responsiveness.

Measure success by checking KPIs and benchmarks:

• Mean time to detect
• Mean time to resolve
• False positive rates

Tracking these metrics over time enables organizations to refine their incident response programs and adapt to emerging threats.

Compliance and continuous improvement

Global organizations must align with evolving legal and regulatory requirements through annual reviews, gap assessments, and GRC oversight.

"Compliance is a moving target. You need standardized frameworks and regular gap assessments to keep up." — Prince Ugo Nwume

But technical controls alone are not enough. Responding to major incidents places enormous pressure on people. Prince stressed the importance of caring for teams.

"You need to support your team — reward their effort and build a culture where people want to step up when it matters" — Prince Ugo Nwume

Shift rotations, recognition, and a culture of resilience help ensure teams stay motivated and capable during prolonged crises.

Conclusion

Incident response planning requires ongoing preparation, cross-team collaboration, and continuous improvement. As the cybersecurity consultant highlighted, real adaptability comes from robust controls, practical training, and a culture of vigilance. Tools like Passwork and standardized procedures are essential, but success depends on adaptability and teamwork. Incident response plans must be living documents, not static checklists.

• Preparation and practice are key
• Cross-functional coordination and clear authority are essential
• Password managers are a cornerstone of rapid response
• Global compliance requires standardized frameworks
• Team resilience and well-being matter

Further reading

Cloud security: Shared responsibility or shared confusion?

Table of contents * Introduction * The shared responsibility model: Theory vs practice * Where ambiguity leads to risk * Contracts, fine print, and operational realities * Lessons learned: Avoiding misconfiguration * Conclusion Introduction Cloud security remains one of the most debated topics in modern IT. As organizations continue their migration to cloud platforms, the question

Passwork BlogTurpal Makh

Cyber insurance: A false sense of security?

Table of contents * Introduction * Cyber insurance: What does it cover? * The day-to-day reality of cybersecurity * Navigating Global Compliance * The rewards and challenges of cybersecurity * Conclusion Introduction As cyber threats and data breaches become more frequent and sophisticated, many organizations are looking to cyber insurance as a way to manage risk.

Passwork BlogTurpal Makh

Passwork 7: Security verified by HackerOne

Passwork has successfully completed the penetration testing, carried out by HackerOne — the world’s largest platform for coordinating bug bounty programs and security assessments. This independent evaluation confirmed Passwork’s highest level of data protection and strong resilience against modern cyber threats. What the pentest covered Security architecture and data

Passwork BlogEirik Salmi

Introduction

GDPR password security is an essential component of modern data protection strategies and a key aspect of GDPR compliance. Under the General Data Protection Regulation (GDPR), organizations are legally required to implement special technical and organizational measures to safeguard personal data. Passwords remain the most common authentication mechanism, and they also represent one of the weakest links in information security when poorly managed.

According to Verizon Data Breach Investigations Report 2024, human error, including credential misuse, remains a significant factor in data breaches, accounting for a substantial percentage of incidents. This highlights the critical need for effective employee training in GDPR password security. Strong technical tools are vital, but security gaps quickly appear if employees aren’t properly trained. This article examines best practices for employee training, identifies common mistakes, and demonstrates how business can mitigate risks through practical policies and modern tools.

Why training matters in GDPR password security

GDPR requires organizations to demonstrate accountability. That means it is not enough to set policies. Businesses must prove that employees understand and apply them. Password misuse remains one of the most frequent root causes of data breaches, often associated with weak or reused credentials.

From a regulatory perspective, insufficient password controls can be interpreted as a failure to apply "appropriate technical and organizational measures" under Article 32 of GDPR. This translates into direct financial and reputational risks, making cybersecurity training a critical investment.

Training employees is the bridge between abstract policy and daily practice. By equipping staff with knowledge and tools, companies not only reduce the risk of data breaches and cyberattacks but also create an auditable record of compliance.

GDPR password security training: Best practices

Effective GDPR password security training is not a one-time event but a continuous process. Employees must see security as part of their daily responsibilities rather than an annual compliance requirement. These are practical recommendations for employee training:

Ongoing, concise learning
Short, frequent sessions are far more effective than long, one-off seminars. Use onboarding modules, quarterly refreshers, and targeted updates after incidents. For example, new hires can generate their first password directly in a password manager, immediately experiencing how the system enforces company-wide security policies.

Learn by doing with simulations
Real-world simulations make lessons stick. A phishing exercise or a mock "compromised shared password" scenario shows how a single mistake can endanger the organization. In the Passwork password manager, such training can be replicated when the system flags outdated or reused passwords, prompting employees to walk through the secure update workflow with full audit logging.

Modern and practical password policies
Overly complex rules often push staff into shortcuts. Instead, focus on length, uniqueness, and blocking reuse. Passwork automates this by generating strong, unique passwords and preventing weak combinations, eliminating the burden of memorization and reducing risky workarounds.

Seamless integration with daily workflows
Employees are more likely to follow secure practices when security tools are built into their routine. Passwork integrates with LDAP and SSO, allowing staff to log in with their standard corporate accounts while administrators gain centralized oversight of accounts and groups.

Role-based training and access control
Different departments face different risks: general staff deal with operational routine issues, finance teams — with fraud attempts, and IT teams manage critical systems. Passwork role-based access control (RBAC) allows employees to see firsthand that they have access only to the credentials required for their role, no more.

A no-blame reporting culture
Security only works when staff feel safe reporting mistakes. Passwork provides audit trails and real-time alerts for critical events, enabling quick remediation and turning incidents into learning opportunities instead of sources of punishment.

The most successful programs blend practical exercises, clear communication, and tools that reinforce correct behavior at the point of use. With platforms like Passwork, secure practices become effortless, turning password management from a weak point into a core strength for compliance and resilience.

Common mistakes employees make with passwords

Despite awareness campaigns, many companies continue to face recurring issues in password behavior. These mistakes point out a gap between policy and practice, where employees either misunderstand requirements or prioritize convenience over security. Recognizing these pitfalls is the first step in addressing them through training and enforcement. Even in organizations with formal password policies, employees often fall into predictable traps:

• Reusing passwords across multiple systems
• Choosing weak or guessable patterns such as names, dates, or simple sequences
• Storing credentials insecurely on notes, spreadsheets, or messengers
• Failing to update compromised passwords after breaches
• Bypassing complex policies with shortcuts (e.g., adding "1!" each time)
• Neglecting multi-factor authentication (MFA) setup, even when available, is a common oversight that significantly weakens access control

Passwork helps businesses eliminate these problems systematically. Zero Knowledge architecture and AES-256 encryption ensure data protection by design. LDAP and SSO integration simplify authentication, and RBAC provides granular access control so that employees only see what they are authorized to use. Multi-factor authentication (MFA) further reduces risks if a password is compromised. Built-in audit trails and real-time monitoring enable security leaders to swiftly identify and address issues such as password reuse and weak credential creation. Employees naturally adopt secure practices, closing the gap between policy and daily behavior.

Business risks of poor GDPR password security

Companies that fail to secure passwords face multiple risks:

• Regulatory fines of up to €20 million or 4% of global turnover or non-compliance with GDPR requirements
• Operational disruptions if accounts are locked or compromised
• Financial loss from investigations, lawsuits, and compensation
• Reputational damage and customer churn
• Supply chain risks occur when compromised passwords affect partners

Password training is universally important, but some industries face higher stakes:

• Healthcare. Medical records are highly sensitive and overlap with HIPAA.
• Finance. Passwords protect transactions and client trust.
• Legal and consulting. Compromised credentials can expose client data.
• Public sector and education. High user volumes and limited budgets make password training a critical necessity.
• Technology and SaaS. Shared developer credentials and API keys require strict governance and oversight.

These risks represent everyday realities across industries. The vast majority of attacks exploiting weak passwords are opportunistic rather than targeted, meaning any business that relies on outdated password practices is automatically at risk. Poor password security is no longer just an IT issue. It is a strategic business risk with legal, financial, and reputational consequences.

By adopting strong training programs and enterprise-level solutions like Passwork, organizations can transform passwords from a liability into a managed part of their security posture.

Conclusion

GDPR password security is both a compliance requirement and a business safeguard. Employee training transforms password policies from abstract rules into daily habits that protect data, reduce risk, and demonstrate accountability.

Security leaders should combine concise training sessions, simulations, practical password policies, and strong technical tools. By embedding Passwork into this ecosystem, organizations both educate staff and provide them with resources to comply effortlessly. Training is about building a security culture where GDPR password security becomes second nature, protecting the business and its customers.

FAQ: Frequently asked questions about GDPR password security training

Q: What does GDPR say about passwords?
A: GDPR does not prescribe exact password rules (e.g., "must be 12 characters long"). Instead, Article 32 requires organizations to implement "appropriate technical and organizational measures" to ensure data security. This is a risk-based approach. For passwords, this means your policies (length, complexity, MFA) must be strong enough to protect the specific personal data you process. A failure to enforce strong password hygiene can be interpreted as a direct violation of this requirement, leading to significant fines.

Q: How can we make security training engaging so employees actually pay attention?
A: The key is to move beyond passive lectures. Effective training is interactive and context-driven. Use gamification (e.g., leaderboards for completing security quizzes), real-world phishing simulations, and role-playing scenarios where teams must respond to a mock data breach. Tying training directly to the tools they use daily, like a password manager, makes the lessons practical. For example, instead of just talking about strong passwords, have them generate one in the company's password manager during the training itself.

Q: What are the essential components of effective GDPR training?
A: Effective programs combine GDPR fundamentals with practical application. This includes secure password creation, using password managers, multi-factor authentication, breach response procedures, and role-specific scenarios to keep the content relevant.

Q: How does password training support GDPR compliance?
A: Documented training initiatives serve as proof of "appropriate technical and organizational measures" under Article 32. Good record-keeping shows regulators that employees have been properly trained and helps organizations track progress and demonstrate accountability during audits.

Q: What metrics prove training is effective?
A: Organizations should monitor the following metrics: reduced password-related incidents, stronger password strength scores, increased adoption of password management tools, and a decline in password reset requests. These metrics provide tangible evidence that training translates into improved security.

Further reading

HIPAA requirements for password management

Table of contents * Introduction * How HIPAA works * Cybersecurity and clinical efficiency * HIPAA and password management * How to train staff to meet HIPAA standards * How Passwork supports HIPAA compliance * Sustainable HIPAA compliance Introduction In the complex ecosystem of modern healthcare, patient data is essential for secure management. In 2024, the U.

Passwork BlogAna Moore

Cyber insurance: A false sense of security?

Table of contents * Introduction * Cyber insurance: What does it cover? * The day-to-day reality of cybersecurity * Navigating Global Compliance * The rewards and challenges of cybersecurity * Conclusion Introduction As cyber threats and data breaches become more frequent and sophisticated, many organizations are looking to cyber insurance as a way to manage risk.

Passwork BlogTurpal Mahaev

Four ways to make users love password security

Four ways to make users love password security

Passwork BlogIliya Garakh, CTO

Introduction

Cloud security remains one of the most debated topics in modern IT. As organizations continue their migration to cloud platforms, the question of "Who is responsible for what?" grows increasingly complex. In our latest Passwork webinar, cybersecurity lecturer David Gordon joined host Turpal to unpack the realities behind the shared responsibility model and why clear boundaries are still elusive for many teams.

"The shared responsibility model is a fundamental concept in cloud security that delineates where the cloud provider’s responsibilities begin and end, and where the client’s responsibilities begin and end" — David Gordon

The session explored practical examples, common pitfalls, and actionable strategies for CISOs and IT leaders navigating the blurred lines between cloud provider and client responsibilities.

The shared responsibility model: Theory vs practice

At its core, the shared responsibility model defines the security obligations of both the cloud provider (e.g., AWS, Azure) and the client. The provider is responsible for securing the infrastructure and network, while the client manages data, applications, and configuration within the cloud environment.

However, these boundaries shift depending on the service model:

• Infrastructure as a service (IaaS). Clients carry most of the security burden, from OS patches to identity management.
• Platform as a service (PaaS). Responsibility is more balanced, with providers handling the platform and clients managing data and application logic.
• Software as a service (SaaS). Providers handle most security aspects, but clients must still manage user access and data governance.

While the model is theoretically clear, David highlighted that practical applications can sometimes be a little complex due to the dynamic nature of cloud services.

Where ambiguity leads to risk

Ambiguity in the shared responsibility model has been the root cause of several high-profile breaches. One of the most cited examples is the misconfiguration of AWS S3 buckets. Despite AWS securing the underlying infrastructure, clients failed to set proper permissions, resulting in sensitive data exposure.

"Some overly permissive permissions were granted to these S3 buckets, and that led to sensitive data being exposed to the public. That type of scenario is unfortunately not uncommon." — David Gordon

Other common missteps include:

• Misconfigured identity and access management (IAM) rules
• Failure to implement multi-factor authentication (MFA) on critical accounts
• Assuming implicit security without verifying configurations

The lesson: never assume security is "built-in" by default. Clients must proactively manage their configurations and understand the nuances of each cloud service model.

Contracts, fine print, and operational realities

Cloud provider contracts aim to define shared security responsibilities, but operational realities often diverge from contractual language. CISOs and IT leaders must scrutinize the fine print, looking for:

• Clear delineation of responsibilities. Understand exactly what the provider covers and what is left to the client.
• Incident response procedures. Who is responsible for breach notification, investigation, and remediation?
• Audit rights and transparency. Can you validate the provider’s controls and monitor their compliance?
• Service-level agreements (SLAs). Are uptime, recovery, and security guarantees realistic and enforceable?

David cautioned that the detailed operational implications are sometimes not as clear as the contract language suggests, underscoring the need for ongoing review and negotiation.

Lessons learned: Avoiding misconfiguration

A recurring theme in the discussion was that most cloud-related incidents are not caused by flaws in the provider’s infrastructure, but rather by preventable mistakes made by clients. The biggest culprits are misconfigured permissions, lack of monitoring, and weak identity practices. These errors underscore the importance of treating configuration management as an ongoing discipline rather than a one-time setup. Training teams, conducting regular checks, and utilizing automated tools can significantly mitigate these risks.

"Just never assume implicit security. Yes, the cloud provider is responsible for the infrastructure, but you, the client, are 100% responsible for how you configure permissions on the cloud." — David Gordon

The webinar highlighted real-world strategies for minimizing risk and confusion:

• Continuous education. Train teams to understand their responsibilities and the specifics of each cloud service model.
• Regular audits. Periodically review configurations, permissions, and access controls.
• Automated monitoring. Leverage tools to detect misconfigurations and anomalous activity in real time.
• Collaborative planning. Foster open communication among security, IT, and business units to ensure a shared understanding.

Conclusion

Cloud security is not a static checklist — it is an ongoing partnership between provider and client. As David Gordon emphasized, "never assume implicit security." Success requires vigilance, clear communication, and a willingness to adapt as cloud services evolve.

• The shared responsibility model is clear in theory, but ambiguous in practice
• Misconfiguration, especially of storage and access controls, remains a leading cause of cloud breaches
• Contracts should be reviewed for operational clarity, not just legal protection
• Ongoing education, monitoring, and cross-team collaboration are essential for effective cloud security

At Passwork, we help organizations navigate the complexities of cloud security with tools that empower proactive management, robust access controls, and real-time monitoring. By understanding your responsibilities and building resilient processes, you can turn shared confusion into shared success.

Further reading

Cyber insurance: A false sense of security?

Table of contents * Introduction * Cyber insurance: What does it cover? * The day-to-day reality of cybersecurity * Navigating Global Compliance * The rewards and challenges of cybersecurity * Conclusion Introduction As cyber threats and data breaches become more frequent and sophisticated, many organizations are looking to cyber insurance as a way to manage risk.

Passwork BlogTurpal Mahaev

Why do employees ignore cybersecurity policies?

Employees often ignore cybersecurity rules not out of laziness, but because they feel generic, irrelevant, or disconnected from real work. True change starts with empathy, leadership, and context-driven policies. Read the full article to learn how to make security stick.

Passwork BlogTurpal Mahaev

Passwork 7: Security verified by HackerOne

Passwork has successfully completed the penetration testing, carried out by HackerOne — the world’s largest platform for coordinating bug bounty programs and security assessments. This independent evaluation confirmed Passwork’s highest level of data protection and strong resilience against modern cyber threats. What the pentest covered Security architecture and data

Passwork BlogEirik Salmi

Introduction

As cyber threats and data breaches become more frequent and sophisticated, many organizations are looking to cyber insurance as a way to manage risk. But is cyber insurance a true safety net — or is it just a false sense of security? This question was at the core of the Password Cybersecurity Webinar, featuring insights from Yemi Eniade, a cybersecurity architect with a global perspective and decades of hands-on experience.

Cyber insurance: What does it cover? 

Yemi Eniade highlighted a critical issue: many organizations misunderstand what cyber insurance provides. While insurance can help mitigate financial losses after an incident, it is not a replacement for strong cybersecurity fundamentals.

"Insurance is not a substitute for robust security controls. It’s a tool, but some organizations see it as the solution instead of part of a bigger strategy. Many organizations misunderstand what is covered. You have to read the policy carefully — don’t assume you’re protected from everything just because you have a certificate on the wall." — Yemi Eniade

Many policies are filled with exclusions and limitations. For example, if an incident is caused by poor configuration or a lack of basic controls, coverage may be denied. Regulatory fines and business interruptions are also often misunderstood.

Key points discussed:

• Insurance doesn’t cover everything. There are many exclusions, especially around preventable incidents.
• Policy terms matter. Organizations need to carefully read and understand their coverage.
• Security maturity is required. Insurers increasingly demand proof of strong controls before issuing or renewing policies.

The day-to-day reality of cybersecurity

Drawing on his journey from the Royal Navy to cybersecurity consultancy, Yemi described the ever-changing nature of the field:

"No two days are the same. Yesterday, you might have been managing vulnerabilities, today, it’s about system design. You always have to be on your toes — just like in the military." — Yemi Eniade

He credits his military background with giving him the discipline and decision-making skills needed to thrive in a high-pressure cybersecurity environment.

What Yemi values most:

• The challenge of solving new problems every day
• The satisfaction of turning threats into opportunities
• The necessity of lifelong learning

Navigating Global Compliance

Yemi’s work spans multiple continents, meaning he must constantly adapt to different regulatory environments:

• Europe: GDPR, ISO 27001
• USA: Sector-specific laws (e.g., FDA)
• China: Strict data privacy and localization laws

"My project is global. The product is global. We have to deal with different laws and standards — GDPR in Europe, FDA in America, and privacy laws in China. The only way to manage is through strict company policy and a strong quality management system." — Yemi Eniade

The cybersecurity architect emphasized that a robust Quality Management System (QMS) and adherence to international standards are essential for maintaining compliance and security across regions.

The rewards and challenges of cybersecurity

The intellectual thrill of solving complex problems is balanced by the constant pressure of staying ahead of attackers. For every breakthrough moment, such as stopping a phishing campaign or closing a critical vulnerability, there is stress from long hours, shifting priorities, and the knowledge that an overlooked detail could have massive consequences. Therefore, cybersecurity leaders must find motivation in the process itself, such as building resilient systems and guiding teams through uncertainty. They must also recognize that their work directly safeguards people, businesses, and, in some cases, even national security.

"Sometimes, it’s overwhelming. You have meetings late at night or early in the morning. But you have to be happy to do what you’re doing — that’s what keeps me going." — Yemi Eniade

Rewards:

• Intellectual stimulation from constant change
• Working with diverse, international teams
• Making a real impact by protecting organizations and individuals

Challenges:

• Maintaining work-life balance, especially with teams in multiple time zones
• The emotional and mental toll of being "always on"
• Keeping up with new threats and evolving regulations

Conclusion 

Cyber insurance can be a valuable part of an organization's risk management strategy, but it is not a guarantee against cyber threats. As Yemi Eniade emphasized, true security comes from robust controls, continuous learning, and a culture of vigilance. Insurance is just one piece of the puzzle — real resilience requires preparation, adaptability, and a commitment to best practices.

• Cyber insurance is not a cure-all: It should complement, not replace, a comprehensive security program.
• Know your policy: Understand exactly what is covered, and what is not.
• Global compliance is complex: Standardized frameworks and policies are crucial for navigating international regulations.
• Stay adaptable: Cybersecurity is always evolving — success depends on staying alert, informed, and proactive.

Further reading

HIPAA requirements for password management

Table of contents * Introduction * How HIPAA works * Cybersecurity and clinical efficiency * HIPAA and password management * How to train staff to meet HIPAA standards * How Passwork supports HIPAA compliance * Sustainable HIPAA compliance Introduction In the complex ecosystem of modern healthcare, patient data is essential for secure management. In 2024, the U.

Passwork BlogAna Moore

Insider threats: Prevention vs. privacy

Insider threats are a major cybersecurity risk, often overlooked. Prevention requires balancing trust and security focus on monitoring risk-based behaviors, not constant surveillance. Use AI for early detection, educate staff, and be transparent to foster trust while protecting data.

Passwork BlogTurpal Mahaev

Passwork 7: Security verified by HackerOne

Passwork has successfully completed the penetration testing, carried out by HackerOne — the world’s largest platform for coordinating bug bounty programs and security assessments. This independent evaluation confirmed Passwork’s highest level of data protection and strong resilience against modern cyber threats. What the pentest covered Security architecture and data

Passwork BlogEirik Salmi

Introduction

In the complex ecosystem of modern healthcare, patient data is essential for secure management. In 2024, the U.S. healthcare sector experienced over 700 large-scale data breaches, marking the third consecutive year with such a high volume of incidents. This surge compromised over 275 million patient records, a significant 63.5% increase from 2023.

"Healthcare data are more sensitive than other types of data because any data tampering can lead to faulty treatment, with fatal and irreversible losses to patients" — Healthcare Data Breaches, MDPI

The consequences go far beyond financial penalties and reputational damage. Breaches of electronic Protected Health Information (ePHI) can disrupt patient care, compromise safety, and erode public trust. As the American Hospital Association highlights, since 2020, healthcare breaches have affected over 590 million patient records — more than the entire U.S. population, with a significant number of individuals being affected multiple times. 

Healthcare operates in a 24/7 environment where delays in authentication can impact patient care. Systems must provide strong protection without disrupting urgent clinical workflows. Password management is no longer just an IT function. It is now a mission-critical process directly tied to patient safety and regulatory compliance under the Health Insurance Portability and Accountability Act (HIPAA).

How HIPAA works

HIPAA is a U.S. federal law that establishes strict requirements for safeguarding sensitive patient health information from unauthorized disclosure. In addition to privacy protection acts, the HIPAA Security Rule specifically addresses the protection of ePHI, any personally identifiable health information created, stored, transmitted, or received electronically.

HIPAA applies to:

• Covered entities: hospitals, clinics, physicians, insurers, and healthcare clearinghouses
• Business associates: service providers (IT, billing, cloud hosting, consultants) that handle ePHI on behalf of covered entities

HIPAA is structured around several interconnected rules, each serving a distinct purpose in protecting patient data:

• The Privacy Rule sets standards for how PHI can be used and disclosed
• Security Rule defines administrative, physical, and technical safeguards to protect ePHI
• Breach Notification Rule requires covered entities and business associates to notify affected individuals, the U.S. Department of Health and Human Services (HHS), and sometimes the media, in the event of a breach
• The Enforcement Rule outlines penalties for violations

Organizations must document their policies, conduct periodic risk assessments, and ensure that staff are properly trained. Non-compliance can lead to сivil fines up to millions of dollars, criminal penalties, including imprisonment, in cases of willful neglect or malicious misuse, and permanent listing on the public "Wall of Shame" for reported breaches. HIPAA compliance isn’t just about avoiding penalties — it’s about protecting patient safety and trust. A breach of PHI can result in identity theft, financial fraud, and critical interruptions to patient care, underscoring the vital importance of robust healthcare data security.

Cybersecurity and clinical efficiency

The 2024 NIST Digital Identity Guidelines (SP 800-63B) represent a significant evolution in cybersecurity best practices. These guidelines advocate for a shift away from overly complex passwords towards longer, more memorable passphrases, widespread adoption of multi-factor authentication (MFA), and enhanced breach detection capabilities. While these changes undeniably enhance healthcare cybersecurity, they also necessitate that healthcare providers reassess their existing tools and policies to align with modern security paradigms, like Zero trust architecture.

The NIST Digital Identity Guidelines provide a comprehensive framework that complements HIPAA requirements, offering detailed guidance on implementing robust identity and access management. For healthcare organizations, this means:

• Identity proofing. Ensuring that individuals are the ones who they claim to be during the account creation process, reducing the risk of fraudulent access.
• Authenticator Assurance Levels (AALs). NIST defines different levels of assurance for authenticators, from single-factor passwords to strong multi-factor methods. Healthcare organizations should strive for higher AALs for access to sensitive ePHI.
• Federated identity management. Leveraging standards like Single Sign-On (SSO) and LDAP Integration to streamline user access across disparate systems while maintaining strong security controls. This reduces password fatigue and improves overall security posture.
• Lifecycle management. Implementing robust processes for managing identities from creation to deactivation, including timely revocation of access rights for departing personnel. This is crucial for maintaining data integrity and preventing unauthorized access.

By integrating NIST recommendations, healthcare organizations can build a more resilient and adaptable cybersecurity posture in healthcare, moving beyond minimum compliance to proactive risk mitigation. This proactive approach is vital in combating evolving threats such as ransomware attacks and sophisticated phishing campaigns.

HIPAA and password management

The HIPAA Security Rule takes a structured approach to password management, breaking it into administrative and technical safeguards. Together, these safeguards form a framework that organizations must adapt to their operational realities, while still meeting regulatory expectations. All of that is done to keep their patient data secure.

Administrative safeguards focus on policy, governance, and people. They require:

• Documented password policies that define how passwords are created, changed, stored, and removed. These policies must be clear, enforceable, and aligned with risk assessments
• User training programs that educate staff on password hygiene, how to avoid common pitfalls such as reusing or sharing passwords, and how to recognize social engineering attempts. Training must be ongoing, not a one-time event
• Risk-based access controls that ensure staff have only the level of access they need to perform their duties, following the HIPAA minimum necessary principle
• Retention of documentation — all policies, risk assessments, and decisions must be recorded and kept for at least six years, enabling compliance audits and investigations

Technical safeguards address the systems and tools used to enforce secure authentication and access management. They include:

• Authentication mechanisms to verify that the person accessing ePHI is the one who they claim to be — for example, username and password combinations backed up by multi-factor authentication
• Logging and audit trails that record every authentication event and track changes to sensitive data, enabling investigation procedures of anomalies or breaches
• Interoperability, ensuring that authentication and password controls work consistently across all environments — from electronic health record (EHR) systems to medical devices and cloud services

HIPAA further differentiates between required and addressable specifications. Required safeguards are non-negotiable — failure to implement them constitutes non-compliance. Addressable safeguards give organizations some flexibility: they can either adopt the recommended control or implement an alternative that achieves the same level of protection. In either case, the decision must be well-documented, justified, and periodically reviewed to ensure it remains appropriate and effective.

A well-designed password management program under HIPAA doesn’t stop at compliance — it also considers usability, scalability, and the unique pressures of healthcare workflows. Implemented correctly, it can reduce risks without creating operational friction, making secure access part of the daily routine rather than a barrier to patient care.

How to train staff to meet HIPAA standards

Human error remains a primary driver of healthcare data breaches. Therefore, effective staff training is not just a regulatory checkbox but an essential component of HIPAA compliance and overall ePHI protection. While regular, role-specific security awareness training for clinicians, administrators, and IT staff is fundamental, a truly effective program extends far beyond basic awareness. The goal is to transform passive compliance into active participation, empowering employees to be the first line of defense against breaches. Compliance is as much about operational discipline as it is about technology. Healthcare organizations should:

• Implement Role-Based Access Control (RBAC) to enforce least-privilege policies.
• Utilize LDAP Integration and Single Sign-On for centralized onboarding and offboarding processes, enhancing access rights management.
• Separate vaults and permissions by department, specialty, or function to ensure granular control
• Maintain comprehensive audit trails for all credential activities, crucial for accountability and forensic analysis

Organizations should consider incorporating advanced training modules on emerging cybersecurity threats, such as ransomware and advanced persistent threats (APTs), specifically tailored to the healthcare context. This includes practical exercises in incident response, data recovery, and business continuity planning. Furthermore, training should focus on the human element of security and foster a culture of vigilance, making sure that every employee understands their role in protecting sensitive patient data. This can involve gamified learning, interactive workshops, and regular communication channels for security updates and best practices. 

How Passwork supports HIPAA compliance

Selecting a password manager for healthcare organizations means not only meeting the highest standards of healthcare data security and regulatory compliance, but also ensuring that the solution fits seamlessly into the daily workflow of medical staff. Complex tools are often rejected in practice, forcing employees to revert to insecure workarounds. Passwork architecture is designed to meet HIPAA-specific compliance challenges while remaining intuitive enough for fast and easy adoption.

• Certifications and security practices. Passwork is ISO 27001 certified, demonstrating adherence to internationally recognized information security standards. Regular penetration testing via HackerOne ensures the platform remains resilient against emerging threats.
• On-premise deployment. Passwork supports self-hosted deployment, allowing healthcare organizations to run the system entirely within their infrastructure. This approach keeps credentials under direct organizational control, meets HIPAA data protection requirements, and minimizes exposure to third-party risks.
• Data protection by design. With a zero-knowledge architecture and AES-256 end-to-end encryption, Passwork ensures that no one — not even the service provider — can access stored credentials. This aligns directly with HIPAA privacy, security, and technical safeguard provisions.
• Access management. Integration with LDAP and SSO centralizes authentication and user management, making it easier to enforce consistent security policies across large and distributed healthcare environments.
• Granular access control. Passwork RBAC enables administrators to assign precise permissions to each user or group. Only authorized staff can access specific vaults or entries, supporting the HIPAA minimum necessary standard.
• Audit trail and real-time monitoring. HIPAA requires detailed audit controls. Passwork logs all actions, including password creation, modification, sharing, and deletion. Real-time alerts for critical events enable quick detection and response to potential security incidents.
• Multi-factor authentication (MFA). Adding an extra layer of protection, MFA helps safeguard accounts even if a password is compromised.
• Easy onboarding and usability. The clean and intuitive interface allows healthcare staff to start using the system immediately without requiring extensive training or disrupting patient care workflows. Passwork received the "Ease of Use" award from Capterra, which confirms that the solution is user-friendly and does not require extensive training.

By combining advanced security measures, regulatory alignment, and user-friendly design, Passwork enables healthcare organizations to protect ePHI effectively while maintaining HIPAA compliance in a practical, sustainable manner.

Sustainable HIPAA compliance

Achieving compliance is only the first step. Maintaining compliance requires ongoing attention. Healthcare organizations should:

• Conduct regular risk assessments and update policies accordingly
• Review audit logs for anomalies
• Refresh training content annually
• Continuously evaluate tools and workflows against evolving threats and regulatory updates

HIPAA compliance is not just a legal obligation — it is central to fostering patient trust and ensuring patient safety. Secure, efficient password management plays a critical role in protecting ePHI and enabling high-quality care. By combining strong encryption, granular access controls, integration with enterprise systems, and ease of use, Passwork helps healthcare organizations meet and sustain HIPAA compliance. In doing so, it safeguards sensitive data, reduces breach risks, and supports the life-critical mission of healthcare.

Further reading

Insider threats: Prevention vs. privacy

Insider threats are a major cybersecurity risk, often overlooked. Prevention requires balancing trust and security focus on monitoring risk-based behaviors, not constant surveillance. Use AI for early detection, educate staff, and be transparent to foster trust while protecting data.

Passwork BlogTurpal Mahaev

Passwork 7: Security verified by HackerOne

Passwork has successfully completed the penetration testing, carried out by HackerOne — the world’s largest platform for coordinating bug bounty programs and security assessments. This independent evaluation confirmed Passwork’s highest level of data protection and strong resilience against modern cyber threats. What the pentest covered Security architecture and data

Passwork BlogEirik Salmi

How to protect your online business from cyberattacks

Protect your online business from cyber threats with actionable strategies, from employee education to advanced tools like Passwork. Learn about phishing, ransomware, and more while discovering how to enhance security with simple yet effective measures. Stay protected — read the full article!

Passwork BlogEirik Salmi

Introduction

Insider threats account for a significant portion of cybersecurity incidents, yet they remain one of the least understood and most challenging risks to mitigate. Whether caused by malicious intent or negligence, insider threats can have devastating consequences, especially when sensitive data is involved.

During the webinar, Senior Executive in Infrastructure and Security Georgi Petrov shared his insights on how Malta Gaming Authority (MGA) manages insider threats while safeguarding trust within the organization. From Edward Snowden’s infamous whistleblowing to phishing attacks that exploit inattentiveness, the discussion emphasized the importance of proactive strategies that address both technical and human vulnerabilities.

At the end of the day, everybody is susceptible to data leaks. Every organization will face insider threats eventually — it’s not a matter of if, but when.
— Georgi Petrov

What are insider threats?

Insider threats refer to the risks posed by individuals within an organization, such as employees, contractors, or partners, who misuse their access to sensitive data or systems. These threats can be categorized into two types:

• Malicious insiders: Individuals who intentionally harm the organization, such as stealing data or sabotaging systems.
• Negligent insiders: Individuals who unintentionally compromise security, often due to ignorance or carelessness.

Georgi emphasized that insider threats often arise from poor system design, inadequate controls, or malicious intent. Addressing these vulnerabilities requires a combination of robust security frameworks and education.

You need to ensure that your insider threat program collects the right type of data — not everything. Focus on metadata, not sensitive content, and always ask: Why am I collecting this information? How does it help safeguard the organization?
— Georgi Petrov

Ethical dilemmas: Surveillance vs. privacy

One of the most debated topics during the webinar was whether insider threat monitoring programs merely serve as a facade for surveillance. Georgi argued that monitoring is not inherently invasive if implemented responsibly. The key is to collect only what is necessary — metadata rather than sensitive content — and to be transparent with employees.

For example: Instead of logging every keystroke or web browsing activity, organizations should focus on detecting risk-based behaviors, such as attempts to access unauthorized data or upload files to cloud storage.

Transparency and clear communication are vital. Employees need to understand that monitoring is designed to protect the organization, not to spy on them. This approach fosters trust while maintaining security.

We are not the big brother. We’re here to protect the organization’s cybersecurity posture, not to track employee activities unnecessarily.
— Georgi Petrov

Insiders vs. outsiders: Who poses a bigger risk?

When asked who poses a greater risk — trusted insiders or outsiders with limited access — Georgi provided a nuanced perspective:

• Outsiders: Unpredictable and capable of exploiting vulnerabilities to escalate privileges, which makes them harder to control.
• Insiders: More predictable and manageable through safeguards like role-based access controls and monitoring.

An outsider with minimal credentials can often pose a bigger risk because they’re unpredictable. They might escalate privileges or exploit vulnerabilities, which can be devastating for an organization.
— Georgi Petrov

Separating signals from noise

Monitoring tools generate vast amounts of data, making it challenging to distinguish genuine threats from irrelevant noise. Georgi stressed the importance of context in threat detection:

• Noise: Routine activities, such as a finance employee downloading spreadsheets during end-of-quarter reporting.
• Signal: Abnormal behaviors, such as an offboarding employee attempting to access and upload sensitive files to cloud storage.

The moment it becomes a signal is when you see abnormal activity — like accessing sensitive folders unrelated to their department or trying to exfiltrate data. That’s when you flip the switch and investigate.
— Georgi Petrov

Predictive vs. reactive threat detection

Should insider threat programs shift from reactive detection to predictive prevention? Georgi strongly advocated for predictive approaches that leverage AI and machine learning to identify subtle patterns that human analysts might miss.

For example: In a reactive system, an employee gradually exfiltrating files over weeks could evade detection. However, predictive tools can identify abnormal patterns and flag potential threats early.

Predictive prevention minimizes the damage caused by insider threats by allowing organizations to act before incidents escalate.

Balancing trust and security

Continuous monitoring can create a culture of mistrust among employees. To strike a balance, Georgi recommended the following:

• Transparency: Clearly communicate what is being monitored and why.
• Risk-based monitoring: Focus on behaviors that indicate potential threats rather than conducting blanket surveillance.
• Education: Regularly train employees on cybersecurity best practices to reduce negligence-based risks.

The main point: Trust and security are not mutually exclusive. By fostering a culture of transparency and education, organizations can build trust while maintaining robust defenses.

Trust, but verify. Build a culture of trust, educate your employees, and configure your monitoring tools to focus on risk-based behaviors — not constant surveillance.
— Georgi Petrov

Key takeaways

• Collect meaningful data: Avoid over-monitoring and focus on metadata and risk-based behaviors.
• Adopt predictive tools: Use AI to identify patterns and prevent threats before they occur.
• Foster trust: Transparency and education are essential for balancing security with employee confidence.
• Prepare for the inevitable: Insider threats are not a matter of "if" but "when". A multilayered approach ensures resilience.

Conclusion

Insider threats present a complex challenge for organizations, requiring them to navigate the fine line between prevention and privacy. As Georgi Petrov highlighted during the webinar, the key lies in building a culture of trust, implementing risk-based monitoring, and adopting predictive tools to stay ahead of threats.

At Passwork, we empower organizations with tools that enhance security without compromising trust. From managing passwords securely to fostering a culture of cybersecurity awareness, our solutions are designed to help you protect what matters most.

Further reading:

Why do employees ignore cybersecurity policies?

Employees often ignore cybersecurity rules not out of laziness, but because they feel generic, irrelevant, or disconnected from real work. True change starts with empathy, leadership, and context-driven policies. Read the full article to learn how to make security stick.

Passwork BlogTurpal Mahaev

Private password breach checking: A new algorithm for secure password validation

Table of contents * Introduction * Existing solutions and their tradeoffs * Our innovation: Obfuscated deterministic bloom filter indices * Key benefits: Bridging the privacy-performance gap * Real-world applications: Transforming password security * Conclusion: A new era in password security Introduction Data breaches have become routine: millions of users worldwide face the consequences of compromised passwords.

Passwork BlogIliya Garakh, CTO

Common myths about password managers

Worried that password managers are risky or hard to use? It’s time to rethink. In this article, we debunk common myths about password managers, break down how they actually work, and show why solutions like Passwork are vital for your cybersecurity. Learn how these tools keep your data protected.

Passwork BlogEirik Salmi

Introduction

Companies spend millions on cybersecurity policies — but often overlook the human side of enforcement. Why do employees ignore security rules, even when they’re clearly defined and regularly updated? And how can organizations shift from checkbox compliance to genuine behavioral change?

These were the big questions tackled in our latest Passwork cybersecurity webinar, featuring ISO 27001 consultant and ISMS Copilot founder, Tristan Roth. Together, we explored how companies can strengthen security culture, align leadership and compliance teams, and ultimately get employees to care about cybersecurity policies.

This article highlights the key insights from that discussion, offering a practical roadmap for businesses aiming to turn policy fatigue into proactive security awareness.

The compliance trap: Why policies fall flat

According to a 2024 ISACA survey, just 38% of organizations believe their compliance efforts have improved their actual security posture. The rest? Going through the motions.

They want to be ISO-certified in three weeks. They write 50 documents, sign them, and think the job is done. But there’s no substance. And without substance, there’s nothing to embed into company culture.
— Tristan Roth

Tristan noted that many companies pursue ISO 27001 purely for external reasons — sales pressure, vendor demands, regulatory requirements. But this "checkbox compliance" mindset often leads to rushed implementations, shallow training, and policies that nobody reads.

That’s precisely why meaningful certifications stand out. As a case in point, Passwork itself recently achieved ISO/IEC 27001:2022 certification — a milestone that underscores our commitment not just to technical excellence, but to real, operational security practices. You can view the certification details here. For us, it’s not about the certificate on the wall — it’s about living the standard in our day-to-day approach to product design, customer trust, and internal controls.

The real reason employees tune out

It's easy to blame employees for ignoring security policies. But in many cases, they’re not wrong to do so.

Tristan described how companies often copy-paste policy templates from the internet without adapting them to their specific context. A policy meant for
a university might get handed to a startup team. A remote work rule might ignore hybrid realities.

If a policy obviously doesn’t reflect your real work environment, of course employees will skip it. They know when no effort was made.

This disconnect between policy and reality creates distrust. Employees learn
to view documentation as bureaucracy, not guidance.

Training vs. transformation

Security training is everywhere — but it’s often treated like background noise.

Tristan emphasized that truly effective awareness programs require empathy, relevance, and context. Instead of one-size-fits-all e-learning modules, what works best is direct, human conversation. Sitting down with small groups. Tailoring sessions to different roles. Explaining why a policy exists, not just what it says.

Sometimes, the most effective approach is doing things that don’t scale. A 10-person training session can do more than a 2-hour video everyone skips.

This type of pedagogy isn’t flashy — but it changes behavior. It creates a feedback loop between employees and security teams that policy documents alone can’t.

Third-party risk: The unseen threat

In 2024, over 60% of data breaches were linked to third parties. Yet many organizations still conduct vendor assessments as a one-time task during onboarding — and never revisit them.

The companies I work closest with — I know the people. And if something changes, I can ask for proof, or pivot fast. That’s the mindset companies need to adopt.

Tristan warned against over-relying on surface-level due diligence. He stressed the importance of designating a responsible person (even in small companies) to build real relationships with vendors, revisit risk exposure over time, and keep alternative solutions in mind for business continuity.

Password mismanagement: Still the weakest link

According to Verizon’s Data Breach Investigations Report (DBIR), over 80% of hacking-related breaches still involve stolen or reused credentials.

Despite having password policies in place, many companies don’t monitor whether employees actually follow them. Shared passwords in messaging apps, weak variations of old passwords, or resistance to using MFA — these are all symptoms of convenience overriding policy.

A good password policy isn’t enough. You need to design systems assuming passwords will be compromised — and build defenses like MFA around that assumption.

Passwork and similar tools offer self-hosted or cloud-based solutions, but Tristan’s advice was clear: tools help, but they don’t replace responsibility. Compliance teams need to combine tech with empathy, audits, and clear communication.

Automating GRC without alienation

Automation can cut Governance, Risk management and Compliance (GRC) workloads by up to 60%, but it’s not a silver bullet. Poorly implemented tools can actually increase policy fatigue.

Some platforms take ten times longer than Excel. People go back to Excel — not because they don’t believe in compliance, but because the tool wasn’t built with their workflow in mind.

Instead of aiming for “full automation,” companies should focus on effective automation — solutions that reduce friction, not increase it. This means assigning a project owner, setting realistic expectations, and piloting changes before rolling them out at scale.

Leadership role in building security-first culture

Cybersecurity is often seen as an IT issue, but real change starts with leadership.

A recent PWC survey found that 80% of executives say they prioritize security — yet only 30% of CISOs feel supported. Tristan argued that this misalignment often stems from poor communication.

Security leaders need to speak the language of business. Not vulnerability management. Risk in financial terms. Loss potential. Mitigation cost. Impact.

CISOs must become translators — connecting security risks to business outcomes. When leadership understands the stakes in terms they care about, support and budget follow.

Final thoughts

Employees ignore cybersecurity policies not because they’re lazy — but because the policies feel irrelevant, the training feels generic, and the tools feel like obstacles.

Shifting that mindset requires a cultural transformation: from compliance to care, from documentation to dialogue. As Tristan put it, be the captain of your own security ship. Know your context. Use the tools wisely. But lead with empathy and clarity.

Further reading:

Four ways to make users love password security

Four ways to make users love password security

Passwork BlogIliya Garakh, CTO

Identifying fake apps on your smartphone

Identifying fake apps on your smartphone

Passwork BlogIliya Garakh, CTO

The necessity of cyber hygiene training in today’s digital world

Information security (IS) courses are needed not only for IS department employees and not even only for certain employees of a company but for everyone. Information security training in today’s world, where virtually all areas of life have been digitized, should be on par with fire safety and other fundamental

Passwork BlogIliya Garakh, CTO