Password Managers 2026: Business Security Guide | Cyborium & SCS | Robert Braxton

Robert Braxton and the Cyborium team share what Australian businesses must know about password manager vulnerabilities in 2026 — and what to use instead.

Password managers have become a staple security recommendation for businesses of every size. And for good reason — password reuse across multiple accounts remains one of the most common entry points for credential-based attacks, and a well-implemented password manager eliminates that risk almost entirely. But as the category has matured and grown, so too have the attack surfaces. Research published over the last 18 months has documented significant vulnerabilities in several of the most widely used password management platforms, raising questions that every business owner and IT decision-maker should be asking before they centralise their most sensitive credentials in any single system. At Simple Complex Solutions and Cyborium, we have helped numerous Australian businesses evaluate, implement, and in some cases, remediate poorly configured password management solutions. Here is what we have learned. The Research That Changed the Conversation In late 2024, researchers at ETH Zürich published a landmark study documenting serious vulnerabilities across multiple major cloud-based password managers, including Bitwarden, Dashlane, LastPass, and 1Password. Despite these platforms marketing themselves around zero-knowledge encryption — the promise that only you can access your data — the researchers demonstrated that malicious server attacks could, in certain scenarios, expose stored credentials through routine interactions like logging in, opening vaults, and syncing data. The specific vulnerability counts were alarming: 12 distinct attack vectors against Bitwarden, 7 against LastPass, and 6 against Dashlane. Even 1Password, which employs a more robust dual-key model that adds an additional secret key to the master password, showed vulnerabilities in certain vault sharing scenarios. Perhaps most concerning was the finding that many of these platforms were still relying on cryptographic approaches developed in the 1990s — designs that were reasonable for their era but that do not reflect the current state of either cryptographic capability or adversarial sophistication. What Has Changed Since Then The responsible disclosure process and subsequent media attention generated significant pressure on vendors to address these vulnerabilities. By early 2026, most major providers have published detailed remediation reports and committed to security audits by independent third parties. However, audit commitments and audit completion are different things. Businesses should verify the specific audit status of any password manager they are evaluating, including which auditing firm conducted the review, when it was completed, and what scope was covered. Additionally, the architectural issues highlighted in the ETH Zürich research — particularly the reliance on legacy cryptographic approaches — cannot be fully addressed through software patches alone. Some of these vulnerabilities require fundamental redesigns of the cryptographic architecture, which takes longer to implement and validate than a standard software update cycle. The Zero-Knowledge Marketing Problem One of the most important concepts to understand when evaluating password managers is the difference between "zero-knowledge" as a marketing claim and "zero-knowledge" as a technical implementation. Zero-knowledge encryption, properly implemented, means that the service provider has no mathematical capability to access your data — even if compelled by a court, compromised by an attacker, or acting in bad faith. The encryption and decryption happens entirely on your device, and the service only ever sees encrypted ciphertext. The ETH Zürich research demonstrated that some platforms marketing zero-knowledge approaches had implemented them in ways that created exceptions — scenarios where the server could, under specific conditions, access or manipulate vault content. This is not zero-knowledge encryption. It is partial-knowledge encryption marketed as something stronger. When evaluating a password manager, ask specifically: has this platform's zero-knowledge implementation been independently audited by a cryptography specialist? Not a general IT security firm — a cryptography specialist. And can they provide the audit report, not just a summary? What We Recommend for Australian Businesses Our recommendations at Cyborium and Simple Complex Solutions have evolved based on the research findings and the vendor responses to them. For businesses of 1-20 employees:** Consider self-hosted options like Bitwarden (the self-hosted version, not the cloud version) or Vaultwarden as an alternative. Self-hosting moves the server-side attack surface to infrastructure you control, eliminating the cloud-based vendor compromise risk. This requires more technical capability to set up and maintain but is achievable for most technology-comfortable small businesses. For businesses of 20-200 employees:** Evaluate enterprise-grade solutions with demonstrable third-party audit history, SSO integration capability, granular access controls, and audit logging. The shortlist for most Australian businesses includes 1Password Business (with the secret key dual-factor model engaged) and Keeper Enterprise. Both have more robust audit histories than most alternatives. For all businesses:** Regardless of which platform you choose, implement these controls: require a strong master password of at least 16 characters with complexity requirements, enable multi-factor authentication on the password manager account itself (not just for sites stored within it), enable breach monitoring alerts, and conduct a quarterly audit of shared credentials to revoke access for former employees and remove stale entries. What to avoid:** LastPass remains on our advisory caution list following the 2022 breach, in which encrypted vault data was exfiltrated and the company's communication about the scope and implications of the breach was, in our assessment, materially misleading. Businesses that were using LastPass at the time of that breach should assume their vault data is in adversarial hands and rotate all stored credentials if they have not already done so. The Broader Security Principle The password manager discussion illustrates a broader principle that we apply across all security tooling evaluations at Cyborium: trust must be earned through verifiable evidence, not claimed through marketing language. Security vendors are not incentivised to be transparent about their vulnerabilities. Their sales cycles depend on buyer confidence, and buyer confidence is easier to maintain with polished marketing than with honest technical disclosure. The burden on buyers — particularly business owners who are not security specialists — is therefore to ask harder questions, demand auditable evidence, and engage advisors who are not commercially affiliated with the vendors they are evaluating. That is exactly the kind of independent assessment we provide at Cyborium. If you are evaluating password managers, reviewing your overall security tool stack, or trying to understand whether your current security posture is genuinely adequate or merely compliant on paper, we would be glad to have that conversation.