A shared credential means you cannot tell who did what, and you cannot remove one person's access without changing the credential for everyone. OWASP's secrets guidance lists sharing one credential across users or services as something to avoid. Replace it with an individual account or a per-workload identity wherever the system allows.
What goes wrong with sharing
- No attribution. The log says the shared account did it. Incident response and audits then rely on guesswork.
- No clean revocation. When someone leaves, you must rotate the shared value and update every person and system that uses it.
- Weak MFA. A shared login usually cannot carry one person's second factor, so it often runs without one.
- Spread. The value ends up in chat, wikis and notes, and in more places over time.
Where sharing hides
- Admin consoles on third-party tools that sell per-seat plans.
- Social media and brand accounts.
- Shared cloud root or break-glass accounts.
- One API key used by several services and developers.
- CI variables that hold a personal token used by the whole pipeline.
Replacement options
Individual accounts. Use SSO or invite each person by name. Per-seat cost is usually smaller than the cost of one incident.
Delegated access. For brand and social tools, use the tool's role-based invites instead of a shared password.
Per-workload identities. Give each service its own key or federated identity so you can scope and revoke it alone. See machine vs human identity.
Controlled shared entries. If a system truly allows one login only, keep it in a vault with access logging, MFA on the vault, and checkout approval for sensitive ones. Rotate it whenever anyone with access leaves. Keep break-glass credentials in a secondary system, as OWASP advises, and test them.
A cleanup plan
- List shared logins and keys. Ask each team, since they know of ones the central list lacks.
- Rank by what they can reach.
- Replace the highest first, then rotate the old value. See rotating without downtime.
- For the ones you keep, name an owner and a review date.
- Enable logging so even shared use leaves a trace.
Quick check
Is a shared mailbox the same problem?
Often. Shared mailboxes can be given to named users with delegation, so actions are tied to a person.
What if the vendor allows only one login?
Put it in a vault with logging and MFA, restrict who can open it, and rotate on every departure. Ask the vendor about roles.
Sources
Last reviewed: 19 October 2026.
