The spreadsheet nobody wanted to talk about

Every company has one. Ours was called logins_FINAL_v3.xlsx, lived in a shared drive, and was last audited by someone who left in 2023. When a contractor asked for the staging database password, the answer was a screenshot pasted into a channel with 212 members.

Nothing bad happened. That was the scary part. We had normalised a process that only worked because no one had tested it.

Convenience is a security control too. If the safe path is slower than the unsafe one, people will take the unsafe one every time.

Making the safe path the fast path

The rollout succeeded not because of policy documents, but because autofill made signing in faster than typing. Browser extensions matter more than admin dashboards. If your engineers never have to open the vault, they will happily use it.

We set up shared vaults per team, turned on breach monitoring, and wrote a two-paragraph guide instead of a wiki. Three weeks later the spreadsheet was gone.