Should a five-person business move shared logins into a team vault?

A public authority frames the choice as an organisational policy decision that depends on how people actually work, not as a product feature contest.

Reported breach prevalence is measured against all businesses, so it establishes that the exposure is common rather than that a particular team is exposed.

The published guidance is written for system owners setting policy and names large organisations and public sector readers, so a team without an administrator must translate rather than inherit it.

In the 2025 to 2026 survey 74% of businesses reported a password policy while 47% required two-factor authentication, and two-factor use among micro businesses rose from 35% to 43%.

The authority describes password reuse and other insecure workarounds as the predictable response to password overload, which is the behaviour the spreadsheet is currently absorbing.

Vendor documentation describes organisation-owned vaults whose items are shared to members and administered from a console, which is the capability that makes revocation possible in principle.

The same guidance warns that a manager is a natural target because one successful attack can expose every stored password, so the master secret and the device are part of the test.

The authority recommends periodic review of how the product is actually used after implementation, precisely because benefit is lost if people stop using it.

On-device managers are described as unsuitable where the same service must be reached from several devices, while cloud-sync managers add considerations for data in transit and remote account compromise.

In April 2026 the same technical authority said it no longer recommends passwords where passkeys are available, addressing consumers and digital services rather than team ownership of shared business accounts.

The two positions are not merged here: the newer statement is about individual sign-in and the older guidance is about organisational credential policy, so the tension is disclosed rather than resolved.

Community questions establish that the selection question is asked, and the governing editorial rule prevents that signal from being read as a finding about fit or outcome.

Hard exclusions still apply here: fabricated claims, undisclosed commercial bias, and a duplicated primary intent cannot be outweighed by decision value.

The prevalence and control-gap figures on this page are United Kingdom population statistics. They are not South African evidence, and no local law, reporting duty, or regulator position is asserted here.

The authority notes that an effective single sign-on process can make a password manager unnecessary for work passwords, so the correct answer for one business may be a different control entirely.