{"id":36051,"date":"2026-06-25T20:20:58","date_gmt":"2026-06-25T15:20:58","guid":{"rendered":"https:\/\/aikdesigns.com\/blog\/?p=36051"},"modified":"2026-06-25T20:20:58","modified_gmt":"2026-06-25T15:20:58","slug":"credential-sharing-is-not-carelessness-its-a-symptom-of-failed-governance","status":"publish","type":"post","link":"https:\/\/aikdesigns.com\/blog\/credential-sharing-is-not-carelessness-its-a-symptom-of-failed-governance\/","title":{"rendered":"Credential Sharing Is Not Carelessness. It\u2019s a Symptom of Failed Governance"},"content":{"rendered":"

Ammar Faheem<\/span><\/a>, Director Product Marketing (CIAM)<\/span><\/p>\n

Summary:<\/b> Credential sharing among B2B partners is rarely a security culture problem. It is a governance failure. When access provisioning is too slow, too opaque, or too dependent on host organization workflows, third parties find workarounds, and those workarounds become silent security debt. Data from the Thales Digital Trust Index 2026 shows that 66% of partner users have shared or borrowed credentials, with 53% citing slow official processes as the reason. The fix is not tighter restrictions. It is smarter delegation.<\/span><\/p>\n

—-<\/span><\/p>\n

According to the <\/span>Thales Digital Trust Index 2026<\/span><\/a> report, 66% of partner users have shared or borrowed credentials.\u00a0<\/span><\/p>\n

Their intent was likely not malicious, but rather a move made in operational desperation.<\/span><\/p>\n

Per the report, only 22% of B2B partners receive system access or login details immediately upon starting. Anxious to get the job done and meet quotas, many turn to sloppy workarounds to sidestep cumbersome IAM and onboarding processes and access necessary systems.\u00a0<\/span><\/p>\n

Shadow access is more often the result of design failures than of user recklessness. This is squarely a governance problem, and it\u2019s up to host organizations to fix it.<\/span><\/p>\n

Partners Don\u2019t Want to Wait to Deliver Value<\/span><\/h2>\n

A look at current B2B provisioning frameworks would suggest that partners are more eager to deliver value than host orgs are to receive it.<\/span><\/p>\n

In the Thales research, among the nearly two-thirds who have shared or borrowed credentials, 53% did so because provisioning processes were too slow. When official processes can’t keep pace with operational needs, users don’t wait; they find whatever works, risk and all to get the job done.<\/span><\/p>\n

This lines up with what <\/span>Gartner<\/span><\/a> vice president analyst Chris Mixter explains: \u201cIn general, cybersecurity puts control in place that they can deliver at scale, but employees experience a lot of friction in complying, so they find ways around it.\u201d<\/span><\/p>\n

This friction is the problem that leads to even more problems.\u00a0<\/span><\/p>\n

When users abandon login processes or are forced to delay, it\u2019s not just productivity that’s lost. Security debt builds up as users pass credentials around \u2013 maybe via Slack or text \u2013 and unsafe workarounds turn into silent opportunities for threat actors and opportunists. Sacrificing security because normal processes are too slow isn\u2019t defensible in year-end reviews.<\/span><\/p>\n

Third Parties Willing to Take On Access Themselves<\/span><\/h2>\n

Even though it would entail additional operational overhead, B2B partners have indicated a willingness to handle their own identity and access management if it means getting things done faster.<\/span><\/p>\n

According to the report, 54% want the ability to reset their own authentication factors, and 52% want personal access to their current entitlements. No middleman. No central IT gumming up the works.<\/span><\/p>\n

Users wanted a self-service portal where \u201cexternal partners could…review their access without so much bureaucracy,\u201d and \u201cimproved automation workflows\u201d were also requested to reduce delays in access granting.\u00a0<\/span><\/p>\n

Third parties benefit as much from the partnership as the host organization, and don\u2019t want their deliverables, metrics, and services held up by IAM processes that treat them like a third priority. They feel much more comfortable when access and provisioning are in their own hands.<\/span><\/p>\n

The Legal Implications of Sharing Access Governance<\/span><\/h2>\n

However, most organizations that are unsure of where the legal line is drawn feel naturally more comfortable with partner IAM in-house.\u00a0<\/span><\/p>\n

The reality is that it\u2019s a mixed bag: the Thales research reveals the gap between intent and execution: while nearly half (49%) of organizations currently offer self-service capabilities to partners, that still leaves the majority without them, meaning most partners remain dependent on host organization ticket queues and manual workflows to get access.\u00a0<\/span><\/p>\n

However, while the presence of a shared model is good, it also suggests that the partner onboarding process could be inconsistent across organizations: reintroducing the friction that the shared model was designed to eliminate.<\/span><\/p>\n

The way to realign is and always has been to map to established frameworks.\u00a0\u00a0<\/span><\/p>\n