Managing Passwords is Obsolete, Manage Privilege Instead!

Maurice Côté, VP of Products at Devolutions, argues that both password managers and standard MFA, as designed a decade ago, are now obsolete and that organizations should shift from managing passwords to managing privilege. He traces how attackers defeated MFA push notifications and stole session tokens, and describes how legacy password managers create single points of failure and account-centric rather than asset-centric workflows. He situates privileged access management (PAM) within NIST's zero trust framework, covering its core components: discovering accounts across identity providers, vaulting and rotating credentials, brokering and logging access, and launching sessions without ever revealing passwords to technicians. He contrasts shared, dual (dash-admin) and passwordless account models with ephemeral, just-in-time privileged accounts that exist only for the duration of a task, arguing these best limit lateral movement and token replay risk. He closes on the productivity-versus-security tradeoff, recommending organizations adopt PAM incrementally against their own risk posture and compliance needs (ISO 27001, SOC 2, HIPAA), and takes an audience question on handling MFA-less service account credentials through automated password rotation, propagation and application-to-application password management.