# The costs of unmanaged credential sprawl

DevFeed: [The costs of unmanaged credential sprawl](<https://devfeed.tech/articles/the-costs-of-unmanaged-credential-sprawl-1966.md>)

Original publisher: [Read original article](<https://1password.com/blog/the-costs-of-unmanaged-credential-sprawl>)

Author: info@1password.com (Rachel Sudbeck)

Published: 2026-05-12T00:00:00Z

Content type: article

Language: en

Sources: [Blog on 1Password Blog](<https://devfeed.tech/sources/blog-on-1password-blog.md>)

Topics: [passwords](<https://devfeed.tech/topics/passwords.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [blog](<https://devfeed.tech/tags/blog.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [developer](<https://devfeed.tech/tags/developer.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

The article examines how unmanaged credential sprawl raises security, compliance, and operational costs. It highlights credentials such as passwords, developer secrets, API keys, SSH keys, service accounts, and access tokens, and argues that AI-based tools and agents intensify access and identity-management challenges.

## Source excerpt

This blog has been adapted from an excerpted section of 1Password's ebook, Credential sprawl: How AI increases the risks. To read the complete ebook and learn more about how AI is accelerating credential sprawl, click here. In Ancient Rome, the military had a daily "watchword" that soldiers used to enter the camp. An official would inscribe the watchword on clay tablets, which were distributed throughout the various military units. If a tablet wasn't returned, they swiftly tracked it down and punished the soldier who had failed to return it. Clearly, one thing has been true from Ancient Roman times until now: if you want to stay secure, you need to know where your passwords are. Unfortunately, keeping track of credentials is more difficult for a modern organization. Today's companies have to manage an ever-growing number of credentials that go well beyond traditional passwords, such as developer secrets, passkeys, shared logins, API keys, SSH keys, service accounts, and SSO access tokens. This problem is especially urgent due to the rise of AI-based tools and agents, which have not only increased the scale and scope of unmanaged credentials, but also present access and identity management challenges that tools like SSO and PAM aren't equipped to handle. What is credential sprawl? Credential sprawl is the uncontrolled growth of credentials like passwords, API keys, tokens, and other developer secrets, being stored across systems without centralized governance. Credential sprawl tends to quietly accumulate across systems, often going unaddressed until a breach exposes the vast web of risky, unmanaged access. In this blog, we'll make a case for addressing this issue proactively, by examining all the ways it extracts a cost from companies. What are the risks and costs of credential sprawl? When credential sprawl runs rampant through a company, the costs manifest in a variety of ways, from an increased blast radius in the event of a breach, to time-consuming manual proce