Cyber security case study

Passwordless Sign-In and Shared Account Control for a Brisbane Firm

Novaguard introduced passwordless primary sign-in for a Brisbane professional services firm with more than 20 staff. Shared vendor and social-account credentials were moved into a company password manager, supported by staff training and management ownership of adoption.

By Michael Jordison, Director, Novaguard Technology Group

Brisbane-based, with remote support Australia-wide. Client details are anonymised.

The challenge

The firm managed IT internally. Staff recorded passwords on notes, while several people shared access to company social accounts and vendor services. Individual sign-in and shared credentials needed different controls.

What Novaguard changed

Passwordless primary identities

We moved staff primary identities to passkey-based sign-in and applied multi-factor authentication across users. Staff could sign in using their registered device without typing a password for their primary identity.

Managed shared credentials

Accounts that remained shared in this environment moved into a company password manager with complex, unique credentials and access assigned to authorised staff. The business gained central ownership of credentials previously shared informally.

Offboarding and recovery procedures

Central identity controls supported removal of access to integrated services. Shared account access also required revoking vault access and changing credentials where appropriate. Recovery arrangements covered lost or replaced sign-in devices.

Staff adoption

Some staff initially resisted the change. We provided training and assigned management ownership for adoption of critical controls, so the rollout addressed daily working habits as well as configuration.

Results and verification

Staff used passwordless sign-in for primary identities.
MFA covered users without standing exemptions.
Shared vendor and social credentials were held under company control.
Password notes were removed from monitors.

The passwordless outcome applies to primary sign-in. Shared and legacy accounts retained passwords where needed. Removing a central identity does not by itself revoke every independent application account; those services need their own offboarding controls.

What this means for a similar organisation

Separate personal identities from shared account requirements. Plan recovery, staff training, and offboarding alongside the sign-in rollout.

Explore managed cyber security or start with a Cyber Business Review.

Questions about this engagement

Did this remove every password from the business?

No. Primary staff identities became passwordless. Shared and legacy accounts that still required passwords were managed through a company password manager.

What helped staff adopt the change?

Practical training and management ownership of critical controls helped staff change their daily sign-in habits. Recovery arrangements were also part of the rollout.

Where should we start if staff share passwords?

Identify the accounts first. Separate personal staff identities from vendor, supplier, and other accounts used by several people. Then check which services support individual access and which still require a shared credential. This gives the rollout a clear scope and avoids treating every account as the same problem. In this case, primary sign-in and shared credentials were handled separately.

What should happen when someone leaves the organisation?

Offboarding should cover the central identity, access to the company password manager, and applications with independent accounts. Where a departing employee had access to a shared credential, consider whether it needs changing. The case study illustrates why the account inventory matters: a central sign-in change only handles the services actually connected to it.

How do you reduce disruption when changing staff sign-in?

Include staff training, device registration, and recovery arrangements in the rollout plan. People need to understand how to sign in during an ordinary workday and where to get help if their device is lost or replaced. This engagement also used management ownership to support adoption. The right sequence depends on the applications, devices, and working arrangements of your team.

Still got passwords on sticky notes?

Passwordless identity is part of our managed cyber security service. Start with a conversation about where your firm actually stands.

Discuss your security requirements