Common Unsafe Practices

Passwords written on sticky notes attached to monitors or keyboards
Anyone walking by can see, photograph, or copy these passwords. When staff leave, the notes remain visible to others.

Passwords recorded in notebooks or desk drawers
Physical documents can be stolen, lost, or accessed by unauthorised personnel. There’s no way to track who viewed what information.

Passwords saved in unencrypted text files or spreadsheets
These files are easily copied, backed up to insecure locations, or accidentally shared. They provide no access controls or audit trails.

Passwords shared via email, text message, or messaging apps
Credentials sent through these channels remain in message histories indefinitely, are often forwarded without authorisation, and can be accessed if the account is compromised.

Why These Practices Are Critical Business Risks

Security breaches: Written or poorly stored passwords are the easiest way for attackers to gain access to your systems.

Staff turnover nightmares: When employees leave, you must change every password they had access to—often dozens across multiple systems.

Lost productivity: Staff waste time searching for passwords, resetting forgotten credentials, and dealing with lockouts.

Failed cyber insurance audits: Insurance providers now regularly audit password management practices. Unsafe practices can lead to higher premiums, coverage exclusions, or policy cancellation.

What Cyber Insurance Providers Require

Cyber insurance providers in New Zealand are increasingly scrutinising password management practices. Many policies now include specific requirements, and failure to comply can result in claim denials or policy cancellation.

Insurer Requirements vs. Consequences of Non-Compliance

Important: Some insurers now require proof of compliant password management before issuing or renewing policies. Written passwords or unencrypted storage are automatic red flags.

The Real Cost of a Password-Related Security Breach

When a security breach occurs due to poor password practices, the costs extend far beyond the immediate incident. New Zealand businesses face three types of costs:

For most NZ SMBs, a single password-related breach that results in denied insurance coverage could be an existential threat to the business.

Six Critical Flaws of Written Password Management

Written passwords—whether on sticky notes, in notebooks, or in text files—create fundamental security vulnerabilities that no amount of other security measures can overcome:

1. Physical Theft and Unauthorised Access

Anyone can photograph, copy, or steal written passwords. Cleaners, contractors, visitors, or malicious insiders can easily access credentials without detection. Modern smartphones make it trivial to capture written passwords in seconds.

2. No Audit Trail

With written passwords, you cannot track who accessed what information or when. After a security incident, you have no way to determine which credentials may have been compromised or what systems were accessed.

SafeKey Difference: Every password access is logged with timestamp, user, and location. These searchable logs in your license portal provide complete forensic capability—essential for insurance claims and compliance audits.

3. Impossible to Revoke Access

When staff leave your organisation, written passwords remain visible to other employees. The only solution is to change every password the departing employee had access to—a time-consuming and error-prone process that businesses often skip or delay.

4. Becomes Outdated Instantly

The moment a password changes, every written copy becomes obsolete. Organisations often have multiple conflicting password versions stored in different locations, leading to confusion and locked accounts.

5. Too Easy to Share Inappropriately

Written passwords can be copied and distributed without authorisation or oversight. There’s no control over who makes copies or how widely credentials are shared beyond their intended users.

6. Automatic Insurance Compliance Failure

Cyber insurance auditors specifically look for written passwords as evidence of inadequate security practices. Discovery of written passwords during an audit can trigger immediate premium increases, coverage exclusions, or policy cancellation. In the event of a claim, evidence of written passwords provides insurers with grounds to deny it.

The SafeKey Solution: Cyber Insurance-Ready Password Management

SafeKey addresses every cyber insurance requirement while providing a practical solution that New Zealand businesses can use. Built on the proven Vaultwarden/Bitwarden platform, SafeKey delivers enterprise-grade security with local hosting, dedicated infrastructure, and NZ-based support.

Key Features Aligned with Insurance Requirements

Why Audit Logging Is Critical for Insurance Compliance

SafeKey’s comprehensive audit logging is one of the most powerful features for cyber insurance compliance. Every password access is recorded and searchable through your user license portal, providing the forensic capability insurers require.

What Gets Logged

When: Precise timestamp of every password access and usage
Who: Specific user account that accessed each password
Where: Location and system from which access occurred
What: Which passwords and systems were accessed

How This Benefits Your Insurance Position

During audits: Provide insurers with concrete evidence of proper access controls and monitoring
After incidents: Demonstrate exactly what was accessed and when, critical for claims processing
For investigations: Search logs to identify suspicious patterns or unauthorised access attempts
Staff departures: Verify what a former employee accessed before they left
Compliance reporting: Generate reports showing proper password management practices

Enterprise Security at SMB Pricing

SafeKey delivers cyber insurance-compliant password management at a price New Zealand SMBs can afford:

Cost Comparison Examples

10 users: SafeKey $414/year vs LastPass ~$1,200/year vs 1Password ~$1,800/year

25 users: SafeKey $1,035/year vs LastPass ~$3,000/year vs 1Password ~$4,500/year

50 users: SafeKey $2,070/year vs LastPass ~$6,000/year vs 1Password ~$9,000/year

Save $1,200-$7,000+ annually compared to international alternatives, while getting dedicated infrastructure and local New Zealand support.

Return on Investment

Lower insurance premiums: Demonstrating proper password management can reduce cyber insurance premiums by 10-30%.

Avoid breach costs: One prevented security incident pays for SafeKey for years.

Productivity gains: Reduced time spent on password resets and managing access.

Peace of mind: Know your business is protected and compliant with insurance requirements.

What SafeKey Changes for Your Business