A password manager is the cheapest real security control you'll ever buy

Ask most small organisations what their biggest security risk is and they'll describe something exotic - a nation-state actor, a zero-day. The actual answer, most of the time, is much duller: someone reused a password that leaked from an unrelated site years ago, and an attacker with a list of billions of breached credentials eventually tried it against the login page that matters.

A team password manager closes most of that gap, and it's not expensive:

• Every account gets a genuinely random, unique password, because nobody has to remember it - the manager does.
• A leaked password from some other site becomes irrelevant, because it was never reused anywhere that matters.
• Shared logins (the ones that shouldn't exist, but do) become traceable and revocable in one place instead of "someone knows the password and we're not sure who's still using it."
• Offboarding gets simpler: revoke access in the vault, done, instead of hoping every shared login got its password changed on the way out.

The honest objection worth naming: it's one more thing to roll out and one more habit to build. It's still cheaper than the alternative, which is finding out during an incident which of your logins were reused from a site that got breached two years ago - by then it's not a rollout project, it's a cleanup under pressure.

If your organisation doesn't have one yet, that's worth fixing before the next MFA rollout, the next Conditional Access policy, or anything more sophisticated - it's the cheapest fix available and it's usually the gap that actually gets exploited.