Password health and at-risk reports

Outpost checks every stored password for the problems that get accounts taken over, and when a team member leaves, it lists exactly which credentials they saw and which they could have seen. This page shows how to find unhealthy passwords and how to run the departure reports so nothing a former colleague knew stays unchanged.

Before you begin

• Reading credential health needs vault:read. The departure reports need vault:manage.
• On the MSP plan, these reports run across every client. A client that cannot be reached is named on the report, so a missing client is never read as a clean one.

What Outpost checks

Outpost scores a password’s strength when it is saved, and checks the whole vault every six hours. Each finding shows as its own chip.

Finding	Means
Breached	The password appears in a public corpus of breached passwords. Raises a critical alert.
Reused	Another credential in the same client has the same password. Clients are never compared with each other.
Weak	The strength score is Very weak or Weak.
Not rotated	Nobody has changed the password in longer than A credential is stale after, days, 365 by default. A password never changed is measured from when it was created.
Insecure address	One of its web addresses uses http://, so the password crosses the network unencrypted when used.
No second factor	A Login with a web address and no one-time code stored.
Not linked to anything	No password is stored on the credential, which often happens with imported credentials that need a value.

A retired credential has no findings.

The breach check sends only the first characters of a hash of the password to the breach corpus, never the password. It needs the internet, so it does not run on a Remote Outpost, and an administrator can turn it off with Check stored passwords against known breaches in Documentation > Settings. When it has not run, a credential’s breach status reads Not checked, never clean.

Find unhealthy credentials

• The Documentation Overview counts credentials flagged. Select it to open the credential list.
• The Documentation Overview also links Password health, a page that lists every stored password and what is wrong with it. The link is shown to holders of vault:read.
• In Credentials, the Health column shows each credential’s worst finding.
• On a credential, the Health card lists every finding, the Strength, and the breach result, such as Not in the breach corpus or Seen 3 times in breaches.

Run the Credential health report

1. Go to Reports > All reports.
2. Select Credential health. The report lists every credential with its collection, kind, strength, breach count, findings, last rotation, and whether checkout is on. It never includes a secret.
3. Select Download PDF or Download CSV.

To receive it regularly, schedule it. See Run and schedule reports.

Offboard someone who has left

Disable the person’s console account first, so they cannot reveal anything more. Then run the two departure reports. Both list only what the vault knows about, so a password the person learned some other way is not on them.

Termination report

The termination report answers what one person saw, what they could have seen, and what has already been changed since. Open it from Termination report on the Documentation Overview, shown to holders of vault:manage.

1. In The person, choose who left. Anyone who has ever held access is listed, including disabled accounts.
2. In How far back, choose The last 30 days, The last 90 days, The last year, or Everything on record. To set dates instead, use Or from this date and Until.
3. Select Run it.

The report has two tables. The first is everything the person disclosed: each reveal, use, one-time code read, previous value read, and export. The second is the credentials they had access to and never opened. A grant that was never used is still a grant, so rotate those too. Select Download the PDF for an auditor or Download the CSV to work from.

Still at risk

Still at risk is the termination report with the finished work removed: the credentials the person could reach that nobody has changed since. Open it from Still at risk on the Documentation Overview, shown to holders of vault:manage.

1. In The person, choose who left.
2. Select Run it.
3. Change each credential listed under Still to change.
4. Run it again. When the list is empty, the page says Nothing this person could reach is still unchanged. The offboarding is complete.

Credentials at risk after a departure in Reports > All reports runs the same check for everyone who has left, and can be scheduled as a regular sweep.

Verify

Run Still at risk for the person. The offboarding is done when it reports nothing still unchanged and names no client it could not reach.

If something goes wrong

Symptom	Cause	Fix
Every credential’s breach status is Not checked.	Breach checking is off, or this is a Remote Outpost.	Turn on Check stored passwords against known breaches, or accept that offline Depots cannot check.
A report names a client that could not be reached.	That client’s database did not answer during the run.	Run the report again later. Nothing from that client is in this run.
The departure reports are unavailable.	You lack vault:manage.	Ask an administrator.

Next steps

• Credentials vault
• Report datasets