Walk into almost any small business in East Texas and you’ll find the same thing behind the counter: a spreadsheet named “logins,” a shared note on the office computer, or a sticky note under a keyboard with the Wi-Fi password and the QuickBooks login on it.
Nobody put that there because they don’t care about security. They put it there because five people need access to eleven systems and nobody had a better answer.
A password manager is the better answer. It’s one of the cheapest, highest-return security tools a business can buy — usually three to eight dollars per user per month — and it fixes a problem that causes real breaches. Here’s how to choose one and actually get your team using it.
Why Passwords Are Still the Weak Point
You’d think passwords would be a solved problem by now. They aren’t, for a few stubborn reasons.
People reuse them. The average person maintains dozens of accounts and a handful of passwords. When one site gets breached — and sites get breached constantly — attackers take that username and password and try it everywhere else. This is called credential stuffing, and it’s automated, cheap, and effective.
People share them. When a business has one login for the accounting portal and four people who need it, that password ends up in a group text, an email thread, or a spreadsheet on a shared drive. Every copy is a place it can leak from, and when the employee who knew it leaves, nobody changes it.
People pick bad ones. “Longview2024!” satisfies most complexity rules and takes a modern cracking rig almost no time to guess, because attackers know exactly how humans construct passwords.
Nobody knows what exists. Ask most owners to list every account their business has and they’ll miss half of them. Old vendor portals, a domain registrar set up by a former employee, a payment gateway nobody has logged into since 2019 — all of it still live, all of it still a door.
A password manager attacks all four problems at once.
What a Password Manager Actually Does
At its core, it’s an encrypted vault. Every credential goes in, protected by one strong master password plus multi-factor authentication. The vault syncs to your phone and browser, fills logins automatically, and generates a long random password for every new account so you never invent one again.
The business versions add the parts that matter for a company rather than an individual:
- Shared vaults so the front desk team gets the credentials for the systems the front desk uses, and nobody else’s.
- Administrative control so you can revoke someone’s entire access the day they leave, instead of hoping they forgot.
- Reporting that flags weak, reused, and breached passwords across your whole organization.
- Secure sharing so you can hand a vendor a credential without emailing it in plain text.
The encryption is done on your device before anything is sent, which is why reputable vendors can honestly say they cannot read your vault. Choose a provider that operates this way — the term to look for is “zero-knowledge architecture.”
How to Choose One
Most well-known business password managers do the core job well. Focus on fit rather than feature checklists.
Does it cover the devices you actually use? Windows and Mac desktops, iPhone and Android, and whichever browsers your team uses. If half your staff works from trucks and job sites, the mobile app needs to be good, not tolerable.
Does it integrate with your identity system? If you run Microsoft 365, look for one that syncs users and groups automatically. Adding and removing people by hand is where password hygiene quietly dies.
Does the vendor publish independent security audits? Reputable providers commission third-party assessments and publish the results. Ask for them before you sign, and be wary of anyone who can’t produce one.
What happens if you lose the master password? Business plans should offer an account recovery process controlled by your administrators. Consumer plans usually don’t, and a locked vault on day one will sink adoption faster than anything else.
Is there a break-glass plan? Write down how you’d reach critical credentials if the service itself were unavailable, and store that recovery kit in a physical safe.
Rolling It Out Without a Revolt
Technology projects fail on adoption, not installation. A rollout that works looks roughly like this.
Week one: inventory. List every system the business logs into — email, banking, payroll, your practice management or dealership software, vendor portals, the domain registrar, social media, the alarm and camera systems. Do this before you buy anything. It usually turns up two or three accounts nobody remembered.
Week two: start with the leadership team. Get the owner and managers using it first. If the boss still has passwords on a legal pad, nobody else will take it seriously.
Week three: shared vaults by role. Front desk, service, billing, admin. Give each group what it needs and nothing more. This is the step that turns a password manager into an access-control system.
Week four: import and clean up. Move everything in, then work the weak-and-reused report. Change the worst ones. Don’t try to fix everything at once — start with email, banking, and remote access.
Ongoing: make it the only path. New account, new hire, new vendor — it goes in the vault, or it doesn’t exist. The spreadsheet gets deleted, not archived.
Budget an hour of training. Most people take about ten minutes to understand it and a week to stop resenting it.
The East Texas Angle
The businesses we work with across Tyler, Longview, Palestine, Lufkin, and Texarkana tend to share a shape: small teams, long tenure, lots of shared systems, and software that came with the industry rather than being chosen for security.
That shape has specific consequences. A CPA firm has staff who all need the tax software, the e-filing portal, and the bank feed — classic shared-credential territory, and Texas law imposes real notification duties when client data spills. A law office faces the same math with case management and court filing systems. Dealerships juggle a DMS, several lender portals, and a manufacturer system, most of which were configured once and never revisited. Medical practices have to demonstrate access controls under HIPAA, and “everybody uses the same login” is a finding waiting to happen.
Manufacturers and oilfield service companies across the region carry a different version of the problem: credentials for equipment portals, remote monitoring, and vendor systems, held by people who are rarely at a desk. And any company doing work for defense primes in the DFW corridor will find shared accounts flagged the moment a customer starts asking CMMC questions.
None of that requires a big project. A password manager, multi-factor authentication, and an inventory of who can reach what will move a small business further than most expensive tools. If you’d rather not sort it out yourself, our managed IT team does this as routine work — get in touch and we’ll walk your list with you.
The Same Question, Pointed at Your Cameras
A password manager is really an answer to one question: who holds your data, and can they be made to hand it over or lock you out? That question doesn’t stop at passwords. It’s worth asking about every system in your building — and the one most owners never think to ask it about is the camera system.
Cloud surveillance vendors store your recordings on their servers, under their terms of service. That arrangement has three quiet consequences. Access is theirs to define: the vendor decides who can view footage, including their own staff, and terms can change without your input. Retention is a subscription line item — most plans cover only a couple of weeks, and a lapsed payment can erase your history. Availability is out of your hands: if their service is down the morning you need to pull footage for an insurance claim or a sheriff’s deputy, you wait.
For a business handling sensitive premises — a medical practice, a law office lobby, a dealership lot, a manufacturing floor with proprietary processes — that’s a real privacy exposure, not a theoretical one. Video of your customers, patients, and employees is personal data, and Texas businesses increasingly have to answer for where it lives and who can reach it.
The alternative is straightforward: keep the footage on your property. Local on-premise storage means a recorder on site, hardware you own, and recordings that belong to you the moment they’re captured. No per-camera monthly fee, no vendor holding your history, no third party in the access path. If you want off-site redundancy, you can add replication as a choice rather than accept it as a default.
That’s how we build every system in our physical security practice, and it’s the same principle behind the password manager: the fewer parties holding your keys and your recordings, the fewer places they can leak from. If you’re weighing a camera system, our security camera installs across East Texas start from that assumption.
This Week in Security
Boston Scientific hit by cyberattack disrupting global operations (Aug. 26). The medical device maker disclosed in a federal filing that an incident detected Aug. 25 disrupted IT systems and business applications, including the systems used to process and ship customer orders. Shares fell about 3.5% on the news. For clinics and hospitals in East Texas, the lesson is downstream: when a supplier goes dark, your order pipeline goes with it. Ask your critical vendors what their outage plan is before you need it. (TechCrunch)
Canada’s largest children’s hospital breached through a third-party app (reported Aug. 28). SickKids in Toronto confirmed that a cybersecurity incident tied to a third-party software application exposed personal data belonging to current and former employees and job applicants. Clinical systems and patient records were not affected. Another reminder that your vendors’ security is your security — including the ones that only touch HR data. (Integrity360)
INTERPOL operation nets 58 arrests in business email compromise networks (reported Aug. 28). Operation Jackal IV, coordinated across 22 countries, identified 263 suspects tied to West African organized crime groups running BEC, investment fraud, and romance scams. South African authorities alone seized $2.67 million. BEC remains the single most expensive threat to small businesses — verify wire instruction changes by phone, using a number you already had. (Integrity360)
Cyberattack takes a UK power generator offline for four days (reported Aug. 28). A small-scale generator was knocked out by an attack the UK government has linked in press reports to Iranian-affiliated hackers, prompting fresh warnings to energy operators. No wider grid risk, but it’s a concrete example of an attack crossing from IT into physical operations — worth noting for the energy and industrial operators around Tyler, Kilgore, and Longview. (Integrity360)
CISA adds an actively exploited Oracle web server flaw to its KEV catalog (Aug. 24). CVE-2026-21962, an improper access control vulnerability in the Oracle HTTP Server and WebLogic Server proxy plug-in, was added to the Known Exploited Vulnerabilities catalog. If you run Oracle middleware anywhere in your stack, patch it. If you don’t know whether you do, that’s the more important finding. (CISA)
Dogwood Security LLC is a veteran-owned managed IT, cybersecurity, and physical security company based in Palestine, Texas, serving Tyler, Longview, Texarkana, Lufkin, and the DFW metro.