Yes, I'm purposefully ignoring physical security, because I'm thinking of the kind of threats nvidia faces. It is important to have a security policy that fits

Yes, I'm purposefully ignoring physical security, because I'm thinking of the kind of threats nvidia faces. It is important to have a security policy that fits your threat level, and the engagement of your employees. You can expect from an upper management person that he has a fast lock screen and an encrypted disk and a tight firewall on his laptop. In those conditions it makes absolute sense to recommend a password manager, preferably with a hardware security key. That's a fully decked-out APT resistant upper management guy or sysadmin. This is also the sort of target that would be the subject of a 'pizza girl' covert operative, so yes having passwords on post-its would be horrible. But that's not the type most likely got Nvidia. The other 50.000 employees is what is getting our big corporations in trouble. A poorly secured Windows laptop with out of date software, and no control on third party applications, that's a terrible place for a password manager. How easy is it to write a tool that extracts passwords from the manager if your tool got sysadmin rights by posing as a Java plugin installer, or a cracked video game? The sort of hacker that targets those employees is not necessarily an APT, more likely as mentioned before the passwords of these employees were gotten from big fly-by password leaks like the PSN hack. This sort of hacker wouldn't even look at your physical security, they don't care about your physical security, they're likely across an ocean from you, and likely wouldn't even drive by your office if it was in the same town as they are. The game is seggregating your security levels, and minimizing attack surface where possible. Standardizing a password manager across 50.000 low-tech employees sounds like a bad idea to me.