Andrew Hartnett, CTO
Andrew Hartnett is the chief technology officer at Bitwarden, leading the engineering organization. He brings extensive experience building, operating, and maintaining products at the intersection of open source, massive-scale data, cybersecurity, and observability, gained across startups, large institutions, and major corporations. Andrew co-founded Rackspace Managed Security and led its engineering and development organization, ran the Core Data Platform organization at New Relic, and most recently served as CTO of One Identity, where he transformed the organization and its processes to embrace an AI-assisted future. He is passionate about driving innovation and accountability while fostering a collaborative engineering culture rooted in excellence and delivery.
Areas of expertise
Engineering leadership
Large-scale data platforms
AI and agentic workflows
Open source software
Identity security
Cloud infrastructure and observability
Cybersecurity Awareness Month Quotes and Commentary from Industry Experts in 2026
"Strong access controls still depend on securing the underlying identities and credentials. Human accounts should use phishing-resistant authentication such as passkeys where available, or strong, unique passwords stored in a password manager and protected by multifactor authentication (MFA).
Machine credentials such as API keys and shared secrets should be tightly scoped, securely stored, rotated, and retired when no longer needed. Regularly reviewing connected applications and revoking unused access can help prevent a compromised account or overly permissive AI integration from becoming a much larger security incident."
National Insider Threat Awareness Month 2026: Expert Insights
"Insider risk can stem from the deliberate misuse of legitimate access or from an honest mistake, and the potential damage grows when accounts retain broader access than a person needs. Stolen credentials present a different threat, but excessive permissions can magnify the impact in much the same way. Credential management is foundational, but organizations also need to govern what happens after access is granted, particularly for privileged access to critical systems and sensitive data. That means enforcing least privilege, reviewing access as roles change, and maintaining visibility and auditability into who accessed what and when."
What the Salesforce and Google outages reveal about token theft and downtime
Andrew Hartnett, Bitwarden’s CTO, agrees that when a primary identity provider goes down, the most vulnerable processes are new logins, session token renewals, and MFA prompts. “Automated systems, software build pipelines, and connected applications often rely on short-lived digital tokens, and they can fail the moment those tokens cannot be renewed,” he told Spiceworks.
Sony’s So-net Breach Exposes 2.59 Million Customer Records
“Exposed email credentials create a dangerous ripple effect because a compromised inbox allows attackers to hijack linked services via automated password resets,” said Andrew Hartnett, CTO at Bitwarden. “Organizations need to limit this blast radius by replacing reusable credentials with phishing-resistant authentication, such as passkeys.”
Cybersecurity Awareness Month 2026: What Industry Experts Want You to Know
"AI is expanding the number of identities and access paths organizations need to secure. As these tools become embedded in everyday work, organizations should apply privileged access principles to any AI system that can access sensitive data or act on their behalf. That means granting only the permissions required for a defined task, defaulting to read-only access where possible, requiring human approval for consequential actions, and removing access when it is no longer needed. Organizations already face a privileged access gap, and AI is raising the stakes by adding more identities and access paths to govern. Recent Bitwarden research found that 84% of respondents rated securing privileged account access as extremely or very important, yet 55% said their organizations had no PAM solution in place."