I want to start with a confession that most security leaders will recognize but few will say out loud: almost everyone reuses passwords. Not the reckless or the untrained. Everyone including, if we are honest, a fair number of people in our own profession.
For years, our industry’s response to this has been some version of finger-wagging. Use unique passwords, make them longer, add a symbol and change them every 90 days. Do not write them down. And then, when someone inevitably reuses the same base password across a dozen systems with a “1”, “2”, “3” on the end, we call them the weakest link.
They are not. They are just human. Our expectations and ridiculous password policies are the real weak links here.
This week of Cybersecurity Awareness Month belongs to Lock and Key, the Workforce Risk Division’s specialist in passkeys, multi-factor authentication and encryption. Lock and Keys’ advice on the character card is deceptively simple: your password should not be a word; it should be a story only you know. I would add a second half to that. A story only you know, and that you only have to remember once, because everything else is carried by a tool, not by your memory.
Here Is the Math at the Heart of this Problem
The average employee touches an average of 120 accounts across their work and personal life. Corporate SSO covers some of them. It does not cover the shadow SaaS tool a team signed up for last quarter, the supplier portal, the conference registration, the AI chatbot someone tried out over lunch, the personal email that shares a device with the work one.
Now ask a human being to generate and retain a unique, high-entropy, 16-character string for every single one of those, rotate them regularly, and never write any of them down.
That instruction is literally impossible. And when we give people impossible instructions, they work around them and improvise to remain productive. They reuse, they pattern, they keep a spreadsheet. They put it on a sticky note under the keyboard.
Psychologists call this cognitive load. Security people should call it what it is: a control that has been designed to fail, and then blamed on the person it failed.
Why the Old Rules Made Things Worse
Forced 90-day rotation is the clearest example. It was introduced with good intentions, and for years it was gospel. But watch what it actually produces in the wild: Summer2026! becomes Autumn2026! becomes Winter2026!. The rotation is theatre and this predictability is a gift to anyone with adversarial motives.
The guidance has since caught up. Both NIST Special Publication 800-63B (Digital Identity Guidelines) and the UK’s NCSC now advise against arbitrary scheduled expiry, and against the complexity rules that pushed people towards those patterns in the first place. Length and uniqueness beat character requirements. Rotation of passwords should be based on evidence of compromise, not on the calendar.
Many organizations know this. Far fewer have actually changed their policy, because the old rules are baked into a compliance checklist somewhere and nobody has adjusted.
Credentials Are Still the Front Door
None of this is an argument that passwords do not matter. Quite the opposite. Identity weaknesses played a role in almost 90% of Unit 42 investigations last year.
Stolen and reused credentials remain one of the most common ways attackers get their initial foothold. It is rarely a zero-day. It is a valid login, bought or phished or pulled from a breach dump from an unrelated consumer site three years ago, walked straight through the front door of a corporate system where the same password was in use.
Long story short: attackers do not have to break in any more, they just “log in” with stolen credentials and tokens.
This is precisely why reuse is the vulnerability that compounds. One breach anywhere becomes a breach everywhere that password is in play.
Password Best Practices that Actually Work
Give people a password manager by default. This is the single highest-return change available to most organizations, and it is routinely under-deployed. A manager collapses “remember 100 secrets” into “remember one good one.” That one good one is Lock and Keys’ story: a long passphrase, song or story, memorable to you only, meaningless to everyone else. Roll it out with licenses for personal and family use too. Home and work security are not separate systems when they share a person and a device.
Turn on MFA and then upgrade it. Not all MFA is equal. SMS one-time pins are better than nothing and weaker than most people assume, given SIM-swap fraud. Push notifications invite MFA fatigue, where an attacker simply spams prompts at 2am until someone taps “approve” to make it stop. Where you can, move to phishing-resistant factors: passkeys, FIDO2 security keys, authenticator apps with number matching. Prioritise your highest-value accounts first, admins, finance, executives.
Start replacing passwords with passkeys. A passkey cannot be phished, cannot be reused across sites and cannot be leaked in a breach dump in a form that is useful to anyone. You will not migrate everything this year. Pick two or three systems and start.
Make it Safe to Admit
If someone realizes they have reused a password on a system that has just been breached, you need them to tell you in the next 10 minutes, not to sit quietly hoping nobody notices. Blame-based security guarantees silence. Silence is how a contained incident becomes a disclosed one.
So when you run your Week Three activities for Cybersecurity Awareness Month, be careful about the framing. “Stop being careless with your passwords” gets you compliance theatre. “We know this is genuinely hard, here is a tool that makes it easy, and tell us the moment something looks wrong” gets you actual security.
Your Week Three Mission
Audit how many of your critical systems still sit outside SSO
Check whether your policy still mandates calendar-based rotation
Deploy or re-launch a password manager, with personal-use licences included
Move your privileged accounts to phishing-resistant MFA
Pick one system to pilot passkeys before year-end
Tell your people, in writing, that reporting a suspected credential compromise will never get them into trouble
None of this is about asking people to try harder. With the right tooling the secure choice stops being an act of willpower and becomes the path of least resistance.
That is the real mission this week: not better passwords, but fewer of them for humans to carry.(function(d, s, id) {
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) return;
js = d.createElement(s); js.id = id;
js.src = “//connect.facebook.net/en_US/sdk.js#xfbml=1&version=v3.0”;
fjs.parentNode.insertBefore(js, fjs);
}(document, ‘script’, ‘facebook-jssdk’));
——————————————————-
Click Here For The Original Source.
