Because policy does not change human behaviour under pressure. Users still reuse secrets, choose weak variations, store them in tools, or hand them to phishing kits, which means the same credential can be captured and replayed. The risk persists until the access model stops depending on user-managed knowledge secrets.
Why password policy does not remove the underlying breach path
Password policy can improve minimum length, complexity, and basic reuse controls, but it cannot reliably stop the behaviours that create compromise. People still choose memorable variants, reuse credentials across systems, save them in browsers or notes, or enter them into convincing phishing pages. That is why the risk survives even when the written policy looks strong.
A password is only as safe as the full path from creation to use. If the same secret can be captured once and replayed elsewhere, the organisation is still exposed to credential theft, credential stuffing, and account takeover. Password Security and Password Manager Guide is useful here because the core problem is not policy wording, but whether the access model still depends on a user-managed knowledge secret.
Where the failure actually happens in practice
Passwords fail in predictable places: users reuse them across services, attackers harvest them through phishing, and infostealers collect them from endpoints or browsers. Even good policy does not prevent a secret from being disclosed, copied, or entered into the wrong place. Once that happens, the attacker does not need to “break” the password, only to use it before the defender notices.
The breach path also persists because policy is usually weaker than the surrounding ecosystem. Help desks reset passwords, legacy applications still rely on them, and shared or service-linked access can spread the same weakness across multiple systems. The State of NHI & AI Agent Breach Report 2026 shows the broader pattern: once credentials become portable, an initial capture can turn into lateral movement and repeated abuse.
What removes the risk, and what only reduces it
Strong policy is a mitigation, not a fix. It reduces weak choices at the margin, but it does not eliminate phishing, reuse under pressure, password sharing, or secret exposure in tools and endpoints. The real reduction happens when the organisation stops treating human memory as the primary control and moves to phishing-resistant authentication, managed credentials, and tighter control over where secrets can be stored and replayed.
That is why password managers help, but they are still a bridge, not an end state. They improve uniqueness and reduce reuse, yet they still depend on vault security, endpoint hygiene, and user discipline. Organisations that want to cut breach risk need to pair password controls with stronger authentication, better credential lifecycle handling, and reduced standing reliance on knowledge secrets. LastPass breach 2022 is a reminder that once a secret vault or its keys are exposed, the downstream blast radius can be far larger than the original password policy assumed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Passwords and phishing-resistant auth are central to the breach path here. |
| Recommendation — Adopt phishing-resistant authenticators for high-value access instead of relying on memorized secrets. | ||
| CIS Controls v8 | CIS-5 — Account Management | Password reuse, reset paths and lifecycle weaknesses drive account takeover risk. |
| Recommendation — Reduce account-takeover exposure by tightening account lifecycle and authentication controls. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential creation, protection, rotation and revocation are the core control concern. |
| IA-2 — Identification and Authentication (Organizational Users) | User login risk remains tied to how organizational users authenticate. | |
| Recommendation — Enforce authenticator lifecycle controls to limit reuse, exposure and replay. Require stronger user authentication where compromised passwords would matter. | ||
| OWASP ASVS | V6 — Authentication | The question concerns why password-based authentication remains breach-prone. |
| Recommendation — Strengthen authentication verification and password handling requirements. | ||
Practitioner Guidance
What to prioritise: Treat passwords as a residual access mechanism, not the control that should carry your highest-value access paths. Prioritise the systems where credential replay would create the largest blast radius, then reduce dependence on reusable secrets there first.
What to verify: Check whether policy enforcement is actually backed by controls that make captured passwords harder to use, such as phishing-resistant MFA, blocked reuse, monitored login anomalies, and rapid revocation. If a password can still authenticate to a critical system after a simple capture, the control set is incomplete.
Common mistake: Organisations often overestimate the value of complexity rules and underinvest in theft-resistant authentication. A hard-to-guess password is still a breach risk if it can be phished, reused, or extracted from an endpoint.
Practitioner takeaway: The question is not whether password policy exists, but whether any important access path still depends on a secret a human can remember, reuse, or be tricked into revealing.
Related resources from NHI Mgmt Group
- Why does vulnerability exploitation keep creating breach risk even when organisations know about the flaws?
- Why do access risks keep reappearing even when organisations have a risk plan?
- Why do parser discrepancies keep creating risk even after a vulnerability is patched?
- Why do reusable secrets keep creating risk even after rotation?