Enterprise password management is not enough against common attacks

At a glance

What this is: This is an analysis of why enterprise password management reduces some risk but does not neutralise the most common password attack paths.

Why it matters: It matters because IAM teams still have to govern human authentication, browser-based session exposure, and adjacent controls such as MFA, device posture, and access recovery.

By the numbers:

• Have I Been Pwned tracks over 850 websites and some 14.2 billion accounts that have been compromised.

👉 Read Island's analysis of enterprise password management attacks

Context

Enterprise password management is about more than generating stronger passwords. The real governance gap is that passwords can still be stolen, reused, phished, intercepted, or bypassed through session theft even when users follow policy.

For IAM practitioners, the problem spans human authentication, browser security, and device posture. A password manager improves hygiene, but it does not by itself address credential disclosure, SMS-based MFA weakness, or cookie-based session hijacking.

That is why password controls have to be treated as part of a broader identity and access stack rather than a standalone protection layer. The article's starting point is common in enterprise environments, where legacy systems and third-party services keep password risk alive.

Key questions

Q: How should security teams reduce password reset risk in large enterprises?

A: Security teams should make password recovery a governed identity workflow, not a help desk exception. That means verified self-service, MFA-based proofing, central logging, and clear ownership for every reset path. The goal is to preserve identity assurance while reducing lockouts, workarounds, and social-engineering exposure.

Q: Why do enterprise password managers still leave security gaps?

A: Because many tools secure the vault but not the behaviour around the credential. Once a password is autofilled, shared, copied, or used outside managed devices, the enterprise loses visibility unless the platform enforces controls during the session itself.

Q: What breaks when users reuse passwords across multiple services?

A: One exposed credential can become many compromised accounts. Attackers test stolen email and password pairs across unrelated applications, so a single breach can expand into a much larger identity incident unless reuse is blocked and exposure is monitored.

Q: How can organisations tell whether their MFA programme is actually strong enough?

A: Look for coverage gaps, exception paths, and methods that can be reset, replayed, or coerced through user interaction. A strong programme has consistent enforcement, phishing-resistant options for high-risk access, and monitoring for fallback methods that quietly weaken assurance. If users can get to sensitive systems through a weaker route, the programme is not truly resistant.

Technical breakdown

Why password complexity alone does not stop credential attacks

Password complexity raises the cost of brute force, but it does not defend against reuse, phishing, malware, or breached databases. Once a password is exposed in one place, attackers commonly test it across unrelated services through credential stuffing. Even a strong password becomes useless if the attacker captures it directly from the user or from the session itself. In practice, the weakness is not only the password value. It is the full authentication path, including the browser, the device, and the surrounding login flow.

Practical implication: treat password complexity as a baseline control, not as a complete defence against account compromise.

How session hijacking bypasses password strength

Session hijacking attacks target authenticated state instead of the password itself. Cookies, cache, and browser memory can be copied or manipulated so the attacker inherits an existing session without needing to know the password. That means the control failure occurs after login, when the browser becomes the trust boundary. For enterprise environments, this shifts attention from password policy alone to browser hardening, memory protection, and device posture enforcement. It also explains why a password manager cannot fully protect the access path if the browser layer is weak.

Practical implication: protect authenticated sessions with browser and endpoint controls, not just credential policy.

Why MFA is only as strong as its weakest factor

MFA reduces risk, but not all factors are equal. SMS codes are vulnerable to SIM swapping, social engineering, and real-time phishing, which means the attacker can satisfy the second factor without breaking the password. Phishing-resistant methods such as FIDO2 and WebAuthn change the trust model because they bind the authentication challenge to the legitimate site and device context. The key point is that MFA is not a single outcome. Its effectiveness depends on whether the factor can be replayed, intercepted, or socially engineered.

Practical implication: prioritise phishing-resistant MFA for high-risk users and applications instead of relying on SMS codes.

Threat narrative

Attacker objective: The attacker wants authenticated access to enterprise systems and the ability to reuse that access across applications without further user interaction.

1. Entry begins with password harvesting through phishing, browser interception, malware, or credential reuse from a breached site.
2. Escalation occurs when the attacker uses the captured password, hijacked MFA step, or stolen session cookie to authenticate as the user.
3. Impact follows when the attacker accesses enterprise applications, exfiltrates data, or persists through reused credentials and additional compromised sessions.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Enterprise password management is a hygiene control, not an identity boundary. The article is right to show that stronger password creation helps, but the attack surface begins where the password is used, not where it is stored. Browser compromise, session theft, and phishing-resistant authentication are the real boundary conditions. The practitioner conclusion is that password managers reduce friction, while identity governance still has to secure the full authentication path.

Session hijack is the control failure that most password programmes underweight. Once cookies or cached credentials are stolen, password complexity and uniqueness no longer matter. That is a governance problem because many programmes still measure success by password strength instead of session resilience. The implication is that browser state now belongs in identity risk management, not only in endpoint security.

Phishing-resistant MFA changes the trust model, not just the login experience. SMS-based MFA can be intercepted or socially engineered, which means it does not fully close the gap it is meant to cover. FIDO2 and WebAuthn matter because they reduce replay and reduce attacker reuse of stolen factors. Practitioners should treat MFA selection as a policy decision tied to risk, not as a generic compliance checkbox.

Credential reuse and password breach exposure create an identity blast radius that IAM teams still underestimate. The same password used across services turns one compromise into a multi-system event. That is why the most useful concept here is identity blast radius: how far one compromised credential can spread before controls stop it. The practitioner takeaway is to govern reuse, exposure, and session persistence together rather than as separate problems.

Enterprise browser controls are now part of password governance. If the browser can leak cookies, keystrokes, or local password stores, then the identity system is only as strong as the client path. That shifts the control conversation from isolated password policy to the broader access surface. The practical conclusion is that IAM teams need a joined-up view of authentication, browser posture, and endpoint trust.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• From our research: 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• From our research: Review NHI Lifecycle Management Guide for the provisioning, rotation, and offboarding controls that reduce unmanaged access exposure.

What this signals

Password governance is moving from a narrow credential problem to a broader access-path problem, especially where browser state and session continuity become the real targets. Teams that still measure success by password policy alone are missing the control surface that attackers actually exploit.

Identity blast radius: the practical question is how far one compromised credential can move before policy, MFA, or browser controls stop it. That framing applies equally to human identities and to adjacent non-human access paths that depend on reused secrets or persistent sessions.

The next programme priority is to align authentication, device posture, and session protection under one access model. For practitioners building mature identity controls, the useful reference point is the Top 10 NHI Issues, which shows how unmanaged access problems compound when governance is fragmented.

For practitioners

• Harden authentication beyond password policy Replace SMS-based MFA with phishing-resistant methods such as FIDO2 or WebAuthn for users and applications that justify stronger assurance.
• Reduce credential reuse across services Enforce unique passwords for all applications, including legacy and third-party systems that sit outside the identity provider's native scope.
• Treat browser state as an identity control point Protect cookies, cache, and local password storage with browser and device controls that limit session hijack and token theft.
• Monitor for password exposure and reuse risk Track breached credentials, failed login spikes, and repeated authentication attempts that indicate credential stuffing across multiple services.

Key takeaways

• Passwords remain exploitable through reuse, phishing, malware, and session theft even when users follow policy.
• The biggest control gap is not password creation, but the browser and session layer where attackers bypass the password entirely.
• IAM teams should pair stronger authentication with phishing-resistant MFA and browser-aware access controls.

Key terms

• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Credential Reuse: Credential reuse happens when the same password, token, or secret can unlock multiple systems or sessions. It increases breach impact because one stolen credential can become a wide-ranging access path. The control problem is not only theft, but the amount of trust packed into each reusable secret.

What's in the full article

Island's full article covers the operational detail this post intentionally leaves for the source:

• Side-by-side attack mapping for password complexity, reuse, phishing, MitM, MitB, and session hijack scenarios.
• Browser and device protection recommendations for cookie handling, keystroke capture, and local password storage.
• Practical guidance on stronger MFA choices, including when WebAuthn and FIDO2 reduce replay risk better than SMS codes.
• Specific enterprise browser controls that help limit web-based and physically local attacks.

👉 Island's full post covers the attack paths, browser protections, and MFA trade-offs in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.