Password policy still matters: what security teams should enforce

At a glance

What this is: This is an e-book on password policy, arguing that passwords remain necessary and that organisations should reduce risk with MFA, password managers, and stronger user guidance.

Why it matters: It matters because human identity controls still shape account compromise risk, and IAM teams need policies that are usable, enforceable, and resistant to common password attacks.

👉 Read KnowBe4's e-book on what your password policy should be

Context

Password policy is the governance layer that decides how people create, store, and use credentials. Even in environments moving toward passwordless access, most organisations still rely on passwords somewhere in the authentication chain, which means weak policy remains a live IAM risk.

The article’s central point is practical rather than theoretical: password attacks are still common, so the control question is how to reduce exposure through stronger requirements, MFA, and password managers without creating policies that users work around. That is a human identity problem first, but it also affects broader access governance and incident prevention.

Key questions

Q: How should security teams build password policy that resists real attacks?

A: Security teams should prioritise password length, breach-list screening, and slow hashing over composition rules and forced rotation. The goal is to make stolen credentials expensive to crack and useless to reuse. Pair that with MFA and session revocation so a compromised password does not become a durable account takeover path.

Q: Why do password policies still matter in organisations using MFA?

A: Passwords still matter because MFA reduces but does not eliminate credential compromise risk. Weak or reused passwords can still be phished, sprayed, stolen from adjacent systems, or used in recovery flows. A strong password policy remains useful because it limits how easily an attacker can start or sustain an account takeover attempt.

Q: What do security teams get wrong about password complexity?

A: They often treat complexity as a proxy for security. A password can be long and varied while still being exposed in public breach data or predictable enough to crack quickly. Effective policy must block known bad passwords, not just enforce character rules.

Q: When should organisations prioritise password managers over stricter password rules?

A: When stricter rules are pushing users toward reuse, resets, or insecure storage, password managers should come first. They let organisations improve password uniqueness without turning authentication into a memory test. That makes the control more sustainable and usually more effective than simply adding more complexity requirements.

Technical breakdown

Password attack patterns that policy has to absorb

Password policy only works when it is designed around real attack methods. Those include credential stuffing, brute force, password spraying, phishing, and reuse across systems. A policy that focuses only on minimum length without addressing reuse, weak reset practices, or recovery flow leaves the control surface open. The practical issue is not whether passwords are outdated, but whether the surrounding identity controls make them resilient enough to remain usable.

Practical implication: align password rules to the actual attack methods your environment sees, not to a generic complexity checklist.

Why MFA and password managers change the risk model

MFA reduces the value of a stolen password by adding a second verification factor, while password managers reduce weak reuse by generating unique credentials. Together, they shift the password problem from memorisation and reuse to authentication assurance and secure storage. That does not eliminate password risk, but it changes the attacker’s economics and makes policy more enforceable at scale.

Practical implication: pair password policy with MFA and approved password managers instead of treating password rules as a standalone control.

NHI Mgmt Group analysis

Password policy is still a live human identity control, not a legacy formality. Organisations often treat passwords as a solved problem because stronger methods exist, but the article shows that password policy remains relevant wherever passwords still gate access. The governance mistake is assuming migration pressure has removed the need for disciplined credential policy. It has not, and practitioners still need to manage password risk as part of identity control design.

The most effective password policy is one that reduces user workarounds. Users bypass rules when policies are too rigid, confusing, or disconnected from real workflows. Password managers and MFA do more than add protection; they make secure behaviour easier to sustain. That matters because a policy that cannot be followed consistently will be informally ignored.

Credential security should be measured as an access outcome, not a documentation exercise. It is not enough to publish rules for length, reuse, and resets. Security teams need to know whether policy is actually reducing account takeover risk, lowering password reuse, and improving adoption of stronger authentication methods. If those signals do not improve, the policy is administrative noise.

Password-policy friction is a governance risk when it pushes users toward unsafe workarounds. Long-lived human credentials fail not only because they can be guessed or stolen, but because the organisation asks people to remember too much and rotate too often without support. The result is predictable shadow behaviour, from reused passwords to insecure storage, and that is an IAM failure mode practitioners must design around.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to the 2024 ESG Report: Managing Non-Human Identities.
• That includes 46% confirmed breaches and 26% suspected breaches, which shows how often identity governance gaps are discovered only after exposure.
• For related guidance, see Guide to the Secret Sprawl Challenge for the credential-management problems that often sit beside weak human password policy.

What this signals

Human password policy remains relevant because authentication behaviour is still one of the most visible indicators of identity maturity. Organisations that pair password rules with MFA and managers tend to reduce avoidable compromise paths faster than those that simply tighten length and rotation requirements.

Password-policy friction: when the policy makes secure behaviour harder than unsafe behaviour, users will choose the unsafe path. The programme signal to watch is not just compliance with a written rule set, but whether help desk reset volume, reused credentials, and MFA enrolment are trending in the right direction.

For practitioners

• Align password rules to observed attack paths Review whether your password policy addresses credential stuffing, spraying, reuse, and reset abuse. Tighten the controls that map to the highest-risk attack paths in your environment instead of relying on complexity alone.
• Deploy MFA where passwords still matter Require MFA for accounts that remain password-based, especially privileged users, remote access, and any application that cannot yet move to stronger authentication. Use phishing-resistant options where practical.
• Standardise approved password managers Make password managers part of the control set so users can generate unique credentials without memorising them. Pair this with guidance that prevents browser-saved or shared passwords from becoming the default workaround.
• Measure whether policy is changing behaviour Track password reuse, reset volume, MFA adoption, and help desk tickets tied to credential problems. If the metrics do not improve after policy changes, the policy is failing in practice.

Key takeaways

• Password policy still matters because passwords remain a live access control wherever they are still in use.
• MFA and password managers make password policy more enforceable by reducing reuse, friction, and attacker value.
• The right measure of success is behaviour change, not whether the policy document looks strict.

Key terms

• Password Policy Enforcement: The set of controls that makes password rules apply consistently across systems, accounts, and users. It covers length, reuse, lockout, expiry, and exception handling so credential quality does not depend on local admin preference or uneven platform behaviour.
• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.
• Password Manager: A password manager is a system that creates, stores, and fills credentials so users do not need to remember or reuse them. In governance terms, it reduces secret sprawl, supports unique passwords per account, and creates a more auditable path for sharing and revocation.

What's in the full article

KnowBe4's full e-book covers the operational detail this post intentionally leaves for the source:

• Practical password policy recommendations for employee accounts and shared user environments
• The pros and cons of password managers and multi-factor authentication in day-to-day use
• Common password attack methods and the controls that reduce exposure
• User-facing guidance for making end users the last line of defence

👉 KnowBe4's full e-book expands on password attacks, MFA trade-offs, and user guidance for stronger policy design.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.