Password security still fails without stronger identity controls

At a glance

What this is: GlobalSign’s analysis argues that password hygiene, hashing, salting and MFA are complementary controls, but weak and reused passwords still create a broad compromise path.

Why it matters: For IAM, PAM and NHI practitioners, the key lesson is that password governance is only one layer in account security, so identity programmes need stronger baseline controls and user behaviour safeguards.

By the numbers:

• The password 123456 remains the most common password and can be cracked in less than a second, according to GlobalSign.
• The 13% of users who reuse the same password for all accounts create a direct path from one compromised login to others, according to GlobalSign.
• The 52% of users who reuse a password for some accounts widen the blast radius of a single credential exposure, according to GlobalSign.

Context

Passwords remain a human identity control, but they fail when organisations treat them as the whole security model. The article’s core point is that password hygiene, storage protections and multifactor authentication only work when they are combined into a layered identity programme.

The practical gap is not whether passwords exist, but whether they are protected against reuse, disclosure and guessing. For identity teams, that means the issue sits at the intersection of human IAM, authentication policy and account recovery design, not at the password field alone.

The article also makes clear that user education is part of the control surface. If employees are trained to type passwords into unsafe channels or recycle them across accounts, even strong hashing and salting leave exposure elsewhere in the identity lifecycle.

Key questions

Q: What should organisations do when they discover a password has been reused across accounts?

A: Organisations should require immediate password change on the most sensitive accounts, then guide users through the less obvious ones they may have forgotten. The goal is to contain exposure before attackers can test the same credential elsewhere. A password manager helps because it creates unique credentials and reduces the chance that an old breach becomes repeated compromise.

Q: Why do strong passwords still fail against phishing and credential stuffing?

A: Strong passwords fail because the attacker does not always need to guess them. Phishing captures the secret directly, and credential stuffing uses a password already exposed elsewhere. If the same credential is accepted on multiple services, one compromise becomes many. MFA and uniqueness are the controls that break that chain.

Q: How do security teams know if password lifecycle control is actually working?

A: Look for centralized logging, repeatable reset orchestration, consistent policy enforcement across systems, and the ability to execute and verify recovery without manual cross-platform coordination. If the team cannot prove who changed what, where, and when, the lifecycle control is still fragmented.

Q: Should hashed passwords still be protected as sensitive data?

A: Yes. Hashing reduces exposure but does not make password databases harmless, because attackers can still brute-force weak values or use salts and hashes in offline cracking attempts. Treat hashed password stores as security-sensitive assets, and protect them with strong access control, monitoring and backup discipline. The control goal is risk reduction, not risk elimination.

Technical breakdown

Password hygiene and credential reuse

Password hygiene is the operational discipline of making passwords difficult to guess, hard to reuse and unlikely to be exposed in transit or storage. The article stresses three common failure modes: trivial passwords, reuse across accounts and unsafe sharing. These are not separate problems. They combine into a single compromise pattern where one weak credential becomes a foothold across multiple services. In practice, the issue is less about password complexity rules than about account-specific uniqueness, storage protection and user behaviour under pressure.

Practical implication: enforce unique credentials per account and remove any policy exception that allows reuse across systems.

Hashing and salting as storage controls

Hashing converts a password into a fixed-length value so the original secret is not stored in plaintext, while salting adds a random value before hashing so identical passwords do not produce identical hashes. Together, these controls reduce the value of stolen password databases and make precomputed attacks far less effective. They do not stop phishing or credential reuse, but they change the economics of offline cracking and limit how much damage a database leak can do.

Practical implication: verify that stored passwords are salted and hashed correctly, then treat any plaintext or unsalted storage as a material control failure.

Multifactor authentication as the compensating control

MFA adds an additional factor beyond the password, which means an attacker needs more than a guessed or stolen secret to complete authentication. The article cites Microsoft’s estimate that MFA can block 99.9% of account compromise attacks, which shows why password strength alone is not sufficient. The architectural point is important: passwords answer who knows the secret, while MFA asks whether the login attempt is backed by another trusted proof. That extra proof is what turns a compromised password from a full compromise into a contained event.

Practical implication: require MFA for all high-value accounts and treat password-only access as an exception that must be justified.

Threat narrative

Attacker objective: The attacker aims to turn one weak or stolen password into access to additional accounts, data or systems.

1. Entry begins with weak or reused passwords that can be guessed, cracked or obtained through phishing.
2. Credential harvesting occurs when attackers collect password data from phishing, reuse patterns or breached services and try it elsewhere.
3. Impact follows when a single exposed password is reused across accounts or accepted without MFA, allowing broader account compromise.

NHI Mgmt Group analysis

Password policy is not an identity security model: The article shows that password rules, while necessary, do not close the main compromise paths on their own. Reuse, phishing and unsafe storage can all defeat a well-written policy if the programme stops at complexity requirements. The practitioner conclusion is that password governance must be treated as one layer inside a broader identity control stack.

Hashing and salting reduce storage risk, but they do not solve authentication risk: These controls matter because they limit the damage from database exposure and slow offline cracking. They do not stop attackers who obtain secrets through phishing, reuse or user error. The implication is that storage hardening and authentication hardening are separate governance problems, not substitutes for each other.

MFA is the decisive baseline control for human accounts: The article’s own evidence points to MFA as the control that materially shifts compromise economics. A password may be guessed, reused or exposed, but MFA changes whether that credential can actually be converted into account access. Practitioners should treat password-only access as an exception state, not a normal operating model.

Identity resilience depends on user behaviour as much as control design: The article correctly places education alongside technical controls because unsafe password sharing and reuse are human failure modes, not just configuration errors. That means awareness, policy enforcement and login telemetry must be aligned. The practitioner conclusion is that account security fails when organisations design controls for ideal behaviour instead of observed behaviour.

Credential reuse creates identity blast radius: When one password unlocks multiple accounts, the compromise domain expands from a single service to an entire user footprint. That is why the most important governance question is not how strong one password is, but how far one leaked secret can travel. Practitioners should measure and reduce blast radius, not just password complexity.

What this signals

Credential blast radius is the real governance problem: When passwords are reused, a single phishing event or breach can extend across multiple accounts without any change in attacker technique. Identity programmes should therefore measure how far one secret can travel, not just whether the secret meets complexity rules.

MFA changes the economics of account compromise: Password-only authentication assumes the secret can stand alone, but modern compromise patterns increasingly exploit reuse and disclosure. Requiring a second factor is the point where a stolen password stops being a complete identity failure and becomes only one layer of a blocked attack.

For practitioners

• Enforce unique passwords across all user accounts Block reused credentials at creation and reset, and pair the policy with checks against known breached-password lists so common secrets never enter the estate.
• Require MFA for all administrative and high-value accounts Make password-only access an exception path, especially for accounts that can access financial, customer or privileged systems.
• Verify salted hashing for password storage Confirm that stored passwords are salted before hashing and that no plaintext or unsalted legacy store remains in production or backup systems.
• Train users on safe password handling Teach staff not to share passwords over insecure channels, not to reuse them across services and not to enter them into untrusted sites or networks.
• Monitor for weak-password and reuse signals Use authentication telemetry to find accounts that repeatedly fail, authenticate from suspicious contexts or show patterns consistent with credential stuffing.

Key takeaways

• Weak passwords, reuse and phishing remain the most practical routes to account compromise, so password policy alone cannot be treated as a complete identity control.
• Hashing and salting matter because they limit the damage from password database exposure, but they do not stop credential theft or reuse-based attacks.
• MFA is the control that materially changes the outcome of password compromise, because it prevents many stolen or guessed passwords from becoming usable access.

Key terms

• Password Hygiene: Password hygiene is the practice of creating, storing and using passwords in ways that reduce compromise risk. It includes length, uniqueness, blocklisting common secrets and avoiding reuse across systems. In mature programmes, it is treated as a governance issue, not only a user-behaviour issue.
• Password Hash: A password hash is a one-way verifier created from a password and a salt so the original secret cannot be recovered from the stored output. In identity systems, the hash must be slow and parameterised so attackers cannot test guesses cheaply after a database leak.
• Password Salting: Password salting adds a unique random value to a password before it is hashed. This ensures that identical passwords do not produce identical hash values, which helps resist precomputed attacks and mass comparison. Salting is effective only when salts are truly random, unique, and stored correctly alongside the hash.
• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.