Topic starter
24/10/2026 8:54 pm
TL;DR: Password reuse and forgotten app access still give attackers easy wins in 2026, according to DNSFilter. Access reviews and separate-channel checks matter because hidden persistence paths can survive normal account oversight.
Editorial analysis by NHI Mgmt Group, based on content published by DNSFilter: “6 Security-Focused New Year’s Resolutions for 2026”.
Key questions
Q: Why do reused passwords create such a large identity risk?
A: Reused passwords turn one disclosure into many possible logins.
Q: What signs show that phishing resilience is weak?
A: Frequent clicks, credential reuse after training, and inconsistent escalation on suspicious requests all indicate that people are still making security decisions under stress without reliable guardrails.
Q: How should security teams reduce the risk of password reuse across systems?
A: Start by identifying where the same credential unlocks multiple applications, admin paths, or infrastructure resources.
Practitioner guidance
- Implement password manager adoption for high-value accounts Make unique passwords mandatory for email, banking and work accounts, and remove any policy that treats memorised credentials as acceptable for important services.
- Review and revoke stale app permissions Run a quarterly consent review for mailbox, file and platform integrations, then remove any app that is no longer recognised, needed or trusted.
- Require out-of-band verification for urgent requests Set a rule that any request involving money, credentials or access changes must be confirmed through a separate channel before action is taken.
Bottom line: The article’s central point is that attackers still win through weak trust patterns such as password reuse, forgotten app access and rushed responses to urgent messages.
Glossary terms: Password reuse, Delegated Access, Out-Of-Band Verification, Identity Reconnaissance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Standing trust, not technical sophistication, is the real failure mode here. The article correctly points to reused passwords, stale app permissions and reflexive responses to urgent messages because these are all forms of ungoverned standing access. The identity lesson is that attackers prefer permissions that already exist and do not need to be earned in real time. That makes lifecycle discipline more important than one-off awareness campaigns. Practitioners should treat stale trust as an access-control problem, not a user-training problem.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How do organisations limit the damage from oversharing and social engineering?
A: Treat personal data as an attack input, not just a privacy concern. Limit what employees publish, reduce account recovery exposure, and train staff to verify unfamiliar requests through trusted channels before they share information or change access. The goal is to narrow the amount of evidence an attacker can use to build a convincing pretext.
👉 Read our full editorial: Six security habits that reduce easy wins for attackers in 2026
This post was modified 6 days ago by NHI Mgmt Group