Topic starter
24/06/2026 8:43 pm
TL;DR: Password composition rules still measure character variety, not resistance to cracking or credential stuffing, according to Avatier. Enterprise IAM needs runtime strength enforcement or it keeps producing predictable passwords and avoidable helpdesk burden.
Editorial analysis by NHI Mgmt Group, based on content published by Avatier: “Password Complexity vs Password Strength: What 2026 Got Right”.
Key questions
Q: Why do complexity rules create more risk than they remove?
A: They encourage users to create passwords that satisfy the rule visually but remain easy to predict, remember, and reuse.
Q: How should IAM teams decide when to rotate passwords?
A: Rotate passwords when risk changes, not when the calendar says so.
Q: What breaks when enterprise password policy still relies on complexity rules?
A: Complexity rules break when they are treated as a strength control.
Practitioner guidance
- Replace composition checks with runtime strength enforcement Require candidate passwords to pass entropy, breach-corpus, and contextual checks at every creation point, including helpdesk resets and API-driven provisioning.
- Inventory every credential creation path Map user self-service, administrative reset, HRIS onboarding, legacy application stores, and automation-driven provisioning to find paths that bypass the same password controls.
- Switch from calendar rotation to event-triggered rotation Trigger password changes on breach exposure, role changes, suspicious authentication activity, and offboarding instead of relying on 90-day schedules.
Bottom line: Composition rules do not measure whether a password can resist attack, only whether it satisfies formatting conditions.
Glossary terms: Credential firewall, Breach-corpus screening, Event-triggered rotation, Predictable Password Pattern
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago 2 times by NHI Mgmt Group
This topic was modified 21 hours ago by NHI Mgmt Group
25/06/2026 5:28 am
Composition rules are a compliance artefact, not a strength model. They reward visible character variety while attackers target reused patterns, breached values, and predictable transforms. That disconnect is why enterprises can pass policy checks and still lose to credential stuffing. The practitioner conclusion is simple: if the control measures formatting, it is not measuring strength.
A question worth separating out:
Q: Should organisations keep password complexity rules or move to runtime enforcement?
A: Organisations should keep the policy outcome, not the old syntax test. Runtime enforcement is the better control because it can check breach exposure, length, predictability, and user-specific patterns at every creation point. Complexity rules alone are too weak for modern attack conditions.
👉 Read our full editorial: Password complexity rules are failing enterprise IAM in 2026