Password complexity rules in 2026: what IAM teams should change

NHI Mgmt Group · 2026-06-25T01:59:01+00:00

TL;DR: Password complexity rules measure character variety, not real password strength, and they keep pushing users toward predictable patterns, helpdesk churn, and false compliance, according to Avatier. The stronger model is runtime enforcement with breach-corpus checks, long passphrases, and event-triggered rotation, because the old composition rule assumes attackers still behave like they did in 1995. Editorial analysis by NHI Mgmt Group, based on content published by Avatier: “Password Complexity vs Password Strength: What 2026 Got Right”. Key questions Q: What breaks when password complexity rules are the main control? A: They create the appearance of security while allowing predictable passwords, breached credentials, and trivial pattern changes to pass. Q: Why do forced password rotations often make security worse? A: Forced rotations often push users toward predictable year-based changes, reused patterns, and weaker memorisation habits. Q: How can security teams tell whether password management is actually improving? A: Look for fewer avoidable resets, stronger SSO coverage, and better compliance among the riskiest user groups. Practitioner guidance Implement runtime breach-corpus checks Reject candidate passwords that appear in public or commercial breach corpora at every creation point, including self-service reset, helpdesk reset, and API-driven provisioning. Audit every credential creation path Map user self-service, admin reset, HR-driven onboarding, application-local stores, and automated provisioning to confirm the same password policy is enforced everywhere. Replace calendar rotation with event-triggered rotation Trigger password changes on breach exposure, anomalous activity, privilege changes, and offboarding instead of rotating all accounts on a fixed schedule. Bottom line: Password complexity rules are a weak proxy for password security because they reward format compliance, not attacker resistance. Explore furtherView Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →

Topic starter 24/06/2026 8:43 pm

Composition rules are a compliance mechanism, not a strength mechanism. They tell an auditor that a password contains the right mix of characters, but they do not tell an attacker anything new. In practice, the control creates the appearance of discipline while leaving users free to generate predictable patterns that cracking tools already know how to test. The practitioner conclusion is simple: governance built on composition is not governance built on resistance.

A few things that frame the scale:

71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.

A question worth separating out:

Q: Which authentication flows should organisations prioritise for passwordless migration first?

A: Organisations should prioritise the highest-risk flows first, especially privileged access, cloud administration, remote access, and systems that face frequent phishing attempts. These are the places where password compromise has the greatest impact. A phased migration reduces operational friction while delivering the biggest reduction in takeover risk early in the programme.

👉 Read our full editorial: Password complexity rules are failing enterprise identity governance

Composition rules are a compliance artefact, not a strength model. They reward visible character variety while attackers target reused patterns, breached values, and predictable transforms. That disconnect is why enterprises can pass policy checks and still lose to credential stuffing. The practitioner conclusion is simple: if the control measures formatting, it is not measuring strength.

A question worth separating out:

Q: Should organisations keep password complexity rules or move to runtime enforcement?

A: Organisations should keep the policy outcome, not the old syntax test. Runtime enforcement is the better control because it can check breach exposure, length, predictability, and user-specific patterns at every creation point. Complexity rules alone are too weak for modern attack conditions.

👉 Read our full editorial: Password complexity rules are failing enterprise IAM in 2026

Password complexity rules in 2026: what IAM teams should change

Deepen Your Knowledge

Subscribe to the NHI & AI Identity Journal

Subscribe to the NHI & AI Identity Journal