Notifications
Clear all
Topic starter
02/08/2026 12:03 pm
TL;DR: Passwords still fail through brute force, reuse, phishing, malware, session hijacking, and weak MFA, even when enterprises use a password manager, according to Island. The core issue is that password hygiene alone does not control the browser, device, and session-layer attack paths that attackers actually exploit.
NHIMG editorial — based on content published by Island: Enterprise password management: Avoiding common attacks
By the numbers:
- Have I Been Pwned tracks over 850 websites and some 14.2 billion accounts that have been compromised.
Questions worth separating out
Q: How should security teams reduce password reset risk in large enterprises?
A: Security teams should make password recovery a governed identity workflow, not a help desk exception.
Q: Why do enterprise password managers still leave security gaps?
A: Because many tools secure the vault but not the behaviour around the credential.
Q: What breaks when users reuse passwords across multiple services?
A: One exposed credential can become many compromised accounts.
Practitioner guidance
- Harden authentication beyond password policy Replace SMS-based MFA with phishing-resistant methods such as FIDO2 or WebAuthn for users and applications that justify stronger assurance.
- Reduce credential reuse across services Enforce unique passwords for all applications, including legacy and third-party systems that sit outside the identity provider's native scope.
- Treat browser state as an identity control point Protect cookies, cache, and local password storage with browser and device controls that limit session hijack and token theft.
What's in the full article
Island's full article covers the operational detail this post intentionally leaves for the source:
- Side-by-side attack mapping for password complexity, reuse, phishing, MitM, MitB, and session hijack scenarios.
- Browser and device protection recommendations for cookie handling, keystroke capture, and local password storage.
- Practical guidance on stronger MFA choices, including when WebAuthn and FIDO2 reduce replay risk better than SMS codes.
- Specific enterprise browser controls that help limit web-based and physically local attacks.
👉 Read Island's analysis of enterprise password management attacks →
Password manager controls: where enterprise teams still get exposed?
Explore further
02/08/2026 1:08 pm
Enterprise password management is a hygiene control, not an identity boundary. The article is right to show that stronger password creation helps, but the attack surface begins where the password is used, not where it is stored. Browser compromise, session theft, and phishing-resistant authentication are the real boundary conditions. The practitioner conclusion is that password managers reduce friction, while identity governance still has to secure the full authentication path.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: How can organisations tell whether their MFA programme is actually strong enough?
A: Look for coverage gaps, exception paths, and methods that can be reset, replayed, or coerced through user interaction. A strong programme has consistent enforcement, phishing-resistant options for high-risk access, and monitoring for fallback methods that quietly weaken assurance. If users can get to sensitive systems through a weaker route, the programme is not truly resistant.
👉 Read our full editorial: Enterprise password management is not enough against common attacks
