Topic starter
10/07/2026 9:20 pm
TL;DR: Password reuse, weak password selection and phishing remain the main paths to account compromise, and GlobalSign cites NordPass data showing 123456 is still common while Microsoft estimates MFA can block 99.9% of account compromise attacks. The real lesson is that password policy alone is not a security model; identity programmes need layered controls, user education and MFA as baseline governance.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Estrategias para mejorar la seguridad de las contraseñas”.
By the numbers:
- The password 123456 remains the most common password and can be cracked in less than a second, according to GlobalSign.
- The 13% of users who reuse the same password for all accounts create a direct path from one compromised login to others, according to GlobalSign.
- The 52% of users who reuse a password for some accounts widen the blast radius of a single credential exposure, according to GlobalSign.
Key questions
Q: What should organisations do when they discover a password has been reused across accounts?
A: Organisations should require immediate password change on the most sensitive accounts, then guide users through the less obvious ones they may have forgotten.
Q: Why do strong passwords still fail against phishing and credential stuffing?
A: Strong passwords fail because the attacker does not always need to guess them.
Q: How do security teams know if password lifecycle control is actually working?
A: Look for centralized logging, repeatable reset orchestration, consistent policy enforcement across systems, and the ability to execute and verify recovery without manual cross-platform coordination.
Practitioner guidance
- Enforce unique passwords across all user accounts Block reused credentials at creation and reset, and pair the policy with checks against known breached-password lists so common secrets never enter the estate.
- Require MFA for all administrative and high-value accounts Make password-only access an exception path, especially for accounts that can access financial, customer or privileged systems.
- Verify salted hashing for password storage Confirm that stored passwords are salted before hashing and that no plaintext or unsalted legacy store remains in production or backup systems.
Bottom line: Weak passwords, reuse and phishing remain the most practical routes to account compromise, so password policy alone cannot be treated as a complete identity control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
Password policy is not an identity security model: The article shows that password rules, while necessary, do not close the main compromise paths on their own. Reuse, phishing and unsafe storage can all defeat a well-written policy if the programme stops at complexity requirements. The practitioner conclusion is that password governance must be treated as one layer inside a broader identity control stack.
A question worth separating out:
Q: Should hashed passwords still be protected as sensitive data?
A: Yes. Hashing reduces exposure but does not make password databases harmless, because attackers can still brute-force weak values or use salts and hashes in offline cracking attempts. Treat hashed password stores as security-sensitive assets, and protect them with strong access control, monitoring and backup discipline. The control goal is risk reduction, not risk elimination.
👉 Read our full editorial: Password security still fails without stronger identity controls