Notifications
Clear all
Topic starter
02/08/2026 12:08 pm
TL;DR: Passwords remain a necessary but risky credential layer, and KnowBe4’s e-book argues that policy quality depends on balancing attack resistance with usability, supported by MFA and password managers. The real governance challenge is that human credential policy is still a frontline control, not a legacy afterthought.
NHIMG editorial — based on content published by KnowBe4: What Your Password Policy Should Be
Questions worth separating out
Q: How should security teams build password policy that resists real attacks?
A: Security teams should prioritise password length, breach-list screening, and slow hashing over composition rules and forced rotation.
Q: Why do password policies still matter in organisations using MFA?
A: Passwords still matter because MFA reduces but does not eliminate credential compromise risk.
Q: What do security teams get wrong about password complexity?
A: They often treat complexity as a proxy for security.
Practitioner guidance
- Align password rules to observed attack paths Review whether your password policy addresses credential stuffing, spraying, reuse, and reset abuse.
- Deploy MFA where passwords still matter Require MFA for accounts that remain password-based, especially privileged users, remote access, and any application that cannot yet move to stronger authentication.
- Standardise approved password managers Make password managers part of the control set so users can generate unique credentials without memorising them.
What's in the full article
KnowBe4's full e-book covers the operational detail this post intentionally leaves for the source:
- Practical password policy recommendations for employee accounts and shared user environments
- The pros and cons of password managers and multi-factor authentication in day-to-day use
- Common password attack methods and the controls that reduce exposure
- User-facing guidance for making end users the last line of defence
👉 Read KnowBe4's e-book on what your password policy should be →
Password policy and MFA: are your controls keeping up?
Explore further
02/08/2026 1:12 pm
Password policy is still a live human identity control, not a legacy formality. Organisations often treat passwords as a solved problem because stronger methods exist, but the article shows that password policy remains relevant wherever passwords still gate access. The governance mistake is assuming migration pressure has removed the need for disciplined credential policy. It has not, and practitioners still need to manage password risk as part of identity control design.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to the 2024 ESG Report: Managing Non-Human Identities.
- That includes 46% confirmed breaches and 26% suspected breaches, which shows how often identity governance gaps are discovered only after exposure.
A question worth separating out:
Q: When should organisations prioritise password managers over stricter password rules?
A: When stricter rules are pushing users toward reuse, resets, or insecure storage, password managers should come first. They let organisations improve password uniqueness without turning authentication into a memory test. That makes the control more sustainable and usually more effective than simply adding more complexity requirements.
👉 Read our full editorial: Password policy still matters: what security teams should enforce
