Topic starter
21/08/2026 4:46 pm
TL;DR: Weak, default, and stolen passwords still underpin most successful breaches, and SMBs are especially exposed because poor password hygiene, shared credentials, and limited visibility turn basic identity controls into a high-impact attack surface, according to Devolutions. Password management is no longer an IT housekeeping task; it is a board-level risk control for human IAM and privileged access.
Editorial analysis by NHI Mgmt Group, based on content published by Devolutions: “White papers”.
By the numbers:
- Nearly two-thirds, or 63%, of successful confirmed data breaches involved leveraging weak, default or stolen passwords.
- 61% of SMBs polled reported a cyberattack, up from 55% a year earlier.
- 54% reported a data breach, with employee negligence cited as the top root cause.
Key questions
Q: What breaks when SMBs keep allowing weak or shared passwords?
A: The authentication layer stops acting like a control and becomes an assumption.
Q: Why do weak passwords and poor enforcement increase breach risk for SMBs?
A: Weak passwords create a low-friction path for attackers to reuse credentials, brute force accounts, or move through multiple systems after one compromise.
Q: How can security teams tell whether password management is actually improving?
A: Look for fewer avoidable resets, stronger SSO coverage, and better compliance among the riskiest user groups.
Practitioner guidance
- Implement password visibility controls Track password reuse, weak choices and sharing patterns across employee accounts, third parties and managed devices without exposing the underlying secret.
- Eliminate default device credentials Inventory IoT and other connected devices, then replace factory-set passwords before they become easy footholds for internal or external attackers.
- Apply privileged password governance Tie privileged account credentials to policy, audit and vaulting rules so administrators can see compliance trends without handling the passwords themselves.
Bottom line: SMBs are exposed because weak, default, shared and stolen passwords still provide a low-friction path into systems and devices.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:06 pm
Weak password hygiene is still a governance failure, not a user quirk. The article makes the familiar but still under-acted-on point that SMBs continue to treat password problems as behaviour rather than control design. When reuse, sharing and defaults remain tolerated, the organisation has not implemented credential governance, it has accepted credential risk as normal. The practitioner conclusion is that password management has to be run as a governed identity control.
A question worth separating out:
Q: Should SMBs prioritise password hygiene or broader zero trust controls first?
A: Password hygiene comes first when weak credentials are still widespread, because zero trust assumptions collapse if the initial login is easy to abuse. Strong authentication, credential vaulting and reuse control reduce immediate entry risk and give broader zero trust controls something dependable to verify. Without that foundation, higher-level architecture inherits the same weak identity inputs.
👉 Read our full editorial: SMB password management gaps still drive most breach paths