Weak passwords and legacy systems: what IAM teams need to fix

TL;DR: A reported Louvre surveillance password of "LOUVRE," plus obsolete systems flagged in audits years earlier, shows how static credentials and legacy infrastructure can turn an access-control gap into an existential security failure, according to Ory. The case reinforces that IAM must move beyond passwords to MFA, passwordless access, and least privilege before compromise becomes routine.

NHIMG editorial — based on content published by Ory: Parlez-vous password? The Louvre's weak password and the IAM failure behind it

By the numbers:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

Questions worth separating out

Q: What breaks when organisations rely on shared passwords in air-gapped systems?

A: Shared passwords destroy accountability and create permanent access that survives role changes, device changes, and personnel departures.

Q: Why do weak passwords and legacy systems increase identity risk so sharply?

A: Weak passwords reduce the cost of initial access, while legacy systems often lack modern monitoring, patching, and authentication safeguards.

Q: How do security teams know whether least privilege is actually working?

A: Least privilege is working when identities have narrowly scoped permissions, unused credentials are removed or quarantined, and repeated access reviews consistently shrink entitlements.

Practitioner guidance

• Remove static passwords from high-value systems Replace reusable credentials on surveillance, admin, and infrastructure accounts with phishing-resistant authentication or passwordless methods, then confirm no shared secret remains as a fallback.
• Inventory every legacy identity dependency Identify systems still using outdated operating systems, unsupported authentication flows, or manual password handling, then classify them as remediation priorities before they touch sensitive assets.
• Apply least privilege to every privileged account Restrict each identity to the minimum task scope needed, and remove broad permissions from any account that can reach monitoring, security, or configuration functions.

What's in the full article

Ory's full blog post covers the operational detail this post intentionally leaves for the source:

• How the password failure illustrates modern IAM gaps across human and machine identities
• The role of MFA and passwordless authentication in removing reusable secret exposure
• Why least privilege changes the blast radius when a single identity is compromised
• How legacy systems create exceptions that identity governance must retire, not inherit

👉 Read Ory's analysis of the Louvre password failure and modern IAM gaps →

Weak passwords and legacy systems: what IAM teams need to fix?

Explore further

View Full Forum →  |  NHI Foundation Course →