Topic starter
09/07/2026 3:26 pm
TL;DR: Weak, reused, or stolen passwords remain a major breach driver, with Verizon’s 2025 DBIR cited by Bitwarden showing they account for 88% of breaches of basic web applications. The lesson is that policy, employee education, and password manager adoption still matter because credential hygiene only reduces risk when it is operationalised.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “How to foster employee password security”.
By the numbers:
- The Verizon 2025 report analyzed 22,000 security incidents, of which 12,195 were confirmed data breaches, according to Bitwarden.
- Healthcare recorded 1,542 data breaches out of 1,710 security incidents, according to Bitwarden.
- Finance recorded 927 data breaches out of 3,336 security incidents, according to Bitwarden.
Key questions
Q: How should IAM teams reduce password-related productivity loss?
A: They should start by measuring where password failures interrupt work most often, then redesign the highest-friction journeys first.
Q: Why do weak passwords keep causing breaches even when users are trained?
A: Training does not change the underlying constraint that people are asked to invent and remember complex secrets under cognitive load.
Q: What are the signs that password blocking controls are not working as intended?
A: Warning signs include weak passwords still being accepted, inconsistent enforcement between internal and customer-facing systems, exceptions without documented CISO approval, and a lack of audit evidence showing the control was tested.
Practitioner guidance
- Standardise password manager adoption Set password managers as the default credential generation and storage method for employees, then measure adoption by account population rather than by policy publication.
- Harden password creation rules Require unique, generated passwords for all corporate accounts and remove allowances that let users recycle known secrets across services.
- Pair training with observable checks Use security awareness content to reinforce reuse avoidance, exposed-password checks, and the routine review of vault health reports.
Bottom line: Weak and reused passwords remain a durable breach mechanism because attackers still benefit from poor human credential habits.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:45 pm
Password policy fails when it is treated as advice rather than enforced identity behaviour: weak and reused credentials continue to create predictable breach paths because policy language does not by itself change user practice. The article’s central finding is that password rules only matter when they are paired with controls that make strong behaviour easier to sustain. For IAM leaders, the point is not awareness alone but repeatable enforcement.
A question worth separating out:
Q: Should organisations prioritise password managers or more email hardening first?
A: If password reuse and weak credential habits are widespread, password managers should be treated as a priority because they make strong unique passwords practical. Email hardening still matters, but it cannot compensate for poor credential behaviour across the user base.
👉 Read our full editorial: Password policy and manager adoption still drive breach reduction