Should organisations prioritise password management before relying on user awareness campaigns alone?

Why This Matters for Security Teams

Password management is not just an IT hygiene issue. It is a control that reduces the blast radius of phishing, credential stuffing, password reuse, and exposed secrets across business systems. Awareness campaigns can improve behaviour, but they do not prevent weak choices or stop attackers once credentials are captured. NHI Management Group’s research on The State of Secrets in AppSec shows how quickly secrets-related failures become operational risk, and the NIST Cybersecurity Framework 2.0 treats identity and access protection as a core resilience function, not a training exercise.

For organisations, the real issue is that user awareness is variable, while password controls can be engineered into the system. Password managers, MFA, rotation where justified, and exposure monitoring create guardrails that scale across every user, device, and application. That matters most where employees handle SaaS, admin portals, and remote access tools that are routinely targeted through credential theft. In practice, many security teams discover the weakness only after reused passwords or exposed credentials have already been used to access a production account.

How It Works in Practice

The practical answer is to make secure credential handling the default and treat awareness as reinforcement. A password management programme should reduce human decision-making at the point of login by using approved password managers, strong unique passwords, and MFA for high-value systems. Where long-lived secrets exist, organisations should pair password controls with lifecycle management so credentials are issued, reviewed, and revoked deliberately rather than left to drift. NHI Management Group’s NHI Lifecycle Management Guide frames this as an operational discipline, not a one-time policy.

Current guidance suggests the most effective programmes combine three layers:

• Make unique password generation and storage easy through an approved password manager.
• Use MFA to reduce the value of a stolen password on its own.
• Monitor for leaked credentials, reuse, and privileged account exposure across SaaS, cloud, and admin tools.

This is especially important for Non-Human Identities as well. Service accounts, API keys, and automation tokens are often protected less consistently than human passwords, even though they can provide broader access. NHI Management Group’s Top 10 NHI Issues highlights how unmanaged secrets and weak lifecycle discipline create avoidable exposure. Awareness helps users recognise phishing and social engineering, but the control itself must be technical and enforceable. These controls tend to break down in environments with fragmented SaaS ownership and shared admin accounts because no single team can reliably enforce consistent password hygiene across the stack.

Common Variations and Edge Cases

Tighter password controls often increase onboarding and support overhead, requiring organisations to balance usability against the reduction in account takeover risk. That tradeoff becomes sharper in mixed environments where some systems support SSO and MFA while older applications still depend on local passwords or shared credentials.

There is also no universal standard for how aggressively passwords should be rotated in every environment. Best practice is evolving toward rotation only when there is evidence of compromise, a privilege change, or a policy requirement, rather than forcing frequent changes that encourage predictable user behaviour. For high-risk systems, current guidance suggests prioritising exposure detection and rapid revocation over rote password churn.

One practical exception is when the organisation is still transitioning away from legacy authentication. In those cases, awareness campaigns remain useful, but only as a temporary support layer while password managers, MFA, and account inventory mature. The strongest programmes also tie password policy to broader governance, including audit readiness and access review, which NHI Management Group covers in its Regulatory and Audit Perspectives guidance.

Related resources from NHI Mgmt Group

• When should organisations prioritise centralized password management over user-owned vaults?
• How do organisations decide whether to prioritise certificate automation before the next validity reduction?
• Should organisations prioritise external exposure or internal credential governance first?
• When should organisations prioritise DMARC over more user-awareness training?