What should organisations do when passwords still exist in part of the estate?

Why the Remaining Password Estate Needs Governance, Not Just Tolerance

Passwords that remain in production are not a temporary inconvenience to ignore. They create a residual control surface that must be managed with the same discipline as any other legacy authentication path: known scope, ownership, review cadence, compensating controls and retirement criteria. Treating the estate as governed risk prevents blind spots where old methods persist long after the modern path is available.

That governance should be explicit about where passwords still exist, why they still exist and which systems or workflows depend on them. In practice, the important question is not whether passwords are ideal, but whether the organisation can prove that every remaining path is inventoried, monitored and on a plan to shrink over time.

How to Reduce Exposure Without Breaking Legitimate Access

The safest way to shrink the estate is to move each feasible use case to passwordless authentication rather than to bolt more policy around the old pattern. Passwordless reduces the chance of reuse, phishing capture and password spraying, but it must be introduced where user population, application compatibility and recovery design can support it. A partial rollout is normal; the goal is controlled reduction, not a big-bang switch.

For the passwords that remain, governance has to cover the whole credential lifecycle. That means rotation when a user, device, role or integration changes; enforced resets after a compromise signal; and consistent policy across all administrative, application and recovery paths. If one reset channel is weaker than the others, the residual estate is only as strong as that weakest path.

Modern control design should also assume that a password is only one layer in a broader access chain. The security value comes from reducing standing exposure, constraining where the credential works and making sure resets, recovery and exception handling do not become back doors around stronger controls. NIST SP 800-63 Digital Identity Guidelines are useful here because they push practitioners toward phishing-resistant authentication and a more deliberate treatment of authenticators and recovery.

What Good Operations Look Like While Passwords Still Exist

Good practice is to run the remaining estate as a measurable, shrinking inventory. Each password-bearing path should have an owner, a business justification, a retirement target and a review trigger. If the organisation cannot answer who can create, reset, override or bypass the credential, then the policy is incomplete even if the login itself is technically protected.

Practical enforcement should be uniform. The same breach-corpus screening, minimum-strength policy, lockout logic, reset rules and exception handling should apply wherever a password can be introduced or recovered. That consistency matters because attackers often target the weakest creation or recovery path rather than the main authentication screen. NIST SP 800-53 Rev 5 Security and Privacy Controls aligns well with this approach because it supports control over identification, authentication and access enforcement as part of an overall control system.

When password use is tied to cloud or service access, the same discipline should extend to non-human and application paths that still rely on shared secrets. OWASP Non-Human Identity Top 10 is relevant because it frames long-lived secrets, overprivilege and poor lifecycle handling as persistent sources of exposure, even when the password is not used by a human.

Risk and Threat Considerations

Residual passwords remain attractive because they are easy to phish, reuse and spray at scale, especially where recovery flows are inconsistent or too permissive. If one part of the estate can still be reset, rescued or overridden without the same assurance as the primary path, attackers will look for that path first.

Failure mechanism: The organisation keeps the old password path alive while the new control model is only partially deployed, so attackers focus on reuse, recovery abuse, weak resets or legacy exceptions to regain access.

Impact: The result can be account takeover, privilege escalation or silent persistence in systems that were assumed to be modernised, with the largest blast radius usually appearing where the weakest reset or exception path exists.

Practitioner Guidance

What to prioritise: First map every remaining password use case to an owner and a retirement decision, then separate truly unavoidable legacy cases from those that can move to passwordless with modest application change. That distinction prevents teams from spending time hardening something that should simply be retired.

What to verify: Confirm that every path that can create, recover or reset a credential is governed by the same strength checks, audit trail and approval logic. If recovery is easier than initial enrolment, the control is already asymmetric in the wrong direction.

Decision rule: If a password can still authenticate into a high-value system, treat it as a standing residual risk until it is either replaced or tightly bounded by strong compensating controls and review. Do not wait for evidence of abuse before tightening the weakest paths.

Practitioner takeaway: The objective is not to preserve legacy passwords forever with more policy, it is to make every remaining password a shrinking, observable exception with a clear exit plan.

Related resources from NHI Mgmt Group

• Why do non-human identities create compliance risk even when policies exist?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?
• How can organisations reduce the blast radius of compromised agent identities?