Key Takeaway: Most password policies fail because they optimize for complexity rather than security. Length and uniqueness matter more than special characters. A password manager that employees actually use is more effective than a policy they work around. MFA on every account is the control that matters most.
Most password policies fail because they focus on complexity rather than length and uniqueness, leading to password reuse and insecure workarounds. Effective password policies prioritize length (≥12 characters), uniqueness per account, and multi-factor authentication over complex character requirements.
A business password manager that employees actually use stores and autofills credentials, generates strong unique passwords, and shares team logins securely, making security easy, not burdensome.
Your security policy says sixteen characters and no reuse. Your employees say that is impossible to remember, so they write passwords on a sticky note under the keyboard. The policy lost. The fix is not a stricter policy. It is a tool that makes the safe choice the easy choice.
Why Sticky Notes Win Without a Manager
People reuse passwords because remembering dozens is genuinely hard. A business password manager stores and autofills credentials, generates strong unique passwords, and shares them within a team without exposing the raw string. Combined with enforced MFA, this closes the most common entry point for attackers [Microsoft DDR].
Pick for Adoption, Not Features
The best password manager is the one your least technical employee will open. Look for browser autofill, a simple mobile app, and shared vaults for team credentials. NIST’s identity guidance supports phishing-resistant, managed credentials over forced periodic resets [NIST].
Roll It Out Like a Habit, Not a Decree
Start with the five most-used shared logins. Import them, train for fifteen minutes, and require the manager for all new accounts. Within a month, the autofill convenience does the enforcing for you.
The Payoff
When every credential is unique, long, and in one audited place, a single leaked password stops being a company-wide event. That is the difference between a contained annoyance and a breach.
Frequently Asked Questions
What if we lose access to the manager?
Configure a break-glass admin and an offline emergency kit held by the owner.
Are browser-built-in managers enough?
For consumers, maybe. For a business with shared logins, a dedicated tool with audit trails is safer.
How do we handle departing employees?
Revoke their vault access on exit day; shared credentials stay with the team, not the person.
About Brent Lacy: Brent Lacy is a technology advisor and the voice behind Rewired MSP. He helps MSPs operate with greater maturity and helps business owners make IT choices that make them more secure and more efficient. He is the author of Rewired MSP: Mastery, Scalability & Performance, vCIO Rewired: Virtually Conquering IT Obstacles, and Near Miss: Preventable IT Failures Threatening Your Business Security.
Sources
- IBM Cost of a Data Breach Report 2024
- Verizon Data Breach Investigations Report 2024
- CISA Cybersecurity Division
- NIST Cybersecurity Framework 2.0
- Microsoft Digital Defense Report
Why Complexity Requirements Backfire
The standard password policy requires a minimum length, uppercase and lowercase letters, numbers, and special characters. It also requires regular password changes. This policy is well-intentioned and counterproductive.
When employees are required to create complex passwords that change every 90 days, they do what humans do when faced with an impossible cognitive burden: they find workarounds. They use the same base password with a number at the end that increments with each change. They write the password on a sticky note. They use a simple pattern that technically meets the complexity requirements but is trivially guessable. The policy that was designed to improve security produces behavior that undermines it.
The National Institute of Standards and Technology (NIST) updated its password guidelines in 2024 to reflect this reality. NIST SP 800-63B now recommends against mandatory periodic password changes, against complexity requirements that do not improve security, and in favor of length as the primary security measure. The guidance that most organizations are still following is the guidance that NIST has moved away from.
What Actually Works: Length, Uniqueness, and MFA
Length over complexity. A 16-character passphrase made of random words is significantly harder to crack than an 8-character password with special characters. Length is the primary determinant of password strength. A password policy that requires 16 or more characters and does not mandate complexity requirements will produce stronger passwords than one that requires 8 characters with complexity.
Uniqueness per account. Password reuse is the most common cause of credential-based breaches. When a password is reused across multiple accounts, a breach of any one of those accounts compromises all of them. The only reliable way to ensure password uniqueness is a password manager. A policy that requires unique passwords without providing a password manager is a policy that will not be followed.
Multi-factor authentication. MFA is the single most effective control against credential-based attacks. A stolen password is useless against an account protected by MFA. Cyber insurance carriers now require MFA on all remote access and privileged accounts as a condition of coverage. The password policy that does not include MFA enforcement is incomplete regardless of how strong the password requirements are.
The Password Manager Question
The password manager is the tool that makes a strong password policy actually work. Without a password manager, employees cannot realistically maintain unique, strong passwords for every account they use. With a password manager, they can.
The password manager that employees actually use is more effective than the one that is technically superior but creates friction. The MSP that deploys a password manager and trains employees on how to use it is delivering a security improvement that is immediately visible in behavior. The MSP that mandates a password policy without providing the tools to follow it is creating compliance theater.
Business password managers for MSP clients include 1Password Business, Bitwarden Business, and Keeper Business. All three integrate with Microsoft 365 and Google Workspace, support administrative controls, and provide audit logging that is useful for compliance documentation.
The Breach Monitoring Layer
Even strong, unique passwords can be compromised through data breaches at third-party services. The employee who uses a strong, unique password for a service that is later breached has a compromised credential that they may not know about for months.
Breach monitoring services, including Have I Been Pwned and the monitoring built into most business password managers, alert users when their credentials appear in known breach databases. This layer of monitoring converts a passive security control into an active one: instead of waiting for a breach to be discovered through its consequences, the organization is notified when credentials are at risk and can take action before the damage occurs.
Frequently Asked Questions
Should I still require password changes?
NIST’s current guidance recommends against mandatory periodic password changes unless there is evidence of compromise. Forced password changes produce predictable patterns (Password1, Password2, Password3) that are easier to guess than a strong password that is never changed. Change passwords when there is evidence of compromise, not on a calendar schedule.
What is the minimum password length I should require?
NIST recommends a minimum of 15 characters for memorized secrets. For passwords stored in a password manager, longer is better. A passphrase of four or more random words is both strong and memorable. The password manager makes length irrelevant for most accounts because the user does not need to remember the password.
How do I get employees to actually use a password manager?
Deploy it, train on it, and make it the path of least resistance. The password manager that is installed on every device, integrated with the browser, and demonstrated in a 30-minute training session will be used. The one that requires employees to seek it out and figure it out on their own will not.
About Brent Lacy: Brent Lacy is a technology advisor and the voice behind Rewired MSP. He is the author of Rewired MSP: Mastery, Scalability & Performance, vCIO Rewired: Virtually Conquering IT Obstacles, and Near Miss: Preventable IT Failures Threatening Your Business Security.
Related Reading
- MFA and Digital Identity: What Your IT Provider Should Be Doing
- Cyber Insurance Requirements 2026: What Carriers Actually Check
- MSP Cybersecurity Hub
- Is Your IT Provider Giving Users Too Many Rights?
Sources
Related Reading: dark web monitoring
