Passwords are still part of everyday business life, even as multi-factor authentication and passkeys become more common. The problem is not usually that staff deliberately choose poor security. It is that people have too many accounts, too many passwords and too many competing demands on their time.
That makes Cyber Awareness Month a useful opportunity to review how passwords are handled across the business. A few sensible changes can reduce risk considerably without forcing everyone to memorise increasingly complicated strings of characters.
1. Stop reusing passwords between services
Password reuse is one of the biggest practical risks. If a password used for a less important website is exposed in a breach, attackers can try the same email address and password against Microsoft 365, cloud applications and other business services.
Every important account should therefore have a unique password. This matters particularly for email, Microsoft 365, finance systems, remote access, backup platforms and administrator accounts.
2. Use a business password manager
Expecting staff to remember dozens of unique passwords is unrealistic. A reputable password manager solves much of that problem by generating and securely storing strong, unique credentials.
For a business, use a managed business product rather than relying on personal password vaults. This gives the organisation control over access, recovery and offboarding. It can also provide secure sharing when several authorised people genuinely need access to the same service.
A password manager does not remove the need for good security around the vault itself. Protect it with a strong master password and multi-factor authentication, and make sure recovery arrangements are documented.
3. Prefer length over complicated password rules
Rules that demand frequent password changes and a particular mixture of symbols, numbers and capital letters can encourage predictable behaviour. Staff may simply change Summer2026! to Autumn2026!, which achieves very little.
Long, unique passwords or passphrases are generally more useful. Where a password manager is generating credentials, they can be long and random because nobody needs to remember them.
Avoid forcing routine password changes purely because a certain number of days has passed. A password should certainly be changed when compromise is suspected, after inappropriate sharing, or when there is another genuine security reason.
4. Never share passwords by email or Teams
Sending a password in an email, Teams message or spreadsheet creates another copy of that credential which may remain accessible for years. It also makes it difficult to know who currently has access.
Where credentials genuinely need to be shared, use the secure sharing facilities within a managed password vault. Better still, where the application supports individual user accounts, give each person their own account instead of sharing one login.
5. Protect passwords with MFA
A strong password is important, but it should not be the only thing protecting a valuable account. Multi-factor authentication adds another barrier if a password is stolen through phishing, malware or a data breach.
For Microsoft 365 and other critical services, enable MFA wherever possible. For higher-risk accounts, stronger authentication methods such as authenticator apps, security keys and passkeys can provide better protection than SMS codes.
MFA is not a substitute for good passwords, and good passwords are not a substitute for MFA. The controls work best together.
6. Remove accounts when people leave
Password security is also an access-management issue. When somebody leaves the business, their access should be removed promptly rather than relying on somebody remembering to change a shared password.
Keep an inventory of important business systems and include them in the leaver process. Disable individual accounts, revoke active sessions, remove access to shared password vaults and review any credentials the person could access.
This is one reason individual accounts and centrally managed password vaults are preferable to a spreadsheet of passwords known by several people.
7. Start moving towards passkeys
Passkeys are increasingly supported by major platforms and can reduce reliance on traditional passwords. They use cryptographic credentials tied to a device or secure authenticator and are resistant to many common phishing techniques.
Businesses do not need to replace every password immediately. Start by identifying important services that already support passkeys or other phishing-resistant authentication, then introduce them in a controlled way alongside sensible recovery arrangements.
A simple password security review
For most small businesses, the immediate priorities are straightforward: stop password reuse, introduce a managed password manager, enable MFA, remove unnecessary shared accounts and make sure leavers lose access promptly. Then review where stronger authentication such as passkeys can be introduced.
Password security should make it easier for staff to do the right thing. If your current approach depends on people remembering dozens of complex passwords, the process itself probably needs improving.
ML Services helps businesses across Sussex improve Microsoft 365 security, account management, device security and day-to-day cyber protection. If you would like a practical review of how your business handles passwords and access, contact ML Services.