Five password security best practices to defend your data

Passwords remain a critical part of protecting business systems and sensitive information, but they are also one of the most common targets for cybercriminals. Employees manage dozens of accounts across their professional and personal lives, making it tempting to reuse passwords or rely on easy-to-remember credentials.

Threat actors are well aware of this and routinely target passwords as a pathway into organizations. According to a 2026 data breach investigations report, stolen credentials were involved in 36% of reported breaches, making credential theft one of the leading ways attackers gain unauthorized access.

Strong password practices remain an important first line of defense in your organization’s layered risk-management approach. Combined with multi-factor authentication (MFA) and employee awareness of common scams, a modern password strategy can help reduce the risk of account compromise and data breaches.

How do threat actors steal passwords?

Cybercriminals steal accounts, financial information, and sensitive data because they can profit from using or selling this information. Targeting passwords is an easy way to gain access. It’s for this reason that organizations in sectors that deal with sensitive data, such as healthcare or financial services, face higher levels of credentials compromise¹.

There are several common techniques threat actors use to steal passwords:

• Exploiting human error or gaining their victim’s trust through social engineering.
• Guessing answers to security questions with information shared through social media.
• Identifying passwords that are routinely reused across multiple accounts.
• Using password recovery toolkit (PRTK) software that automatically uses familiar words in password fields, including substituting characters for letters (e.g., p@$$w0rd).

Passwords are an organization’s first line of defense against unauthorized access. Leaders should prioritize protecting data by using unique, strong passwords and enable multi-factor authentication (MFA) whenever possible. Implementing practices to strengthen employee password guidelines and enhancing protections, which we’ll cover in this article, can help combat password thieves. However, transitioning to passkeys as an authentication method – and doing away with passwords altogether – could be the safest strategy.

The rise of passkeys

Passkeys are an alternative authentication method that does not require passwords or usernames. With a passkey, users can log into websites, accounts, and applications using their device’s authentication method to verify identity, such as a PIN or biometric features, including fingerprints and facial recognition. Using a passkey that leverages these more secure and convenient methods of authentication allows users to bypass usernames and passwords entirely.

This form of passwordless authentication is gaining momentum, a move supported by major tech companies, including Apple, Google, and Microsoft. This availability and adoption signals a significant shift away from traditional passwords to reduce the risk of phishing and credential stuffing attacks.

Organizations should consider transitioning to passkeys to reduce or eliminate the number of credentials employees manage. The risk of relying solely on password authentication is just too high: One report found valid account abuse was used in approximately 12% of data breaches, leading to average breach costs of $5.07 million². Transitioning to passkeys can take time; leveraging strong password management practices and embracing MFA in the meantime can further help protect your organization.

Create a strong password management policy

Every organization should have set requirements for passwords to ensure they are secure, unique, and complex enough. We recommend following the National Institute for Standards and Technology (NIST) guidelines to inform your policy. All passwords used at your organization should consider the following:

• Long: Use passwords or passphrases that are at least 15-16 characters long. Longer passwords are generally more resistant to guessing and cracking attempts.
• Unpredictable: Encourage passphrases made up of multiple words rather than relying on predictable personal or business information, substitutions, or keyboard patterns.
• Unique: Never reuse passwords or use the same word or phrase for all accounts.
• Exclusive: Never use business credentials for personal websites, applications, or online services and vice versa.
• Secure: Employees should be instructed not to save passwords in web browsers, applications, shared drives or network files.
• Screened: Check new and updated passwords against lists of commonly used, weak or previously breached passwords and reject those that have been exposed.

Use these principles to develop or update your organization’s password policy. Be sure to enforce this policy and regularly communicate about it with employees.

Expand multi-factor authorization (MFA)

Multi-factor authentication (MFA), also known as two-factor authentication, requires users to provide multiple forms of verification to access an account. This layered approach significantly enhances security, so it’s recommended to use MFA across all apps, services, and sites used at your organization.

MFA verification can include any combination of the following:

• Something you know, like a password.
• Something you have, such as a hard token, security key, or smartcard.
• Something you are, meaning a biometric method.

To gain unauthorized access to an account secured with MFA, a threat actor would need to have access to a user’s mobile device and be able to authenticate with one of the three methods above. Microsoft research found that MFA can block more than 99.2% of account compromise attacks³.

Organizations can combine biometric methods with something an employee physically possesses, such as an authorized smartphone, for a highly secure passwordless authentication experience. Not only does this layered approach help mitigate phishing attempts and similar attacks, but it’s also more convenient for employees than memorizing credentials. Ease of use can help cut back on bad password habits, such as reusing passwords or keeping physical copies of credentials.

Five password security best practices

In addition to enforcing strict password requirements and implementing tools such as passkeys and MFA, there are a few other ways your organization can help avoid breaches related to stolen credentials.

1. Create a strong culture of security by implementing routine cybersecurity awareness training for all employees, regardless of their role’s access to company systems.
2. If you haven’t transitioned to using passkeys, require employees to use a longer password or passphrase.
3. Remain vigilant against phishing attacks and educate employees on how to recognize suspicious emails attempting to get them to reveal sensitive information.
4. Review account activity where possible and report any suspicious activity. For example, if you receive a prompt to complete an MFA activity you did not initiate, change your password immediately.
5. Stay on top of software and device vulnerabilities. Running older versions of software and operating systems opens you up to vulnerabilities that could compromise sensitive data – like your passwords.

By implementing a strong password policy, offering awareness training, and alternative, passwordless authentication methods, you can help protect your organization and its employees. Huntington can support you with the insights, resources, and expertise you need to help keep your organization safe.