Passwords are supposedly dead. Every year a keynote declares it, and every year your team still manages a couple hundred of them. Passkeys are genuinely coming, and we deploy them wherever they exist. Meanwhile there is a spreadsheet named passwords-FINAL-v2.xlsx on a shared drive somewhere, and security has to work in the present tense.
Why reused passwords are the killer
Credential stuffing is grimly simple: attackers take the billions of passwords leaked from other people’s breaches and replay them against your systems, automated, around the clock. It works because humans reuse. The password your office manager set for a conference-swag site in 2021 is the same one on your invoicing portal today, and the swag site got popped.
No malware, no zero-day, just a login that looked legitimate because it was. Attackers do not need to be clever when a list of working passwords costs less than your lunch, and too many defenders keep treating that fact as somebody else’s breach.
The pattern shows up in almost every small-business incident we get called into. The front door was not kicked in; it was unlocked with a key the owner did not know existed. That is the part worth sitting with: most password disasters are not sophisticated. They are inherited, from a breach nobody here caused, at a company nobody here has heard of.
The fix costs less than lunch
A password manager for every employee, mandated, paid for, and trained in one thirty-minute session. Generated unique passwords for every service, so a breach elsewhere is a dead end instead of a master key. Shared vaults to kill the spreadsheet, with access that follows roles and revokes on departure day. If you want the short version of how we roll this out, our password manager program covers the whole thing.
MFA goes on top, because defense should never be one factor deep. Train for its failure mode too: attackers now spam approval prompts hoping someone taps yes just to stop the buzzing. We wrote up how MFA fatigue attacks work, because a second factor only helps if people know how it gets abused.
The whole program costs a few dollars per seat per month, which makes it the highest-return security spend most small businesses will ever approve. CISA’s guidance says the same thing in federal prose: strong unique passwords, a manager to hold them, MFA on top.
Rules that actually work
Skip the 90-day rotation theater; forced resets breed Winter2026! and sticky notes. Length beats complexity, so favor long passphrases over symbol confetti. Never reuse across work and personal. And check your critical accounts against known breach dumps, because the honest question is not whether some of your passwords have leaked, it is which ones.
One more rule that pays for itself: separate admin accounts from daily-driver accounts. The credentials that can change payroll or DNS should not live in the same browser profile that opens every attachment. Vault them, MFA them, and log their use. Ten minutes of setup that removes your scariest single point of failure.
Write the policy in one page. People follow rules they can remember, and a manager makes the secure path the lazy path, which is the only kind of security policy that survives contact with a busy Tuesday.
The transition strategy
Adopt passkeys as vendors ship them; they are phishing-proof and users genuinely like them once enrolled. Prioritize them for email, identity, and finance, the accounts where takeover hurts most. Email deserves special paranoia because it is the reset key to everything else; our email security checklist pairs well with this one.
But run the password program as if passkeys were a decade away, because for your long tail of vendor portals and industry tools, they might be. The two systems coexist fine, and the manager holds the passkey metadata too.
Unique everywhere, stored properly, MFA on top. Do those three and you exit the demographic that appears in breach write-ups under the phrase reused passwords. The keynote can keep declaring passwords dead; yours will simply stop being the ones that matter.
