Cybersecurity

Passwords, MFA, and the myth of the disciplined employee

Published January 20, 2026  ·  Exosphere Solutions

Every password policy ever written assumes an employee who does not exist.

This person memorizes forty unique passwords, each sixteen characters, none reused, all rotated quarterly. They have never written one on a sticky note. They have never appended 2024! to an old one.

This person is fictional, and security that depends on a fictional person is a story you tell yourself.

Why people reuse passwords

People reuse passwords because the alternative was never humanly possible. Blaming them is like blaming someone for not memorizing the phone book.

Reuse is exactly what attackers count on. When one site is breached, the stolen password gets tried everywhere else, automatically, at scale, for free. It costs an attacker nothing to try, and it can cost you a great deal when it works.

Use a password manager

The fix is a tool. Posters and reminders to try harder have had decades to work.

You remember one strong password. The manager remembers the other forty, generates them properly, and fills them in. It’s the approach that holds up when real people use it.

Length beats complexity

Four random words are stronger and far easier to use than P@ssw0rd!. Complexity requirements mostly produce predictable substitutions (a becomes @, o becomes 0), and attackers have known about those for twenty years.

Then turn on MFA and stop worrying quite so much

Here’s the good news. With multi-factor authentication switched on, a stolen password on its own is nearly worthless.

Start with email, since it’s the account that resets every other account. Then banking, then anything with customer data.

Yes, it’s mildly annoying. So is a seatbelt, and nobody proposes removing seatbelts because they’re inconvenient.

The practical version

1. Roll out a password manager to the whole team. One afternoon.
2. Turn on MFA for email, first, today.
3. Change the reused passwords you already know about. You know the ones.
4. Stop requiring 90-day rotation. It produces Winter2026! and everyone knows it.

On password length over forced complexity and against arbitrary rotation, see NIST SP 800-63B.

← All articles