IT audit: password complexity

A study presented in 2020 at the ConPro workshop of the IEEE Security & Privacy conference shows that most users don’t change their passwords after a security incident or when procedures require them to, and when they do, they often choose a password that’s just as weak, or weaker.

During the IT audit, RezolvIT identifies things such as the “complexity”, “age” and “uniqueness” of passwords: in practice, we find out how passwords are made up, when they were last changed and whether they’re also used for other services or sites.

There’s even a kind of pushback when our Helpdesk colleagues explain to users why a password has to be long and unique for each site, and why the system rejects their simple passwords.

To advise companies on how to help their users do these things before a security incident happens, it’s important to understand how effective post-incident practices are.

What did the study show?

Of the 249 participants, 63 had accounts on a compromised domain. Only 33% of those 63 changed their passwords, and only 13% (of the 63) did so within three months of the breach being announced. The new passwords were, on average, 1.3 times stronger than the old ones, although most were weaker or just as strong. Specifically, the new passwords generally resembled the participants’ other passwords, and they rarely changed their passwords on other sites, even when those were identical or similar to the password on the compromised domain.

The conclusion is simple: it’s not enough to ask people to change their password. A company needs rules that work even when users don’t react.

What password rules do we recommend in 2026?

The recommendations have changed compared with previous years. The US guideline NIST SP 800-63B, revised in 2025, says passwords shouldn’t be changed periodically, only when there are signs they’ve been compromised, and drops composition rules (an uppercase letter, a digit, a symbol) in favor of long passwords checked against lists of compromised passwords.

In short, for your company:

1. Length matters more than complexity. An easy-to-remember phrase of at least 15 characters is harder to crack than a short word with symbols.
2. A unique password for each account. When a reused password shows up in a breach, attackers immediately try it on email, on the VPN and in the company’s apps too.
3. A password manager. That way, employees no longer have to remember dozens of passwords, and they stop writing them on sticky notes stuck to the monitor.
4. Two-step verification (MFA) on email, VPN, Microsoft 365 and important apps. For companies that fall under NIS2 (in Romania, GEO 155/2024), multi-factor authentication is one of the required security measures.
5. Changing the password after an incident, not by the calendar: as soon as a service announces a breach or a company address shows up in a list of compromised accounts.

See also the basic rules for creating secure passwords.

What do you get from the IT audit?

The free IT audit gives you an inventory of your equipment, a list of risks, including those related to passwords and accounts, and a report with concrete recommendations. When the company hires someone, we set up their computer and accounts with secure rules from day one, and when someone leaves, we close their access.

RezolvIT highlights the need for clear password procedures: few rules, but followed by everyone.

Request a free IT audit for your company now.