weak passwords: what businesses should know

weak passwords is an important part of keeping business technology practical, secure and reliable. This article explains the issue in plain language, with related context on account compromise and useful external guidance on password guidance.

Most businesses don’t think they have a password problem. There’s usually some level of awareness. “We use passwords.” “We don’t write them down.” “We’ve got a system.” On the surface, it feels under control. But when you actually look closer, the real issue isn’t shared passwords. It’s something far more common and far more dangerous. The same weak password, used everywhere. The Pattern We See All the Time This is what it usually looks like in practice:

• One password for email
• The same password for Microsoft 365
• The same password for third-party systems
• Maybe a slight variation if forced

It’s not laziness. It’s survival. People are juggling too many logins, too many systems, and too many requirements. So they simplify. The problem is, this creates a chain reaction. One Compromised Password Becomes a Full Breach When a password is reused across multiple systems, it stops being a single point of access. It becomes a master key. If just one of those systems is compromised through a breach, phishing attempt, or leaked database, that same password can be used to access everything else tied to it. Email. Cloud platforms. Business systems. And most of the time, this happens quietly. Weak Passwords Make It Even Easier Reused passwords are bad. Weak passwords make it worse. Common patterns we still see:

• CompanyName123
• Welcome2026
• Passwords based on seasons or years
• Slight variations of the same base password

These are easy to guess, easy to crack, and often already exposed in previous breaches. There’s a moment in Hackers (1995) where a list of the “most common passwords” gets read out:

• love
• s*x
• secret
• god

At the time, it sounded almost exaggerated. But the reality is, people still default to predictable words and patterns because they’re easy to remember. And that’s the real issue. Most users aren’t ignoring security because they don’t care. They’re doing it because:

• They’re managing too many logins
• They’re expected to remember complex passwords
• They don’t have the right tools to manage them properly

So they simplify. And that simplification leads to weak, predictable passwords that attackers already know how to exploit. If you want a quick reality check, you can check your email or password against known breach databases using Have I Been Pwned: https://haveibeenpwned.com/ For many businesses, this is the moment it clicks. Where IT Support and POPIA Come Into This There’s another layer most businesses don’t think about. When working with an IT provider, a common assumption is: “They have all our passwords.” In a properly managed environment, that shouldn’t be the case. From a POPIA perspective, access to credentials should be limited and controlled. Most responsible IT providers do not store login details unless there is a very specific and justified reason to do so. Instead, access should be handled through:

• Assigned user permissions
• Admin roles within systems
• Secure tools designed for controlled access

This protects both the business and the provider. Because if credentials are being passed around casually, stored in emails, or shared informally, it doesn’t just create a technical risk. It creates a compliance risk as well. Shared Passwords Still Exist. But They’re Not the Core Issue Shared passwords do still happen, but usually in specific scenarios. The most common one is shared email accounts like: info@company.co.za admin@company.co.za And even here, the problem isn’t just that multiple people have access. It’s how that access is handled. If you’re using Microsoft 365 Business, Shared Mailboxes already solve this properly:

• No shared password required
• Each user logs in with their own account
• Access is assigned individually
• Activity is traceable

So while shared passwords are still a risk, they’re often just a symptom of a bigger issue. Strong Passwords Are Still the Foundation Before jumping to advanced solutions, most businesses need to fix the basics. A proper password should be:

• At least 12 to 16 characters
• Unique for every system
• Random enough to avoid patterns

This is where password managers come in. They allow users to generate strong, unique passwords, store them securely, and avoid reusing credentials across systems. Without them, people fall back to memory. And memory leads to repetition. Where Things Are Going: Passkeys and Passwordless Access Even with strong passwords, the industry is moving beyond them. Passkeys are becoming the next step in authentication. They remove the need for passwords entirely. There are two main types: Device-based passkeys:

• Stored on your phone or computer
• Use biometrics like fingerprint or face recognition

Physical security keys:

• USB or NFC devices used to log in
• Must be physically present

The advantage is simple. There’s nothing to reuse. Even if one system is compromised, there’s no shared credential that can be used elsewhere. Why This Becomes a Business Risk So Quickly The issue with password reuse is scale. One user reusing a password might not seem like a big deal. But across a business, it creates:

• Multiple entry points
• No isolation between systems
• A higher chance of widespread access if one account is compromised

And because users don’t always report issues immediately, problems can go unnoticed. How to Fix This Without Making Life Difficult This doesn’t need to be complicated.

1. Enforce unique passwords for every system
2. Introduce a password manager
3. Enable multi-factor authentication
4. Use proper shared access instead of shared logins
5. Start moving toward passkeys where possible

Final Thought Most businesses don’t get breached because of some advanced attack. They get breached because of simple, repeated patterns. Weak passwords. Reused passwords. Poor access control. It’s not complicated. But it is important. If you’re not sure how passwords and access are currently handled in your environment, it’s worth reviewing it properly before it becomes a bigger issue. If you’d like help assessing or improving this, you can reach out to us.