Complexity Was Never the Problem.

In the 2026 Verizon Data Breach Investigations Report, 4 percent of Active Directory accounts were using a password that had already been breached somewhere else. Fewer than 1 percent failed a complexity requirement.

Your users are more than four times as likely to be running an already-compromised password than a technically weak one.

Your password policy is auditing for the second thing.

Disclosures. Ergon sells technology leadership work that includes security posture, so a post about your password hygiene is a post that sells what I do. And every analysis I read to write this was published by a company that sells the fix: Verizon sells security services, and the firms explaining its report sell passwordless authentication, credential exposure monitoring, and identity security. The data is consistent across all of them, which is why I trust it. Everyone handing it to you still profits from your concern, including me.

The Audit Is Checking for the Wrong Thing

Somewhere in your organization there is a policy that requires a capital letter, a number, and a symbol. It gets enforced at the login screen. It gets reviewed once a year. Somebody has a spreadsheet.

That policy catches under 1 percent of your risk.

The password that actually gets you breached passes every one of those checks. It is twelve characters, mixed case, has a symbol in it, and it is sitting in a credential dump right now because your controller used it on a hotel booking site in 2023.

Complexity is a property of a string. Exposure is a fact about the world. You are testing the string.

The fix is not a harder rule. It is a different question. Instead of asking whether this password is strong, ask whether this password is already known. That is a lookup against breach corpora, and it is a solved problem with commodity tooling.

Reuse Is the Failure, Not Weakness

Six percent of Active Directory accounts in that dataset were reusing passwords.

Reuse is what turns one breach into yours. The attacker did not crack anything. Somebody else's vendor got popped, the credentials went into a dump, and your account was in the blast radius because the same string opens both doors.

This is why the personal advice and the corporate control are the same advice. The password your VP of Sales uses for a conference registration is a corporate control, whether or not it appears anywhere in your policy documentation.

Most security programs treat this as a user education problem. It is not. It is an architecture problem wearing a training slide.

What AI Changed, and What It Didn't

Here is the part that will disappoint anyone hoping for a dramatic story.

Vulnerability exploitation now starts 31 percent of breaches, up 55 percent year over year, and it has passed stolen credentials as the top initial access vector. That shift deserves attention.

But credentials appear in 39 percent of all breaches once you count the full attack chain instead of just the first step. They remain the most pervasive technique in the dataset, because credentials are how attackers move sideways, escalate, and turn access into money. Losing the top spot at the front door does not mean leaving the building.

And the AI contribution is not a new technique. The report's read is that AI is scaling what already worked. Forty-four percent of AI-assisted initial access was phishing-related. Same play, better copy, more of it, aimed at more people.

I wrote on Friday that OpenAI rated a model Critical for cybersecurity. That is worth taking seriously. It is also not what is going to happen to you this quarter. What is going to happen to you this quarter is a well-written phishing email and a password your employee used somewhere else.

The Ninety-Five Day Window

Seventy-three percent of ransomware victims in the report had an infostealer infection or a credential leak in the year before the attack. Half of those happened within 95 days of the ransomware landing.

Read that again, because it is the most useful sentence in the whole report.

The credential leak is not the breach. It is the countdown. There was a window, measured in weeks and months, where the material was already out and the attack had not happened yet. Somebody could have known. Nobody was looking.

That reframes this entire topic. Password hygiene is not a virtue. It is a detection capability. The question is not whether your people have good passwords. It is whether you would find out that one of them was exposed before somebody used it.

Meanwhile only 23 percent of third-party organizations fully remediated missing or improperly configured MFA on their cloud accounts, and the median time to resolve half of the weak password and permission findings was eight months.

Eight months, against a 95 day fuse. That is the whole problem in two numbers.

What I'd Do This Week

Check your passwords against breach data, not against a rule. If your identity provider offers compromised credential detection, turn it on today. If it does not, that is a procurement conversation worth having this quarter.

Find out how you would learn about an exposure. Not whether you block one. Whether anyone would tell you, and how fast. If the answer is a news article, you do not have a control.

Turn on MFA everywhere it is missing, starting with the accounts nobody audits. Service accounts. Contractors. The vendor with access to your file share. The report is blunt about how badly this is done in third parties.

Stop measuring password strength in your reporting. It looks like diligence and it measures almost nothing. Replace it with exposure count and time to remediate.

The Part That Matters

The advice your bank gave you fifteen years ago was right, and it was right for the wrong reason. Do not reuse passwords. Not because someone will guess yours. Because someone already has it.

AI did not change that. It just made the phishing better and the volume higher while everyone watched the wrong door.

Complexity was never the problem. Exposure was, and it still is.