MFA

A financial services firm rolled out its annual password policy update. Minimum 12 characters, one uppercase, one number, one special character. Employees complied. Security felt good. Then a red team engagement three months later found that 38% of employees had chosen variations of “Company2026!” and that nearly half were reusing their corporate password on personal services.

The policy was technically met. The behavior it was supposed to create never materialized.

This pattern repeats across industries. Organizations invest in password rules and compliance checklists, then wonder why credential-based attacks keep succeeding. The problem is not that employees lack awareness. Most people know password reuse is risky. The problem is that knowing something is risky does not automatically produce the alternative behavior.