Accounts

Passwords and MFA: what your business should be doing now

Robert Edmonds · November 2026 · 8 min read

If someone gets into your email, they can usually get into everything else, because that's where password reset links go. How your people log in is one of the most important security decisions in any business, and most of the problems I see come down to three things: weak passwords, reused passwords, and nowhere sensible to keep them.

1. Make passwords strong

Length matters more than complexity. A short password full of symbols, like P@ssw0rd1!, is easier to crack than a long one made of ordinary words. For the few passwords you need to remember, such as your computer login or your password manager, the NCSC recommends three random words. Pick words that have nothing to do with each other or with you.

Avoid anything someone could guess or find online: names, birthdays, pets, football teams, or the name of the business.

The passwords criminals try first

Attackers don't guess at random. Their tools start with lists of the most common passwords, then try words connected to you: your name, your children, your pets, your team. That information is often on your social media.

NordPass's 2025 study of passwords exposed in data breaches (September 2024 to September 2025) found the most common passwords worldwide were still:

1. 123456
2. admin
3. 12345678
4. 123456789
5. 12345
6. password

Adding symbols doesn't help as much as people think. Thirty-two of the 2025 top 200 included special characters, with familiar patterns such as P@ssw0rd and Admin@123. Attackers try those too.

Football teams are a UK favourite. When the NCSC analysed breached accounts in 2019, “liverpool” had been used on 280,723 of them, “chelsea” on 216,677 and “arsenal” on 179,095. First names (ashley, michael), bands (blink182) and characters (superman) all ran into the hundreds of thousands. The NCSC's advice was simple: don't protect anything important with something guessable, such as your name, local football team or favourite band.

For businesses: you can stop staff choosing these passwords in the first place. Microsoft Entra ID, for example, can block known weak passwords and a custom list you add, such as your company name, products and local teams.

2. Never reuse a password

This is the one I'd push hardest. Websites get breached all the time, and when they do, criminals take the email addresses and passwords and try them everywhere else, including your email, your bank and your Microsoft 365 account. If you've used the same password twice, one breach on a site you'd forgotten about can open up the accounts that matter.

Every account needs its own password. Nobody can remember dozens of them, which is why the next point matters.

3. Use a password manager

A password manager such as Dashlane creates a strong, unique password for every account, stores it securely and fills it in for you. You remember one strong password (and protect it with two-step verification), and the manager does the rest. It also shows you where you've reused or weak passwords, and many will warn you when a site you use has been breached.

For a business, use a business password manager rather than leaving staff to their own devices. Shared logins go in shared vaults instead of spreadsheets or emails, and when someone leaves you can remove their access in one place.

4. Passkeys are the future, but store them properly

In April 2026 the NCSC started recommending passkeys wherever a service supports them. A passkey replaces the password: it's unlocked with your fingerprint, face or PIN, and it can't be phished, because it only works with the genuine site it was created for.

The catch is where the passkey lives. If it's created on one device and stays there, you'll struggle the moment you need to log in from your laptop instead of your phone, or when you replace a device. Keep passkeys in a password manager that supports them, such as Dashlane, so they're available on every device you use. Your password manager then becomes the one place for both passwords and passkeys.

5. Turn on two-step verification everywhere

Two-step verification (also called 2FA or MFA) means a password alone isn't enough to get in. Where a service doesn't support passkeys, the NCSC recommends a strong password plus 2SV. Start with email, banking, accounting software, admin accounts, and your domain and website hosting.

An authenticator app is stronger than a text message, but any 2SV is far better than none.

6. Security keys for business accounts

For businesses, especially those running Microsoft Active Directory, Entra ID or a similar identity system, I strongly recommend physical security keys such as a YubiKey. Staff sign in by plugging in or tapping the key and entering a PIN, instead of typing a password.

That changes where the risk sits. Your main sign-in no longer depends on a password that can be guessed, reused, shared or typed into a fake login page. An attacker would need the physical key as well as the PIN. Security keys are particularly worth it for admin accounts, finance staff and anyone with access to sensitive data.