Why Are We Still Forcing Password Changes When Cybersecurity Risks Go Far Beyond the User?
Why Are We Still Forcing Password Changes When Cybersecurity Risks Go Far Beyond the User?
The Password Security Paradox
Every few months, employees across government agencies, healthcare organizations, financial institutions, and commercial businesses receive a familiar notification:
Your password has expired. You must create a new password before continuing.
The new password must meet minimum length requirements and include uppercase and lowercase letters, numbers, and special characters, and it cannot resemble a previously used password.
Employees comply because they must.
Meanwhile, the same organization may operate unpatched servers, outdated applications, poorly configured cloud environments, overly privileged service accounts, or third-party platforms with limited security oversight.
There is an important question organizations should be asking:
Why do we keep emphasizing changing an individual's password when major cybersecurity threats exist far beyond the individual's control?
Passwords remain an important security control. Stolen credentials continue to contribute to cyberattacks.
However, repeatedly changing a password does not correct a vulnerable server, insecure application, compromised cloud service, or poorly managed infrastructure.
Cybersecurity must address the entire technology environment rather than placing disproportionate responsibility on individual users.
NIST No Longer Recommends Routine Password Expiration
For years, many organizations treated periodic password changes as a fundamental cybersecurity requirement.
Employees were instructed to change passwords every 30, 60, or 90 days regardless of whether their credentials had been compromised.
That approach was intended to limit the period during which a stolen password might remain useful.
However, mandatory password expiration can create unintended consequences.
Employees may respond by selecting predictable variations of existing passwords, such as changing a number or symbol at the end.
Others may struggle to remember multiple complex passwords and resort to insecure storage practices.
NIST Special Publication 800-63B-4, published in 2025, explicitly states that verifiers and credential service providers shall not require periodic password changes. Password changes are required when evidence shows the authenticator has been compromised.
NIST also discourages arbitrary password composition rules, such as requiring particular combinations of character types.
The emphasis has shifted toward stronger passwords, screening against compromised credentials, appropriate authentication controls, and responding to actual evidence of risk.
This raises another question:
If current federal digital identity guidance discourages routine password expiration, why do so many organizations continue relying on it?
Some organizations operate under legacy policies, contractual obligations, or regulatory requirements that have not been updated. Others continue established practices because changing security policy requires coordination across compliance, technology, and leadership teams.
However, maintaining an outdated requirement simply because it has always existed is not the same as improving security.
What the Breach Data Actually Shows
It's inaccurate to claim that most cybersecurity breaches originate exclusively within cloud infrastructure or Infrastructure-as-a-Service (IaaS) environments.
Cyberattacks involve several major entry points, including stolen credentials, phishing, software vulnerabilities, third-party compromises, and misconfigurations.
However, recent breach data demonstrates why organizations cannot rely primarily on user password controls.
Verizon's 2026 Data Breach Investigations Report found that exploitation of software vulnerabilities accounted for approximately 31% of breaches as an initial access vector, compared with 13% attributed to credential abuse.
This marked the first time in the report's history that vulnerability exploitation surpassed credential abuse as the leading identified initial access method.
These figures describe initial access within the report's analyzed dataset. They do not mean that every exploited vulnerability involved cloud infrastructure or that stolen credentials are no longer important.
The findings show that organizations must devote substantial attention to vulnerabilities in systems, applications, and infrastructure.
A strong password cannot prevent an attacker from exploiting an unpatched internet-facing application.
Your Password Cannot Fix an Unpatched Server
Consider an organization that requires employees to change passwords every 60 days.
The organization may also have:
-
An outdated web server
-
A vulnerable VPN appliance
-
Unsupported software
-
An exposed management interface
-
A misconfigured cloud storage resource
-
A database accessible through an insecure application
-
An unpatched third-party component
Employees can follow every password requirement and still have their information compromised through these weaknesses.
The problem is not necessarily the employee.
The problem may be the technology environment that stores, processes, or provides access to the employee's information.
This distinction matters because security programs should prioritize controls according to the risks they actually reduce.
Password policies address certain identity-related risks.
Vulnerability management, secure configuration, network segmentation, monitoring, and patch management address other risks.
One cannot replace the others.
Infrastructure Security Is Often Invisible to the User
Employees are constantly reminded of their cybersecurity responsibilities.
They receive password expiration notices, phishing simulations, security awareness training, and multi-factor authentication requests.
These controls are visible because employees interact with them directly.
Infrastructure security is different.
Most employees cannot see whether:
-
Servers are fully patched
-
Databases are properly secured
-
Administrative accounts have excessive privileges
-
Cloud resources are configured correctly
-
Backup systems are isolated
-
Application vulnerabilities have been remediated
-
Security logs are being reviewed
-
Third-party providers are meeting contractual requirements
Yet these controls can be just as important as individual authentication practices.
An employee may have a strong password and use multi-factor authentication, but the underlying application may contain a serious vulnerability.
The user cannot correct that weakness.
Only the organization, software provider, infrastructure operator, or responsible technology team can address it.
Cloud Computing Complicates Security Accountability
Cloud services introduce another layer of responsibility.
Organizations increasingly rely on Infrastructure-as-a-Service, Platform-as-a-Service, and Software-as-a-Service providers.
These services can offer strong security capabilities, but they do not eliminate organizational risk.
Cloud security generally operates through a shared responsibility model.
The provider and customer have different responsibilities depending on the service.
With IaaS, the provider typically secures the underlying physical infrastructure, while the customer retains significant responsibility for operating systems, applications, data, identity, and configurations.
With SaaS, the provider generally assumes more responsibility for the application and supporting infrastructure, while the customer continues managing areas such as user access, data handling, and configuration.
The precise responsibilities depend on the provider and service agreement.
This creates an important governance challenge.
An organization may require employees to follow strict password policies while having limited visibility into how a third-party provider manages vulnerabilities, privileged access, logging, or incident response.
The organization remains accountable for understanding those risks even when it does not directly operate the infrastructure.
A Compromised Provider Can Affect Many Customers
Commercial cloud platforms and SaaS applications frequently support numerous customers.
A security weakness in a shared service, identity component, software dependency, or management system can affect multiple organizations.
A customer can implement strong passwords, multi-factor authentication, and employee training without having direct control over the provider's underlying software or infrastructure.
That does not mean cloud services are inherently less secure.
Major providers often maintain security capabilities that smaller organizations would struggle to implement independently.
However, relying on a provider requires ongoing evaluation of security practices, contractual responsibilities, incident notification, and service dependencies.
Trusting a provider should not mean abandoning oversight.
Password Changes Do Not Prevent Every Identity Attack
Even when an attack involves identity rather than infrastructure, periodic password changes may not address the actual weakness.
Modern attackers may use:
-
Phishing
-
Credential theft
-
Session hijacking
-
Stolen authentication tokens
-
Malicious browser extensions
-
Compromised endpoints
-
Social engineering
-
Authentication fatigue
-
Insecure password recovery procedures
An attacker who steals an active session token may not need the user's password to access an application.
A phishing attack that captures credentials and authentication information in real time may succeed regardless of whether the password was created yesterday or three months earlier.
This is why identity security should include more than password complexity and expiration.
Organizations should consider phishing-resistant authentication, secure session management, device security, monitoring, and risk-based access controls.
Multi-Factor Authentication Is Important, but Not All MFA Is Equal
Multi-factor authentication adds an important layer of protection by requiring more than a password.
However, some authentication methods remain vulnerable to phishing, social engineering, or interception.
For example, an attacker may convince a user to approve an unexpected authentication request or enter a temporary code into a fraudulent website.
Phishing-resistant authentication methods, including properly implemented FIDO2 security keys and passkeys, can better protect against credential phishing.
Organizations should evaluate the authentication method rather than simply checking a box indicating that MFA is enabled.
Security should be based on control effectiveness, not merely their presence.
Zero Trust Addresses the Bigger Problem
Zero Trust provides a more comprehensive approach to cybersecurity.
Instead of assuming that a user, device, or application is trustworthy because it has already entered the network, Zero Trust requires access to be evaluated according to established policies.
NIST SP 800-207 emphasizes that trust should not be granted implicitly based on network location or asset ownership.
A Zero Trust architecture can incorporate:
-
Strong identity verification
-
Least-privilege access
-
Device security
-
Resource-level authorization
-
Network segmentation
-
Continuous monitoring
-
Policy-based access decisions
-
Protection of sensitive data
Under this model, a valid password does not automatically provide unrestricted access.
An authenticated user should receive only the permissions required to perform authorized work.
If an account or system is compromised, properly implemented controls can limit the attacker's ability to move through the environment.
Zero Trust does not eliminate the need for secure infrastructure, but it helps reduce the consequences when individual controls fail.
Security Accountability Must Extend Beyond Employees
Employees should protect credentials, recognize suspicious activity, and follow reasonable security policies.
However, leadership, technology teams, and service providers have responsibilities that employees cannot fulfill.
These include:
-
Maintaining supported systems
-
Applying security patches
-
Managing privileged accounts
-
Reviewing cloud configurations
-
Monitoring vulnerabilities
-
Protecting databases
-
Securing applications
-
Evaluating vendors
-
Testing backups
-
Maintaining incident response capabilities
A mature cybersecurity program should clearly assign these responsibilities.
It should also set measurable performance expectations.
For example, an organization can measure how quickly it remediates critical vulnerabilities rather than relying primarily on how often employees change passwords.
Are Organizations Measuring the Right Things?
Cybersecurity programs often emphasize controls that are easy to document.
An auditor can readily determine whether passwords expire every 90 days.
It may be more difficult to evaluate whether the organization can detect unauthorized activity, contain an incident, or recover a compromised system.
Meaningful security measurements should include:
-
Critical vulnerability remediation time
-
Percentage of supported and patched systems
-
Privileged account reviews
-
Multi-factor authentication coverage
-
Cloud configuration findings
-
Incident detection and response time
-
Backup restoration success
-
Third-party security assessments
-
Security logging coverage
-
Unresolved high-risk findings
These measurements help leadership understand whether the organization is actually reducing risk.
A password policy may demonstrate compliance with an internal procedure.
It does not necessarily demonstrate that the organization is secure.
Security Policies Should Evolve with the Threat Landscape
Cybersecurity requirements should not remain unchanged simply because they were adopted years ago.
Organizations should periodically review whether existing policies align with current standards, technology, and threats.
For password management, that may involve:
-
Eliminating unnecessary periodic expiration
-
Requiring adequate password length
-
Screening passwords against known compromised values
-
Supporting password managers
-
Implementing phishing-resistant authentication
-
Requiring changes when compromise is suspected or confirmed
-
Monitoring suspicious authentication activity
-
Removing unnecessary complexity requirements
Organizations must still evaluate applicable contractual, regulatory, and system-specific requirements before changing policies.
The objective is not to weaken security.
It is to replace ineffective or outdated controls with practices that provide meaningful protection.
Governance Is the Missing Connection
The central issue is not whether passwords matter.
They do.
The issue is whether organizations apply the same discipline to infrastructure security, application security, vendor oversight, and operational resilience as they do to end-user behavior.
Cybersecurity governance should establish:
-
Clear security ownership
-
Risk-based priorities
-
Documented policies
-
Configuration management
-
Vulnerability management
-
Change control
-
Quality assurance
-
Third-party oversight
-
Incident response procedures
-
Performance reporting
-
Executive accountability
Without governance, organizations may enforce highly visible employee requirements while leaving less visible technical weaknesses unresolved.
Security should be evaluated across the complete technology lifecycle.
How SingTone Technologies Can Help
SingTone Technologies helps government agencies and commercial organizations strengthen cybersecurity governance, modernize technology environments, and improve operational security practices.
Our capabilities include:
-
Cybersecurity governance
-
Policy and procedure development
-
Configuration management
-
IT modernization
-
Database administration
-
Project management
-
Quality assurance
-
Technical documentation
-
Risk-management support
-
Application development
-
Cloud and hosting solutions
-
Operational process improvement
We shall work with organizational stakeholders to evaluate technology requirements, document responsibilities, strengthen governance, and align security practices with operational risks.
Our approach emphasizes disciplined management, accountability, and continuous improvement rather than relying on individual controls as substitutes for comprehensive security.
Stop Treating Password Changes as the Measure of Security
Employees should use strong, unique passwords and appropriate authentication methods.
They should also understand how to recognize suspicious activity and protect sensitive information.
However, cybersecurity cannot stop at the login screen.
Changing a password does not fix a vulnerable application, secure a misconfigured cloud service, update an unsupported server, or correct excessive administrative privileges.
Organizations must recognize that some of the most consequential security weaknesses exist within systems and infrastructure that ordinary users cannot see or control.
The question should not be how often employees are required to change passwords. It should be whether the organization is adequately protecting the systems those passwords provide access to.
At SingTone Technologies, we believe effective cybersecurity requires shared accountability, risk-based governance, secure technology operations, and continuous improvement.
Protecting the user is important.
Protecting the environment the user depends on is equally essential.
Sources for the article: