Most data breaches start with a stolen password. Here's how to fix that

Employees reuse old passwords, share credentials, and rely on browser autofill when organizations lack password infrastructure. Stolen credentials are involved in about 80% of web application breaches and are the most common initial attack vector across industries. Breaches often appear as normal logins: a reused password leaks in a consumer breach, attackers test it against company systems, and access succeeds. The solution is not better password advice, but systems that make strong, unique credentials the default and reduce shortcuts. Business password managers help, but encryption evaluation can miss a metadata gap. Vault contents may be encrypted while item titles, URLs, email addresses, and access timestamps remain exposed, creating risk.

"Somewhere in your organisation right now, an employee is reusing a password they created in 2019. Another is sharing login credentials for a team account through a Slack DM. A third is storing client portal access in a browser's built-in autofill, synced to a personal Google account your IT team does not control. None of these people are careless. They are simply doing what most workers do when their company has no password infrastructure."

"According to Verizon's 2024 Data Breach Investigations Report, stolen credentials were involved in roughly 80 per cent of web application breaches and remain the single most common initial attack vector across all industries. The pattern is consistent year after year: an employee reuses a password, that password appears in a consumer data breach, an attacker tests it against the company's systems, and the door opens. The breach rarely looks dramatic. It looks like a normal login."

"The fix is not telling people to choose better passwords. The fix is giving them a system that makes strong, unique credentials the default and removes the temptation to cut corners. That is what business password managers are designed to do. But most of them share a blind spot that matters more than their marketing suggests."

"When you evaluate a password manager, the first thing you check is encryption. Every serious product uses AES-256. Every serious product claims zero-knowledge architecture. But encryption scope varies more than most buyers realise, and the difference has real consequences. Standard password managers encrypt the contents of your vault: the passwords, secure notes, and credit card numbers you store. What they often leave unprotected is the metadata surrounding those items. Item titles, associated URLs, email addresses, and access timestamps may sit on the provider's"

Read at TNW | Offers