Most security incidents an SME runs into aren't the result of a sophisticated, targeted attack — they're a simple, repeatedly reused password that leaked somewhere else once, and that an automated script simply tries on your systems too. Password management is the area where the smallest, cheapest investment eliminates the biggest, most easily avoidable risk.

Why the "strong password" rule isn't enough

Most companies' security policy stops at "have a strong password" — uppercase, number, special character. This rule alone isn't enough, because the real risk rarely comes from someone guessing a password — it far more often comes from the same password being used in multiple places. If an employee uses the same password on an external, less secure service as on company systems, and that external service suffers a data breach, the leaked password can immediately be tried on company systems too — this kind of attack, called credential reuse, is one of the most common entry points companies run into.

This realization is why password management shouldn't be a matter of individual discipline — it should be a system-level solution. A company password manager that gives every employee a unique, strong, automatically generated password for every service, and stores them securely, practically eliminates the risk from reuse — without anyone needing to remember a dozen complex passwords.

Two-factor authentication — the one protection that still works even if the password leaks

Two-factor or multi-factor authentication (MFA) means that alongside the password, a second, separate element is also needed to log in — typically a code sent to a phone, or an authenticator app. Its strength is that even if a password leaks or is guessed, the attacker still can't log in, because they don't have access to the second factor. This is the one, relatively simple-to-introduce measure that in practice stops the vast majority of attacks, even if every other line of defense were breached.

The most common objection heard at rollout is that "this slows down work" — in reality, modern MFA solutions (approving a notification on your phone) take a few seconds, negligible compared to the risk it eliminates. For administrative access — where the most damage can be done with a single successful login — introducing MFA shouldn't be optional, it should be a baseline requirement.

What most SMEs skip: the audit and offboarding

The third, least visible but critical element of password management is a regular audit: do you know exactly who has access to which system, and is there any access that should have been revoked long ago? This matters especially when an employee leaves — if access revocation isn't automatic, and instead requires someone to remember it, an account no one is officially responsible for anymore, but that anyone who knows the password can still use, can stay open for weeks or months.

Most security incidents aren't the result of a sophisticated attack — they're a forgotten, reused password, or an access no one ever revoked.

Getting started in practice is simple: introduce a company password manager, turn on two-factor authentication everywhere it's available — starting with the administrative, highest-risk access — and set up a regular, even just twice-a-year review of who has what access. These three steps, none of which require serious technical expertise, eliminate a significant share of security risk at most SMEs.

If you'd like to get your company's password and access management in order, let's review together where the biggest, most easily eliminated risk is.