Reviewed and updated: August 2026
Somewhere in your office, possibly on your desk right now, there is a sticky note. On it is a password.
Perhaps it is based on the current season, the name of your business and the year. Every three months, someone changes the number at the end because the IT policy says they have to.
That habit is not keeping the organisation safe.
In many cases, it is encouraging people to create predictable passwords while giving the business a false sense of security.
Routine 90-day password changes are no longer recommended by the National Cyber Security Centre or Cyber Essentials. Current guidance focuses instead on unique passwords, secure password storage, multi-factor authentication and, where they are available, passkeys.
Here is what businesses should now be doing.
The 90-day password myth
The 90-day password rule came from a reasonable concern: if someone obtained your password, a forced expiry would eventually lock them out.
On paper, that made sense, but the problem is what happens in the real world.
When people are forced to change passwords regularly, they rarely create a completely new and random one. They make a small, predictable change.
They add a number.
They change the season.
They capitalise the first letter.
They add an exclamation mark because the system insists on a special character.
An attacker who has obtained an old password will expect this. Password-cracking tools are designed to test common substitutions, keyboard patterns and incremental changes.
Changing Summer26! to Autumn26! may satisfy the policy, but it does not create a meaningful new barrier.
The NCSC has advised organisations not to force routine password expiry for several years. The current Cyber Essentials requirements also say organisations should not enforce regular password expiry or arbitrary complexity rules. Passwords should instead be changed promptly when an account or password is known or suspected to have been compromised.
What current password guidance looks like
There is no single security control that fixes every password problem.
The aim should be to reduce how often people need to create and remember passwords, make the remaining passwords unique and protect important accounts with stronger authentication.
Use a passkey where one is available
Passwords are no longer always the best option.
In April 2026, the NCSC began recommending passkeys where a service supports them.
A passkey uses cryptography rather than a secret that you type into a website. Your device confirms that it is you using its normal unlock method, such as a fingerprint, face check or PIN.
The important difference is that the passkey is tied to the legitimate website or application. It cannot simply be typed into a convincing imitation login page.
That makes correctly implemented passkeys resistant to the phishing attacks used to steal passwords and traditional MFA codes.
The NCSC assesses that FIDO2 credentials, including passkeys, are as secure as or more secure than traditional MFA against common credential attacks seen in practice.
Where a service offers a passkey, it should now be considered before relying on a password and a one-time code.
For business use, the rollout still needs to be managed properly. You should decide:
- which devices can hold business passkeys
- how access is recovered if a device is lost
- how credentials are removed when someone leaves
- whether personal credential-sync accounts can be used
- which authentication methods remain available as a fallback
Passkeys are an improvement, but they still depend on the security of the device and the account used to manage or synchronise them.
Use three genuinely random words when a password is still needed
Not every system supports passkeys yet. Where a password is still required, the NCSC recommends combining three random words. This produces something longer and easier to remember than a short password filled with predictable substitutions.
The word random matters.
Do not use three words that someone could easily associate with you, your family, your organisation or your location.
For example:
Chesterfield-Football-School
may be long, but it is not particularly random for someone who works with schools in Chesterfield and regularly talks about football.
A better approach would be three unrelated words selected at random, such as:
Lantern-Tulip-Kettle
Add a number or symbol only when the system requires one. Length and unpredictability matter more than turning an a into @ or adding an exclamation mark to the end.
For accounts managed through a password manager, there is usually no need to create a memorable password at all. Let the password manager generate a long, random one.
Use a different password for every account
Password reuse is one of the quickest ways for a breach at one company to become your problem.
When usernames and passwords are stolen from one service, criminals test the same combinations against other services. This is known as credential stuffing.
They may try:
- Microsoft 365
- Google Workspace
- remote-access portals
- accounting software
- supplier systems
- social media
- online banking
If the password is unique, the damage is contained to the original account.
If it has been reused, one breach may provide access to several parts of the organisation.
Nobody can realistically remember a different strong password for every system they use. That is why secure password storage is essential rather than optional.
Change passwords when there is a reason
A strong, unique password does not need changing simply because it has reached its 90th birthday.
It should be changed when:
- the service reports a breach
- the password appears in a known breach
- you suspect it has been disclosed
- someone has entered it into a phishing page
- malware may have infected the device
- the password was shared with someone who no longer needs it
- an employee or supplier with access has left
- the password is weak, predictable or reused elsewhere
- a default password is still being used
After a suspected compromise, changing the password may not be enough.
You may also need to:
- sign out existing sessions
- revoke active tokens
- review registered MFA methods
- check account-recovery details
- remove unknown devices
- examine email-forwarding and inbox rules
- investigate the device for malware
If an attacker has stolen an active session cookie, they may be able to continue using an account without entering the new password or completing MFA again.
Enable multi-factor authentication
Where passkeys are not available, multi-factor authentication remains one of the most effective ways to protect an account.
MFA requires an additional form of verification alongside the password. This could involve:
- an authenticator application
- a managed device
- a physical security key
- a trusted account
- a one-time code
- a push notification
Not every form of MFA provides the same protection.
Text messages and simple push approvals are better than relying on a password alone, but they are not as resistant to phishing as FIDO2 security keys and passkeys. Traditional MFA codes and approvals can still be intercepted, relayed or approved accidentally.
Prioritise stronger authentication for:
- cloud storage
- accounting and payroll systems
- domain and website administration
- remote-access tools
- backup platforms
- password managers
- administrative accounts
- any system holding customer, staff or safeguarding information
MFA should not be treated as a premium extra. It is a basic control for accounts that matter.
Is it safe to store passwords in your browser?
Modern browsers such as Chrome, Edge, Safari and Firefox can generate, store and autofill passwords.
The NCSC says it is safe to use a browser or device password manager on your own trusted devices. It is certainly better than reusing the same password, keeping passwords in an unprotected spreadsheet or choosing something simple enough to remember.
Autofill can also help protect against conventional phishing. A password manager should recognise that an imitation website has a different address and refuse to enter the saved password automatically.
Browser password storage is therefore not automatically bad practice.
However, the security of those passwords depends heavily on the security of:
- the device
- the user’s device account
- the browser profile
- the browser-sync account
- the operating system
- any extensions installed in the browser
Passwords should never be saved on a public computer or inside a browser profile shared between several people.
For organisations, there is also a difference between something being technically secure and something being manageable.
A business needs to know who can access each account, how credentials are shared, what happens when somebody leaves and whether access can be audited.
That is where a dedicated business password manager may offer significant advantages.
Browser password manager or dedicated password manager?
For an individual using their own supported device, a built-in browser or device password manager may be perfectly reasonable.
For a business, a centrally managed password manager can provide additional controls such as:
- organisation-owned vaults
- secure sharing without revealing the password
- access based on job role
- audit logs
- password-health reports
- breached-password alerts
- controlled account recovery
- removal of access when someone leaves
- emergency-access arrangements
- support across different browsers and devices
Options include Bitwarden, Keeper and other established business password-management platforms.
Black Swan Cyber supplies Keeper, but the right product depends on the organisation’s requirements. The important questions are not simply which logo is on the product.
You should consider:
- where the vault data is stored
- how the vault is encrypted
- how administrators are protected
- what recovery options exist
- whether MFA or passkeys can protect the vault
- how access is removed during offboarding
- whether personal and business credentials are separated
- what auditing and reporting are available
The best password manager is one that people will actually use and that the organisation can administer properly.
What about infostealer malware?
Infostealers are malicious programs designed to collect valuable information from an infected device.
Depending on the malware and the access it gains, this may include:
- saved usernames and passwords
- session cookies
- authentication tokens
- autofill information
- cryptocurrency-wallet data
- documents
- email and cloud credentials
Modern infostealers may target browser password vaults as well as third-party password managers. Some also capture passwords as they are typed.
This is why the answer cannot simply be: Browser bad. Separate password manager good.
If malicious software is running successfully on the device, every authentication method used on that device may be at risk.
The NCSC says credential-stealing malware affecting Windows and macOS devices is increasing in both volume and sophistication. Common stealers may record typed passwords, take session cookies and attempt to access both browser and third-party credential vaults.
A password manager remains useful, but it needs to sit alongside:
- supported and updated devices
- prompt security patching
- endpoint protection
- endpoint detection and response
- web and DNS filtering
- controlled software installation
- restricted administrative privileges
- monitoring for suspicious account activity
Password security is not just a password-policy problem. It is also a device-security problem.
How this connects to Cyber Essentials
Cyber Essentials is the UK government-backed certification scheme designed to protect organisations against common cyber attacks.
The current Cyber Essentials Requirements for IT Infrastructure version 3.3 applies to assessment accounts created after 27 April 2026.
Under the current requirements:
- default and guessable credentials must be changed
- users must have unique credentials
- MFA must be implemented where it is available
- authentication to cloud services must use MFA
- password guessing must be controlled through MFA, throttling or lockout
- routine password expiry should not be enforced
- arbitrary password-complexity rules should not be enforced
- passwords must be changed promptly when compromise is known or suspected
- users must be given a usable and secure way to store passwords
Where password-based authentication is used, Cyber Essentials requires technical controls to manage password quality.
This must include one of the following:
- multi-factor authentication
- a minimum password length of at least 12 characters, with no maximum-length restriction
- a minimum password length of at least eight characters, with no maximum-length restriction, combined with automatic blocking of common passwords
Where a password forms part of an MFA login, it must be at least eight characters long with no maximum-length restriction.
Cyber Essentials does not ban browser password managers and it does not require every business to buy a particular password-management product.
It expects the organisation to take control of authentication, protect accounts against common attacks and give people a practical way to use unique passwords.
A policy that bans browser storage without providing a workable alternative may simply push people back towards sticky notes, predictable passwords and password reuse.
What about SMB1001?
SMB1001:2026 is a multi-tiered cyber security standard designed for small and medium-sized organisations.
It provides a progression through five levels:
- Bronze
- Silver
- Gold
- Platinum
- Diamond
The standard covers a broader range of areas as organisations move through the levels, including technology management, access management, backup and recovery, policies and staff education.
SMB1001 has been mapped against other standards and frameworks, including Cyber Essentials. However, mapping does not mean the standards are identical.
Each scheme has its own:
- control wording
- scope
- evidence requirements
- assessment method
- certification process
A business should not assume that passing Cyber Essentials automatically satisfies SMB1001, or that an SMB1001 control can simply be copied into a Cyber Essentials password policy.
Organisations pursuing SMB1001 should work from the current edition and the requirements for their intended certification level.
A practical password-security checklist
For a business that wants to improve account security without creating unnecessary complexity, this is a sensible place to start.
1. Stop routine 90-day password changes
Change passwords when they are weak, reused, disclosed or suspected to have been compromised.
Do not change them simply because an arbitrary number of days has passed.
2. Adopt passkeys where they are available
Start with important services such as email, cloud platforms and administrator accounts.
Make sure recovery and offboarding are considered before a business-wide rollout.
3. Use unique passwords everywhere else
Use a password manager to generate long, random passwords that do not need to be remembered.
For the small number of passwords people must remember, use three genuinely random words.
4. Enable MFA
Use MFA on every important account that supports it.
Where there is a choice, prefer passkeys or FIDO2 security keys over text messages, one-time codes and simple push approvals.
5. Provide secure password storage
A browser password manager may be suitable on a properly managed individual device.
A dedicated business password manager may be more appropriate where central control, secure sharing, auditing and offboarding are required.
6. Protect the device
Keep devices and browsers updated.
Control browser extensions.
Restrict local administrator rights.
Use suitable endpoint protection and monitoring.
A secure vault cannot compensate for a badly compromised device.
7. Prepare for compromised accounts
Have a process for:
- changing the password
- revoking sessions and tokens
- resetting MFA
- reviewing recovery information
- checking email rules
- investigating the affected device
- documenting what happened
8. Review Cyber Essentials readiness
Check whether your password, MFA and cloud-service settings meet the current version 3.3 requirements rather than relying on an old policy template.
Better guidance creates better behaviour
The sticky note on the desk is not necessarily a character flaw. It is often the natural result of years of impractical advice.
People were told to create complicated passwords, never write them down, remember a different one for every account and change them all every 90 days.
That was never going to work and better guidance now exists.
Use passkeys where they are supported.
Use unique passwords where they are not.
Give people somewhere secure to store them.
Protect important accounts with MFA.
Secure and monitor the devices those accounts are accessed from.
And stop forcing password changes that make the number at the end go up without making the organisation any safer.
Cyber security does not have to mean buying everything or changing everything at once.
But you do have to start somewhere.
If you are unsure whether your current password and MFA policies meet the latest Cyber Essentials requirements, Black Swan Cyber Security Solutions offers practical, plain-English support to help you understand where you stand and what needs to change.
