How to set secure passwords in the company and avoid trouble

Blog Tips and Advice

26. 05. 2026

Kateřina Mrenová

Passwords are still the most common way to protect corporate email, cloud access, website administration, or internal systems. If you don't want a single data breach to jeopardize the entire company, you have probably heard something about password security and come across terms like strong password, password manager, multi-factor authentication (MFA), or passkeys. In this article, we will clearly explain when to use which type of security and how to set simple rules for cybersecurity.

We write about:

why the biggest risk is not a "weak password," but the repetition of access credentials,
what a strong password looks like in practice (and what is just unnecessary gymnastics),
when it makes sense to use a password manager,
why two-factor/multi-factor authentication (2FA/MFA) is the second lock that often makes the difference,
what passkeys are and why it's worth knowing about them,
what to do if you suspect a leak or phishing.

A password is a key – the problem arises when you use it to unlock everything

Imagine having one key for your office, car, warehouse, and home. Convenient? Yes. Safe? Only until someone copies that key or you lose it.

It's the same with passwords. Most problems do not arise from someone "breaking" your super complex password. More often, it's a combination of two things: a password leaks from one service and you use it (even in a slightly modified form) elsewhere. An attacker then just tries to see where they can access with those same credentials.

A strong password is not a cipher. Length and uniqueness matter

Letters, numbers, exclamation marks. It sounds "secure," right? However, a complex password has one weakness: it's hard to remember. So you write the password on a note, save it in your notes, or create one favorite base and just modify it according to where you are logging in.

If you want a password that is secure and memorable, opt for a passphrase. Feel free to use multiple words in a row. Choose a combination that only you can recall, but that won't make sense to anyone else.

You can recognize a truly strong password by two things:

1) It is long. The longer it is, the harder it is to guess or crack.
2) It is for one account. One password = one door. Once you use the same password in multiple places, one leak is enough for the problem to spread further.

And now, what people often overlook: tricks like “a→4, o→0” or mandatory “must contain a capital letter and a special character” are not a magical protection. Attackers account for these patterns. They are more of a minor addition — not a foundation.

Two-factor authentication (MFA) is the second lock that turns a regular password into strong account protection

Even if you have passwords sorted out, the rule still applies: a password is "something that can be obtained" — for example, through phishing. Therefore, it makes sense to use two-factor authentication (2FA) or generally multi-factor authentication (MFA).

The principle is simple: to successfully log in, it is not enough to just have a password; a second step is required — confirmation in an app, biometrics, or a security key. This means that even if someone has your password, they cannot log in without the second factor.

If you want to choose "one place" where MFA absolutely must be implemented, it is:

corporate email (the most common entry point),
website administration / CMS,
cloud services and shared drives,
accounts with access to billing and payment methods.

Phishing is a scam in which someone tries to extract your login credentials (or even your card number) by pretending to be a trustworthy service.

It typically looks like this:

you receive an email or SMS stating: "Your account is at risk of being blocked," "unpaid invoice," "package delivery,"
you click on a link that leads to a fake login page,
you enter your password – and the attacker gains access to it.

Signs to recognize: pressure for quick action, suspicious sender/link address, minor text errors, logging in "again" without a clear reason.

Passkeys: passwordless login that is fast and resistant to phishing

You may have seen the option to "log in with passkey" on some services. Passkeys are a modern authentication method designed to minimize the most common password problem – accidentally entering it where it doesn't belong.

Passkeys work by confirming your login in a way similar to unlocking your phone (fingerprint, face, PIN) instead of typing a password. This makes logging in significantly more resistant to phishing than traditional password entry.

When to change passwords and what to do if you suspect a breach

With passwords, it's important not to engage in rituals. The regular "change your password every 30 days" often leads to people simply adding a one at the end and calling it done. That’s not securing the account; it’s fatigue.

Changing passwords makes sense mainly when:

you suspect a compromise (suspicious login, service alert),
there has been a data breach,
someone entered the password on a suspicious site,
credentials were shared and someone is leaving the team.

When something "smells," act quickly but calmly:

change the password for that account (and everywhere it was the same),
log out active sessions/devices,
enable or tighten MFA,
check security settings (e.g., email forwarding, connected apps),
don’t view it as an individual failure. It’s an incident — and it should have a clear process to prevent recurrence.

Mini checklist for secure passwords in the company

If you want to set up account security to last even after six months, follow these points:

Unique password for each account (without exceptions).
Password manager as standard (not a "recommendation").
MFA everywhere possible — especially for email, cloud, and admins.
Clear rule for shared access (ideally no shared passwords, but roles and access).
Onboarding/offboarding process: when someone joins or leaves, access is handled systematically.