Step 1 of 4: Stop Remembering Passwords. Start Managing Them.

Passwords protect your email, your bank, your accounting system, and your customer data, and most of them are weaker than their owners think. They fail in a few predictable ways: they get guessed, they get reused after someone else’s data breach, or they get handed to a criminal who asked nicely. That last one gets its own post in Step 3.

This series, Secure Your Business, One Step at a Time, covers four practical protections, and it starts with the tool that makes the rest easier: a password manager. Each step builds on the last, so none of them has to be a big project.

Don’t reuse passwords

Reusing a password turns one company’s data breach into a problem for every account you own. When a website is breached, attackers take the leaked email and password pairs and try them on banking, email, and business sites, because they know people recycle.

Using one password everywhere is like having one key that opens your house, your car, your office, and your safe. Lose it once and you have lost all four.

Businesses carry a second risk. An employee who reuses a work password on a personal site has tied the company’s accounts to a website the company has never heard of.

What makes a password strong

Length beats cleverness. A long passphrase is stronger than a short string of swapped-in symbols, and it is easier to type. A strong password is also unique to each account and random rather than personal. “Summer2026!” looks complicated, but it follows a pattern attackers try first.

Personal is the real trap, and Hollywood showed why thirty years ago. In Clear and Present Danger, Jack Ryan needs into the computer of Ritter, a senior CIA official, to prove a conspiracy. He stands there with a cup of coffee while an IT whiz tries birthdays, then combinations of birthdays. Ryan is already walking away when the whiz says he’s got it: the password was built from Ritter’s family birthdays. No hacking wizardry, just patient guessing from personal details.

That was 1994. Today those details are on social media, company websites, and in old breach data, and attackers have new help finding and using them. The FBI warns that criminals use generative AI to write believable messages faster, to remove the spelling and grammar slips that used to give scams away, and to clone voices for phone calls. The UK’s National Cyber Security Centre likewise assesses that AI gives attackers an advantage in researching targets and in social engineering, making both harder to detect. Security professionals call this approach social engineering: working on people instead of breaking technology. It also means the old advice to watch for bad grammar no longer protects you.

You do not need to become an expert to defend against it. A few habits go a long way:

• Never build a password from facts about you or your family.
• Treat any request for your password as a red flag, no matter who seems to be asking. Real IT staff do not need it.
• Verify unexpected requests by calling back on a number you already know.
• Think twice before posting birthdays, pet names, or the answers to security questions.
• Give your team a set way to verify identity before anyone resets a password.

How exposed your business is depends on who works there, what you store, and how you operate. If you want a second set of eyes on that, we are glad to talk.

Managing passwords: the wrong way and the right way

Nobody can remember dozens of long, unique passwords, which is how people end up with workarounds. The common ones are a spreadsheet, a notes file, sticky notes on the monitor, a shared document, or passwords saved in a browser on a shared computer. Each habit started with a good reason. None of them offers real encryption, access control, or a record of who saw what.

The better way is a password manager. It generates strong, unique passwords, stores them in an encrypted vault, and fills them in for you. You remember one strong passphrase, and the manager remembers the rest. It also fills a login only on the correct website, which quietly helps against look-alike pages.

Website password rules are a floor, not a goal. Most sites enforce a minimum, typically a capital letter, a number, a symbol, and a short length requirement. Those rules are often outdated. Current guidance from the National Institute of Standards and Technology (NIST), revised in 2025, tells organizations to require length (at least 15 characters for passwords used alone), to check new passwords against known-breached lists, and to stop forcing symbols and scheduled changes. Many sites have not caught up, so a password that merely passes the sign-up form can still be weak. Do not aim for the minimum. Let your manager generate something much longer than the site asks for, and use the longest password the site will accept.

Not every manager is equal. Look for strong encryption, multifactor protection on the vault itself, shared vaults and admin controls for teams, and a clear recovery process. Choosing one and rolling it out so people actually use it is where many businesses get stuck.

A password manager helps you run the business

A business-grade password manager is a continuity tool as much as a security tool. It gives you control that spreadsheets and sticky notes cannot:

• Shared vaults: teams share logins without pasting them into email or chat.
• Offboarding: when someone leaves, you remove their access in one place instead of changing every password and hoping you caught them all.
• Visibility: administrators can see weak or reused passwords and who has access to what.
• Continuity: critical credentials get an owner and an emergency-access plan, which ties directly to our article on why businesses should own their IT documentation.

One action for this week

Pick a password manager, set a strong passphrase for it, and move your most important accounts first: email, banking, your domain registrar, and any admin portals. Do not try to do everything in one sitting. That is how people quit.

If you would rather not figure it out alone, Wolverstone Solutions can help you choose a manager and set it up so your whole team uses it. Get in touch and we will walk through it with you.

Next in the series: Step 2 adds the second lock, multifactor authentication, and looks at where passkeys fit.