Every year a keynote declares the password dead, and every year your team still manages a couple hundred of them. Passkeys are genuinely coming, and we deploy them wherever they exist. Meanwhile there is a spreadsheet named passwords-FINAL-v2.xlsx on a shared drive, and security has to work in the present tense.
Why reuse is the killer
Credential stuffing is grimly simple: attackers take the billions of passwords leaked from other people’s breaches and replay them against your systems, automated, around the clock. It works because humans reuse. The password your office manager set for a conference-swag site in 2021 is the same one on your invoicing portal today, and the swag site got popped. No malware, no zero-day, just a login that looked legitimate because it was.
The fix costs less than lunch
A password manager for every employee, mandated, paid, and trained in one thirty-minute session. Generated unique passwords for every service, so a breach elsewhere is a dead end instead of a master key. Shared vaults to kill the spreadsheet, with access that follows roles and revokes on departure day. MFA layered on top, because defense should never be one factor deep. The whole program costs a few dollars per seat per month, which makes it the highest-return security spend most small businesses will ever approve.
The transition strategy
Adopt passkeys as vendors ship them; they are phishing-proof and users genuinely like them once enrolled. Prioritize them for email, identity, and finance. But run the password program as if passkeys were a decade away, because for your long tail of vendor portals and industry tools, they might be. The two systems coexist fine, and the manager holds the passkeys metadata too.
Unique everywhere, stored properly, MFA on top. Do those three and you exit the demographic that appears in breach write-ups under the phrase reused credentials.
Passwords, handled properly
The standards agree with the boring plan: NIST’s digital identity guidelines favor long unique secrets, managers, and MFA over complexity theater and forced rotation. Our rollout — documented step by step in the password manager guide — takes one training session and a few dollars a seat, and it removes the single most common way small businesses end up in breach write-ups.
Unique everywhere, stored properly, MFA on top. Then adopt passkeys as fast as your vendors ship them.
