Secure Credentials Help Keep Threat Actors Out

Passwords are one of the most familiar aspects of cybersecurity — and they are as important today as ever because password use at organizations has become increasingly complicated. Employees move between numerous applications during a normal workday, and each app may have its own password and login that connects to cloud platforms, business systems, shared information, or other parts of the organization. 

Organizations should regularly remind employees to create strong passwords that follow Cybersecurity and Infrastructure Security Agency guidelines. Passwords should be 16 or more characters in length, unique with each password used for only one account, and random with a combination of unrelated words or phrases or a random string of letters, numbers, and symbols. In addition, employees should implement multifactor authentication (MFA) as an added layer of protection. 

Employees should follow the password guidelines because passwords are a valuable, sought-after asset for threat actors. A strong password acts as a first line of defense to protect an organization's sensitive personal information and financial data. Once threat actors have an employee's username, password, and MFA, they can readily infiltrate a network and move freely as the actual user. Employees need to stay vigilant about securing their credentials to keep the organization's network safe, and taking a few specific actions can increase the probability of success.

Authentication has become commonplace

Most employees log in to applications so frequently that the process is a routine activity. Typically, an authentication request appears, the employee approves it, and work continues without a second thought. But threat actors count on employees' routine behaviors and take advantage of the situations. 

In a threat actor's attempt to steal credentials, an employee may receive a password prompt or an MFA request that he or she didn't request, and the safest response is to immediately stop. An alert employee who briefly pauses to consider the request and report it, rather than simply providing the requested information, can prevent stolen credentials from becoming authenticated access. Organizations should establish clear policies that tell employees how to immediately report a suspicious authentication request.

Access accumulates over time

Identity risk grows as organizations grow. Over time, employees move between roles, projects end, new applications are introduced, and old responsibilities disappear. However, access often remains long after the employees need it. For example, someone who needed a particular system two years ago but no longer needs it may still have permission to use it today, a freelance contractor account may remain active long after the project is completed, or a shared app may retain connections that nobody actively uses anymore. Such situations can quietly increase the probability of a compromised account.

As responsibilities change, security should change with them. Employees know when their access requirements have changed, and they can help reduce the cyber risk by letting the security team know that a specific access is no longer required.

The apps that employees connect can matter too

Modern work relies heavily on connected applications. In fact, the average company runs a record-high 101 software apps, and large enterprises run nearly 660 apps, according to Okta's Businesses at Work 2025. For example, an employee may give a new platform permission to view a calendar, access documents, or interact with other business systems. That access can be useful and completely legitimate, but it can also remain in place long after the app is no longer in use.

As Pondurance experts discuss in How AI Is Changing the Cyber Threat Landscape — and What To Do About It, cloud access and identity controls are increasingly important areas for organizations to understand as threat actors look for new ways to use legitimate accounts.

Organizations should implement a clear process for introducing new apps, so employees know when to involve the security or IT team.

Unusual behaviors may surface after a compromise

Threat actors who gain control of a legitimate account may be able to blend into ordinary activity, but eventually, the security team or an employee may see evidence of unusual behavior that throws up a red flag. For instance, an IT team with visibility may notice that an account suddenly behaves differently, or an employee may receive a login notification from an unfamiliar account, get a password reset message that arrives unexpectedly, or discover a new application connection he or she never approved. Unusual account activity is always worth reporting, even when nothing else appears to be wrong.

Strong security allows room for mistakes

No authentication process is perfect. Threat actors are constantly finding new ways into employee accounts, and employees make mistakes, like reusing passwords or approving malicious prompts. In fact, 62% of breaches in 2025 involved a nonintentional human element, according to Verizon's 2026 Data Breach Investigations Report. Knowing this, a strong security program assumes bad things will happen but limits what happens afterward.

Employees can support the security effort by treating authentication requests carefully and speaking up when access no longer makes sense. Security teams can reinforce those behaviors by limiting unnecessary privileges and maintaining enough visibility to recognize suspicious account activity. Together, those layers make a compromised password far less useful to a threat actor.

Cybersecurity Awareness Month is the ideal time for organizations to make employees aware of ways they can make the cybersecurity program stronger. This week, organizations should ask employees to take actions that make it harder for threat actors to succeed, including reviewing the applications and access they regularly use and flagging anything they no longer recognize or need.

Organizations need to protect the credentials they depend on

Nearly every part of the modern workplace requires credentials, which means organizations need visibility into what happens before and after an employee logs in with a username, password, and MFA. Pondurance helps organizations identify suspicious activity, investigate potential threats, manage cyber risk, and strengthen protection across the environment.

Explore Pondurance and learn how organizations can build stronger cybersecurity around their employees and the networks they rely on.