Passwords, Old Accounts and the Access People Forget

Most employees use passwords every day, but they don't always think much about them until something goes wrong.

A reused password, an account left active after someone leaves, or a forgotten subscription can create opportunities for cyber criminals.

It's tempting to think that regularly changing passwords is the best way to stay protected. However, good password security involves much more than updating login details every few months.

The real priority is making sure accounts are protected, access is controlled, and old credentials aren't creating unnecessary risks.

For businesses, a few practical changes can make a noticeable difference without adding complicated security procedures.

Why reusing passwords puts multiple accounts at risk

Using the same password across different services might seem convenient, especially when employees manage several accounts throughout the day.

But it can create a serious security weakness.

Imagine an employee uses the same password for their work email and an unrelated online service.

If that service is breached, criminals might steal the employee's login details and try to use them elsewhere.

This technique is known as credential stuffing.

Attackers use automated tools to test exposed usernames and passwords against other platforms, including email services, cloud storage, and business applications.

A single exposed password can therefore put several accounts at risk.

The simplest way to reduce this danger is to use a different password for every account.

A password manager can make this easier by generating and securely storing unique passwords, so employees don't have to remember dozens of login details.

The UK's National Cyber Security Centre (NCSC) recommends using strong, unique passwords and additional security measures to protect important accounts.

Add another layer of protection with MFA

Passwords remain important, but they shouldn't always be the only thing protecting sensitive business information.

Multi-factor authentication (MFA) adds another security check when someone signs in.

For example, after entering a password, an employee might need to approve a request through an authentication app or use a security key.

This makes it harder for criminals to access an account using a stolen password alone.

MFA is particularly valuable for accounts that provide access to sensitive information, such as:

• Business email: Protects communication and accounts used for password resets.
• Financial systems: Protects banking and accounting platforms.
• Cloud storage: Helps secure important business documents and shared files.
• Administrative accounts: Reduces the risk of unauthorised changes to business systems.

Where possible, businesses should choose phishing-resistant authentication methods, such as passkeys or security keys.

Employees should also understand that unexpected authentication requests can be warning signs.

If someone receives a login approval notification they didn't initiate, they should reject it and report the activity.

Do passwords really need changing every few months?

Many businesses have traditionally required employees to change their passwords every 30, 60, or 90 days.

The intention is understandable. Regular changes might seem like an easy way to reduce security risks.

However, forcing frequent password changes can sometimes create more problems than it solves.

Employees may respond by choosing predictable variations of their existing passwords or using simpler combinations that are easier to remember.

For example, someone might change a password by adding a new number or updating the month.

These changes don't necessarily provide meaningful protection.

The UK National Cyber Security Centre's password guidance advises organisations against enforcing routine password expiry without a specific reason.

Instead, change passwords when there is evidence or suspicion they have been compromised.

It's also worth replacing passwords that are reused across multiple accounts.

The goal should be stronger passwords and safer account access, not simply more frequent password changes.

Forgotten accounts can create hidden security risks

Passwords aren't the only things businesses need to review.

Old user accounts, forgotten subscriptions, and unused software can also create unnecessary security risks.

Consider what happens when someone leaves a business.

Their email account might be deactivated, but they could still have access to a separate cloud platform, project management tool, or shared service.

Similarly, a business might stop using an application without removing accounts or reviewing the information stored within it.

These overlooked accounts can remain active long after they're needed.

If login details are exposed or access permissions are misused, they may provide another route into business systems.

This is why account management should be part of everyday cyber security.

Businesses should know which services they use, who has access, and whether that access is still necessary.

Regular reviews can help identify accounts that need updating, restricting, or closing.

Make account reviews part of your routine

Keeping business accounts secure doesn't have to be complicated.

A straightforward review can help identify potential problems before they become more serious.

Start with your most important business systems, including email, cloud storage, finance platforms, and applications used across departments.

Then consider a few practical questions:

• Who has access? Check that current employees have the permissions they need for their roles.
• Are former employees still listed? Remove access that is no longer required after staff changes.
• Which services are still being used? Identify forgotten applications and subscriptions.
• Where is important information stored? Make sure business data is retained or transferred appropriately before closing accounts.
• Are security settings consistent? Check whether MFA and other access controls are enabled where appropriate.

Don't delete accounts or close services without checking what they contain.

Some accounts may hold important documents, customer records, or information needed for business continuity.

Review ownership and data storage first to prevent accidental loss.

Account checks are particularly useful when employees join, change roles, or leave the organisation.

Making these reviews part of normal business processes can reduce unnecessary access without creating additional work.

Build better security habits across your business

Good password security isn't about asking employees to remember increasingly complicated combinations.

It's about making safer choices easier.

Unique passwords reduce the risk of credential theft. Password managers make those passwords easier to manage, while MFA provides an additional layer of protection.

Regular account reviews help ensure that access remains appropriate as employees, applications, and business requirements change.

These steps work best when everyone understands their responsibilities.

For a helpful overview of how to strengthen everyday account protection, explore these practical ways to build safer password and login habits and make security easier for everyone across your business.

Take control of your business account security

A forgotten account or reused password might seem like a small issue, but it can create unnecessary risks for your business.

At Jedi Services, we help UK SMEs strengthen cyber security, manage IT systems, and maintain better control over their business technology.

Not sure whether your passwords and account access are properly managed? Contact Jedi Services to discuss practical ways to improve account security and reduce avoidable risks.

You can also explore our managed IT and cyber security services or visit Jedi Services for more insights into protecting your business.