My staff reuse passwords: how to fix it this week
⏱ In about 12 minutes
Affiliate disclosure: Some links on this page may become affiliate links. If you buy, we may earn a commission at no extra cost to you. It doesn't change what we recommend. Read the full disclosure.
In this article
The short answer
Short answer
If your staff reuse passwords, a single leaked password can open your email, your accounting software and your customer data. That makes it a business risk, not a quirk of IT.
The fix is a business password manager plus multi-factor authentication (MFA). Give every person their own vault, share logins through shared vaults instead of spreadsheets or group chats, and remove access the day someone leaves. Most teams can get the basics done in a week without hiring anyone.
Why this matters more than it looks
One password, many doors
Reuse works like this. A password leaks from one service: a supplier portal, an old newsletter account, a personal shopping site. Attackers then try that same email-and-password pair on other services. If it was reused, they get in.
The UK's National Cyber Security Centre puts it plainly: "if you use the same password across different accounts and one of your accounts is compromised, a hacker can try the same password on your other accounts and potentially gain access to them too." (NCSC)
The Australian Cyber Security Centre (ACSC) says it directly about small businesses: "Weak or reused passwords are a common cause of cyber security incidents in small businesses." (ACSC, Small business cyber security handbook: securing accounts and identities)
Stolen logins are traded, not just guessed
The ACSC's latest annual threat report says cybercriminals are "continuing their aggressive campaign of credential theft, purchasing stolen usernames and passwords from the dark web to access personal email, social media or financial accounts." (ACSC Annual Cyber Threat Report 2024–25)
So you don't have to be singled out. If a reused password is already on a list somewhere, your business can be reached simply because that list is being worked through.
Email is the account that unlocks the rest
According to the same report, the top two cybercrimes businesses reported to the ACSC in 2024–25 were email compromise (19% of business reports) and business email compromise fraud resulting in financial loss (15%). (ACSC Annual Cyber Threat Report 2024–25)
Your email inbox is usually where password resets land. Once someone controls it, the rest of your accounts are a few clicks away.
Small doesn't mean safe
The UK NCSC's guidance for small organisations says that small businesses "are just as likely to experience online crime as larger ones." (NCSC Small organisations guide)
The cost of doing nothing vs the cost of fixing it
Doing nothing feels free because the bill hasn't arrived. Here is the comparison as plainly as we can make it, using only published figures.
| Factor | Cost of doing nothing | Cost of fixing it |
|---|---|---|
| Money | The ACSC reports the average self-reported cost of cybercrime per report for a small business was A$56,600 in 2024–25 (A$97,200 for medium businesses). These are averages across reports, not a prediction for any one business. (ACSC Annual Cyber Threat Report 2024–25) | A business password manager is a per-user subscription. For example, at the time of checking, one vendor's small-team pack was listed at US$24.95 per month billed annually (US$299.40 a year) for up to 10 members. (1Password business pricing, checked 18 Oct 2026. Confirm current price and currency at checkout.) |
| Time | Hours or days spent on recovery: resetting accounts, contacting customers and suppliers, dealing with your bank, and getting staff back to work. | One setup session, then a short rollout to staff (see the steps below). MFA and password changes cost nothing but time. |
| Control | You can't easily tell who still knows which password, including people who have already left. | You can see who has access to what, and you can remove someone in minutes. |
| Day-to-day friction | Lockouts, password resets and "what's the login for…?" messages. | Autofill saves typing. The ACSC notes password managers help you "save time and effort by auto filling your account logins". (ACSC) |
Fix it: step by step
The time guides below are rough, for a team of about 5–20 people. Yours will vary.
Step 1: Turn on MFA for your most important accounts first (about 1 hour)
Do this before anything else. MFA means a stolen password alone isn't enough to log in. The ACSC calls MFA "one of the most effective ways to protect business accounts" and says to start with "email, banking, cloud storage, accounting software and social media." (ACSC)
- Look under each account's security settings. It may be called two-factor authentication or two-step verification.
- Choose stronger methods where you can. The ACSC lists passkeys, security keys and authenticator apps, and describes SMS or email codes as "the least secure option".
- Start with the owner's and admins' accounts, then move on to everyone else.
Step 2: Choose a business password manager (about 30 minutes)
Look for these features:
- Shared vaults with permissions, so the team can use a login without passing it around in chat.
- Admin controls: invite and remove users, set policies, and recover locked-out accounts.
- Password health alerts: flags for reused, weak or breached passwords.
- Works on your devices: browser, desktop and mobile.
- Free trial, so you can test it with two or three people first.
See the quick pick below, or our password manager guide.
Step 3: Set it up properly (about 1–2 hours)
- Protect the password manager itself. The ACSC advises a "long, unique master password" plus MFA. In its words, weak protection here "is like putting your valuables in a safe and leaving the unlock code beside the door." (ACSC)
- Create shared vaults by job, not by person. For example: "Finance", "Marketing", "Suppliers", "Admin only".
- Give at least two trusted people admin and recovery rights, so the business isn't stuck if one person is unavailable.
Step 4: Move staff over and replace reused passwords (about 1 week, a little each day)
- Invite staff and ask each person to install the app and browser extension.
- Start with the most important accounts and change each password to a new, generated one. The ACSC recommends passwords of at least 15 characters where MFA can't be used. (ACSC)
- Delete the old spreadsheets, sticky notes and chat messages that hold passwords.
- Don't force regular password changes for their own sake. The US standards body NIST says services "SHALL NOT require subscribers to change passwords periodically" but must force a change "if there is evidence that the authenticator has been compromised." (NIST SP 800-63B) Change passwords when there's a reason to.
Step 5: Lock in the habits (15 minutes a month)
- When someone leaves: remove their password manager access the same day and change any shared passwords they knew. The ACSC says to "change login details when staff leave or change roles" and to "remove access promptly when staff leave." (ACSC)
- Once a month: check the password health report and fix anything flagged as reused or breached.
- Least privilege: give admin access only to the people who need it.
Quick pick
Quick pick: business password managers (product details from official vendor pages, checked 18 Oct 2026. Not hands-on tested. No ratings. Confirm prices and features on the vendor's site.)
- Best for most small teams: 1Password. It has a small-team pack listed at US$24.95/month billed annually for up to 10 members, and its business plan includes reporting on weak, reused or breached passwords and account recovery. 14-day free trial. → See our password manager guide
If you're on a tight budget: Proton Pass. Its business "Pass Essentials" plan was listed from US$1.99 per user/month billed yearly (minimum 3 users) at the time of checking. The listed price may be an introductory rate. It includes shared vaults, a built-in 2FA authenticator and dark web monitoring. There's a free personal plan and a 14-day business trial. → See our password manager guide- If you want group- and folder-based sharing with breach monitoring: NordPass. Its Business plan lists group-based and folder-based credential sharing, password strength monitoring and data breach monitoring (5-user minimum). There's also a Teams pack for 10 users. Free trial available. Prices didn't display in our check, so see the vendor's page. → See our password manager guide
Not sure yet? Compare them in our password manager guide or see all our quick picks.
Honest limits: who this isn't for
Free: the Small Business Password & Access Checklist
A 1–2 page checklist that turns this article into a to-do list: which accounts to protect first, how to set up shared access, and what to do when someone joins or leaves.
You only get emails if you tick the consent box. Unsubscribe any time. See our privacy policy.
Frequently asked questions
Isn't it risky to put all our passwords in one place?
It's a fair question. The national cyber agencies we cite recommend password managers anyway, because they make unique, strong passwords practical. The protection depends on securing the vault itself: a long, unique master password plus MFA, as the ACSC advises.
Can't staff just use the browser's built-in password saver?
The UK NCSC notes password managers "might be built into your browser already". For a single person, that can be a reasonable start. For a team, a business password manager adds shared vaults, admin control and fast removal of leavers, which is usually the part owners actually need. (NCSC)
Should we make everyone change their passwords every 90 days?
Not by default. NIST's current guidance says not to require periodic changes, but to force one when there's evidence of compromise. (NIST SP 800-63B)
How long should passwords be?
The ACSC says at least 15 characters where MFA can't be used. Let the password manager generate them so nobody has to remember them. (ACSC)
What if staff resist?
Lead with what they gain: no more remembering or resetting passwords, plus autofill. Start with the accounts that matter most and go one team at a time.
Related guides
- Password managers: our hub
- Cybersecurity tools
- Start here: free 5-step security checklist
- Coming soon: Which password manager should my small team use? (A2) · We've never turned on two-step login (A3) · A staff member left. Do they still have our logins? (A7)
Sources
Government and standards bodies first. All links checked and loading on 18 Oct 2026.
- Australian Cyber Security Centre: Small business cyber security handbook: securing accounts and identities
- Australian Cyber Security Centre: Annual Cyber Threat Report 2024–25
- Australian Cyber Security Centre: Report a cyber security incident
- US National Institute of Standards and Technology: SP 800-63B Digital Identity Guidelines: Authentication and Authenticator Management
- UK National Cyber Security Centre: Managing your passwords
- UK National Cyber Security Centre: Small organisations guide to cyber security
- Canadian Centre for Cyber Security: Best practices for passphrases and passwords
- Vendor pages (checked 18 Oct 2026): 1Password business pricing · Proton Pass for business · NordPass business plans
About our review process
We pick products from official information and say clearly when we haven't tested something hands-on. Affiliate status doesn't decide what we recommend. See how we work.