Identity and Privileged Access Security
Password Resilience Assessment
We assess how your organization's passwords withstand guessing and leaked-password attacks. We revise your password policy based on identified weaknesses.
What it is
A password policy may appear strong on paper. Users can still choose passwords that comply with rules but are predictable, such as a season and a year. The assessment compares domain password hashes with leaked-password lists and common patterns in a closed environment. The current NIST SP 800-63B is used as the standard.
Scope
- Password policy, fine-grained policies, and account lockout settings
- Password hashes compared with known leak lists
- Predictable patterns such as company name, season, and year
- Passwords reused across multiple accounts, especially admin accounts
- Accounts with passwords that never expire or require no password
- Banned password lists and password protection settings
The need
When organizations need it
- When employee email addresses and passwords are exposed in a data leak.
- When a password spraying attempt or unusual account lockouts are detected.
- Before revising your password policy to align with current NIST SP 800-63B guidance.
Method
How we work
-
Policy review
We review password and lockout settings along with all domain policies.
-
Closed analysis environment
With your approval, we analyze password hashes in a closed environment you specify. Data is deleted at the end, and deletion is documented.
-
Comparison
We compare the hashes with leaked-password lists and common patterns.
-
New policy
We recommend a policy based on length, banned password lists, and MFA coverage.
Outcome
What you have at the end
You see how many accounts use leaked or predictable passwords, broken down by pattern. Your password policy is based on measured weaknesses and avoids unnecessary user burden.
Frequently asked questions
Will you see our passwords?
Reports do not contain cleartext passwords. Findings are presented by pattern and account group. Accounts requiring password changes are shared only with the authorized contact.
Should we require regular password changes?
NIST SP 800-63B advises against mandatory periodic changes, recommending changes only if compromise is suspected. Some sector regulators still require regular changes. The policy is set according to your applicable regulation. Length and leaked-password checks are always included.
Identity and Privileged Access Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting