Type “123456” or “password” into a login box and you are in good company, which is exactly the problem. Password security flaws are not rare mistakes made by careless users; they are structural weaknesses baked into how most of us create, store and reuse credentials, and criminals have built entire industries around exploiting them. In 2026, those flaws look different to how they did five years ago.
Attackers now pair stolen credential lists with AI-driven guessing tools, and they have found ways to slip past multi-factor authentication that most people still believe is unbeatable. This article walks through where password security flaws actually come from, what UK regulators expect organisations to do about them, and the practical changes, from passphrases to passkeys, that close the gap.
- Credential abuse still features in 39% of all data breaches worldwide, even though it is no longer the single most common way attackers first get in.
- The UK’s National Cyber Security Centre has moved past “complex passwords” advice, now recommending three random words and, where possible, passkeys instead.
- Multi-factor authentication helps, but adversary-in-the-middle phishing kits are stealing session tokens after MFA succeeds, so it is no longer a complete answer on its own.
- UK regulators have fined organisations over a million pounds for password and authentication failures within the past year, making this a compliance issue as well as a technical one.
Table of Contents
Why Traditional Password Advice Is Failing in the AI Era
For two decades, security teams told people to make passwords complicated: a capital letter, a number, a symbol, repeated every ninety days. That advice produced passwords like P@ssw0rd1!, which look strong but follow entirely predictable substitution patterns. Attackers know these patterns because they have harvested billions of real passwords from previous breaches, and modern cracking tools test the popular substitutions first. The result is that complexity rules increased user frustration without meaningfully increasing security, which is one of the clearest password security flaws in older guidance.
AI-Powered Credential Stuffing and Brute Force
Credential stuffing takes a list of email and password pairs leaked from one breach and tries them automatically against dozens of other websites, banking on the fact that so many people reuse the same login everywhere. According to Verizon’s 2026 Data Breach Investigations Report, credential abuse of some kind featured in 39% of all confirmed breaches, making it the most persistent technique across the entire attack chain even though vulnerability exploitation has overtaken it as the first point of entry.
The same report found that a user is roughly four times more likely to be running a password that has already appeared in a breach than one that is simply weak but unique, which says more about reuse than about password strength alone.
Generative AI has sharpened this further. Rather than trying every possible combination, modern cracking tools are trained on real breached password sets and learn the habits people fall into, swapping letters for numbers, appending a birth year, or capitalising the first letter. That means a password that looks complex to a human, such as Manchester2024!, can be guessed far faster than its character count suggests. Staying ahead of this shift means moving away from short, clever substitutions and towards genuinely long, unpredictable passphrases, which the next section covers in detail.
The Password Security Flaws Putting UK Users and Businesses at Risk
Most guidance still frames password security flaws as something individual users cause through laziness, but the reality is more layered. Predictable choices, careless storage and gaps in organisational policy all combine to create the openings attackers rely on. The three patterns below cover the most common failure points seen across UK households and workplaces alike.
Predictable and Reused Passwords
The single most common password security flaws are predictability and reuse, and they tend to travel together. Around three in five people admit to reusing one favourite password across multiple accounts, according to long-running industry surveys, which means a single breached email and password combination can open a person’s banking, social media and work accounts in one go.
Predictable choices compound the risk: names, pet names, birthdays and keyboard sequences remain the first guesses attackers try, whether by hand or via automated tools. Reducing this flaw is less about remembering more passwords and more about not needing to remember them at all, which is where a password manager and tools for securing every account you hold become genuinely useful rather than optional extras.
Weak Storage and Hashing Practices
A password can be long and unique and still be exposed if the organisation storing it has done its job poorly. Passwords should never be stored in plain text; they should be hashed with a slow, salted algorithm designed specifically to resist cracking, so that even if a database is stolen, the passwords inside it are not immediately usable. Many smaller organisations still rely on outdated hashing methods or, in the worst cases, store credentials in plain text spreadsheets. Understanding the difference between encryption and basic password protection matters here, because the two are often confused, and a business that assumes its passwords are “encrypted” without checking how may be closer to a breach than it realises.
The Spreadsheet and Chat-App Trap: Administrative Flaws
The password security flaws that get the least attention are administrative rather than technical. IT teams and small business owners frequently store shared logins in unencrypted spreadsheets, in messaging app pins, or scribbled in shared documents, because a proper password vault feels like an extra step during a busy week. These informal stores are rarely monitored, rarely rotated, and often outlive the employees who created them.
When a member of staff leaves a company, an internal spreadsheet of passwords they once had access to is one of the easiest routes back in for a disgruntled ex-employee or anyone who obtains a copy of that file. Fixing this is a policy problem as much as a technical one: a proper password manager with role-based access removes the temptation to keep an informal, unmanaged list altogether.
Beyond the Password: Why MFA Alone No Longer Stops Attackers
Multi-factor authentication has been the standard advice for years, and it still stops a huge volume of opportunistic attacks. The problem is that determined attackers have adapted specifically to defeat it, which means MFA can no longer be treated as a guarantee, only as one useful layer among several.
MFA Fatigue and Session Hijacking
One increasingly common tactic is MFA fatigue, where an attacker who already has a stolen password repeatedly triggers login prompts until a tired or distracted user approves one by accident, assuming it is a system glitch. A more technical version of the same problem is session hijacking, where an attacker steals the authentication token created after a successful login rather than the password itself, letting them access an account without ever triggering another MFA prompt. Both techniques rely on the same insight: once you are logged in, the system trusts you, and that trust can be stolen.
Adversary-in-the-Middle Attacks
Adversary-in-the-middle, or AiTM, phishing is the more sophisticated cousin of MFA fatigue. Rather than asking a user to approve a login, an AiTM kit places a proxy server between the victim and the real login page, silently relaying every character typed and every MFA code entered. Because the victim is interacting with what looks like the genuine site, they complete the login and the MFA challenge themselves, and the attacker simply copies the resulting session cookie once it is issued.
According to Proofpoint’s 2025 analysis, 59% of accounts that were successfully taken over had multi-factor authentication switched on at the time, showing clearly that MFA alone is not the finish line it is often assumed to be. Microsoft’s research points the same way, attributing the majority of recent MFA-bypass breaches to this kind of session-token theft rather than to attackers guessing the second factor itself. Recognising the limits of standard MFA is precisely why the NCSC and UK regulators increasingly push organisations towards hardware security keys and passkeys, which are far harder for a proxy server to intercept.
UK Compliance: Password Security Flaws Under GDPR and Cyber Essentials
For UK organisations, password security flaws are not just a technical risk; they are a regulatory one. Both the Information Commissioner’s Office and the government-backed Cyber Essentials scheme treat weak authentication as a specific, named failure point rather than a vague good practice suggestion, and recent enforcement shows they are prepared to act on it.
The Information Commissioner’s Office fined password manager provider LastPass UK Ltd £1.2 million in November 2025, after finding it had failed to implement sufficiently strong technical and organisational security measures around device and account management, exposing personal data belonging to up to 1.6 million UK users.
In a separate case, the ICO fined a genetic testing firm’s UK arm £2.31 million after five months of undetected credential stuffing attacks went unnoticed, citing the absence of mandatory multi-factor authentication on highly sensitive data as a central failing. Both cases make clear that under UK GDPR Article 32, “appropriate technical and organisational measures” includes how an organisation actually manages authentication, not just whether a password policy document exists on paper.
Cyber Essentials, the UK government’s baseline certification scheme, was updated to version 3.3 in April 2026 with tighter password quality rules. Organisations must now choose one of three routes: enforce multi-factor authentication alongside an eight-character minimum, set a minimum password length of twelve characters with no maximum cap, or keep an eight-character minimum but automatically block common and previously breached passwords.
The update also made the absence of MFA on any cloud service that supports it an automatic fail, closing a loophole that many smaller organisations had previously relied on. The NCSC’s own guidance has shifted in the same direction, now actively encouraging organisations to plan a move to passkeys wherever their systems support them, rather than treating passwords as a permanent fixture.
Fixing Password Security Flaws: Practical Steps for Individuals and Businesses
Understanding where password security flaws come from is only half the job. The second half is making specific, practical changes that close the gaps identified above, starting with how a password is built in the first place.
Building a Strong Password with the NCSC’s Three Random Words Method
The NCSC recommends building passwords from three random, unrelated words, joined together with a number or symbol if a site requires one, such as “raincoat42violin” rather than a single dictionary word with a capital letter bolted on. The logic is straightforward: length beats complexity, because a longer password has a vastly larger number of possible combinations for an attacker to try, while three unconnected words are still genuinely memorable to the person who chose them. The one rule that matters is randomness. Words linked to your own life, a pet, a football team, a street name, narrow the guessing pool considerably, so the words need to be picked without any personal connection at all.
Choosing and Using a Password Manager
A password manager removes the need to apply the three random words method by memory for every single account, since it can generate and store a unique, lengthy password for each one and fill it in automatically. This single change removes password reuse as a risk almost entirely, because a breach on one site no longer threatens every other account. When comparing tools, look at whether the provider uses zero-knowledge encryption, meaning even the company itself cannot read your stored passwords, and whether it supports passkeys alongside traditional entries, since most major providers are adding this quickly. Our password manager comparison guide covers the practical differences between leading options if you are choosing one for the first time.
Moving Towards Passwordless Authentication
Passkeys remove the password from the equation entirely, replacing it with a cryptographic key pair tied to your device and confirmed with a fingerprint, face scan or device PIN. According to the FIDO Alliance’s 2026 State of Passkeys report, 77% of UK consumers now have passkeys enabled on at least one account, and passkeys were measured with a 93% login success rate compared with 63% for traditional passwords, largely because there is nothing to forget, mistype or phish.
Because a passkey never leaves your device and is bound to the specific website it was created for, it is inherently resistant to the adversary-in-the-middle attacks described earlier; there is no password or one-time code for a proxy server to intercept. For accounts that do not yet support passkeys, biometric authentication built into a phone or laptop offers a similar practical benefit today.
What To Do Immediately After a Suspected Breach
Speed matters more than most people assume once a password may have been compromised. Change the password on the affected account first, then check whether the same password was reused anywhere else and change it there too, starting with email and banking, since a compromised email account can be used to reset passwords elsewhere. Turn on multi-factor authentication if it was not already active, and check the account’s recent login activity and connected devices for anything unfamiliar.
Research suggests that only around three in ten people actually change their password promptly after being notified of a breach, which is precisely the delay that lets a stolen credential remain useful to an attacker for months. A clear, unhurried walkthrough of how to reset a password safely across your main accounts is worth bookmarking before you need it, not after.
MFA Method Comparison
Not every second factor offers the same protection against the adversary-in-the-middle attacks described above, so it helps to see the options side by side before choosing what to switch on first.
| MFA method | Resistance to AiTM phishing | Everyday convenience |
|---|---|---|
| SMS text codes | Low | High |
| Authenticator app codes | Low to moderate | High |
| Push notification approval | Moderate | High |
| Hardware security key | High | Moderate |
| Passkey | High | High |
Password security flaws rarely announce themselves before they are exploited, which is exactly why a short audit is worth doing now rather than after an incident. Check which of your accounts still share a password, turn on multi-factor authentication anywhere it is missing, and where a site offers a passkey, switch to it. For UK businesses, that audit should extend to Cyber Essentials alignment and a documented password policy that goes beyond a single line in a staff handbook. None of this requires specialist knowledge, only the fifteen minutes it takes to work through your own most important accounts one by one.
Frequently Asked Questions
These are the questions UK readers ask most often when trying to understand password security flaws and what actually fixes them, gathered from search trends and common support queries.
What is the most common password security flaw?
The most common flaw is reusing the same password across multiple accounts, since it turns a single breach on any one site into a route into everything else that shares the same login.
How long should a password be in 2026?
Aim for at least fifteen to sixteen characters where a site allows it. A three-word passphrase easily reaches this length while remaining memorable, which is why the NCSC recommends it over shorter, symbol-heavy passwords.
Can AI really guess a complex password?
Yes, when that password follows a common pattern. Tools trained on billions of breached passwords recognise substitutions such as swapping “a” for “@” almost instantly, which is why unpredictable length matters more than clever character swaps.
Does multi-factor authentication fully solve password security flaws?
No. MFA blocks most opportunistic attacks, but adversary-in-the-middle phishing kits can steal the session created after a successful MFA check, which is why phishing-resistant methods such as passkeys and hardware keys are increasingly recommended alongside it.
Are password managers safe to use?
Reputable password managers that use zero-knowledge encryption are generally considered safe, since the provider itself cannot read stored passwords. The main risk shifts to protecting the single master password, so that should be the longest and most unique one you set.
What happens if I never update an old, reused password?
It remains a live risk indefinitely. Breached credential lists are traded and reused by attackers for years after the original incident, so an old reused password can still open an account long after the breach that exposed it has been forgotten.