The useful question is not “Have we told everyone to choose a strong password?” It is “How do people sign in, how could that go wrong, and how would we recover?”
For a business leader, I would begin with the team's important accounts and the person responsible for each. Email, the password manager and the work sign-in service deserve particular attention because other accounts may depend on them.
Passwords: unique beats familiar
A password should be long and unique to its account. A password manager can help create and keep different passwords without asking people to remember them all. Use the manager your organisation approves, with its own access and recovery protections. The NCSC's account guidance recommends unique passwords and explains password-manager and additional-verification options.
Do not reuse a work password for a personal account. Do not ask an AI chat to generate, inspect or remember your actual password. I would keep that job inside the approved password manager.
Current NIST guidance does not recommend forcing routine password changes merely because a calendar period has passed. Evidence of compromise is different. Follow your organisation's process and raise a questionable policy with its owner; do not quietly bypass it.
What the second factor adds
A factor is a kind of evidence: something you know, something you possess or a biometric characteristic used in an appropriate authentication system. A password followed by another password is not two distinct factors.
An authenticator app or security key can add possession of a device to knowledge of a password. Two-factor authentication, or 2FA, uses two distinct factors; multi-factor authentication, or MFA, is the wider term. Product labels such as “two-step verification” need checking: count the kinds of evidence, not just the number of screens.
Codes can still be stolen through a convincing fake sign-in page. NIST distinguishes manually entered one-time codes from phishing-resistant cryptographic authentication. Do not approve a sign-in request you did not initiate; use the organisation's reporting route if one appears.
Where passkeys fit
A passkey uses cryptographic keys instead of asking you to type a reusable password. You commonly unlock its use on a device with a PIN, fingerprint or face check. FIDO explains that passkeys provide phishing-resistant authentication. That does not make the whole account immune to compromise: device security and recovery routes still matter.
Some passkeys are synchronised through a credential provider; others are tied to a particular device or security key. Ask which arrangement your organisation supports and how people recover when a device is lost. “There is a passkey” does not tell you whether a separate OTP code is required; the product's authentication design matters.
A practical account conversation
My proposed review would use account names and owners, never their secrets:
| Ask about | Evidence to request |
|---|---|
| Normal sign-in | Approved method and which users must use it |
| Fallback sign-in | Whether an older password or recovery route remains available |
| Lost device | A documented recovery process and the responsible support team |
| Departing colleague | Removal of sessions, factors and connected access as applicable |
Store recovery codes in the approved secure location. Do not put them in an AI conversation or this review table. Ask the administrator to explain recovery before changing your only working sign-in method.
If a supplier stores user passwords, ask how it protects them. OWASP recommends purpose-built salted password hashing, rather than readable passwords or reversible storage for routine login verification. Password hashing is different from encryption of ordinary business files. Your team should not build a homemade password system for this lesson.
Ask your AI to teach you
Paste this into an approved learning chat without connected accounts:
Check that you can use it
Two sign-in screens both ask for a secret you memorised. Is that two-factor authentication? No. Now explain why a backup sign-in method needs protection even when the usual method is strong.
Ask your system owner which approved method and recovery process your team should use. This is a conversation to prepare, not permission to change company policy. Prompts do not restrict an agent's real tools or account permissions.
Start with authentication if these terms are unfamiliar. Continue to databases.
Sources and boundaries
NCSC, NIST, FIDO and OWASP sources linked above were checked on 21 October 2026. FIDO is the standards alliance describing its technology; the guide claims no measured improvement for this course or your accounts. Examples and review questions are proposed practice. An AI explanation cannot confirm that your sign-in or recovery is configured correctly.