World Password Day: Why Stronger Authentication Matters More Than Ever

By Jeannette Jarvis, Chief Business Officer, Cyber Threat Alliance At the Cyber Threat Alliance, we see every day how interconnected our digital world has become and how much our collective security depends on the choices each of us makes. Passwords remain one of the most common entry points for attackers, yet they’re also one of the easiest places for individuals and organizations to strengthen their defenses. As part of our commitment to advancing shared resilience across the global cybersecurity community, we’re proud to support World Password Day and the movement to promote stronger, more consistent authentication practices. World Password Day World Password Day is an annual global awareness effort focused on improving password hygiene and promoting stronger authentication practices. Celebrated on the first Thursday of May, it encourages individuals and organizations to take meaningful steps to protect their digital identities. This global moment aligns closely with the work of organizations like Nonprofit Cyber, which continues to champion consistent, evidence‑based guidance on password and authentication best practices. Their Common Guidance on Passwords, endorsed by more than 130 organizations, provides clear, actionable recommendations for strengthening credential security. Passwords: Still a Growing Problem Passwords have always been a major source of frustration — and the problem hasn’t improved. Recent analyses show that the average person now manages around 100 passwords, a number that has remained stubbornly high as our digital lives expand. With so many accounts to secure, it’s no surprise that many people reuse passwords across multiple platforms, often relying on predictable patterns or simple variations that attackers can easily guess. This behavior has real consequences. Weak or reused passwords continue to be a leading cause of breaches. CTA member Panda Security published ‘40+ Password Statistics That Will Change Your Online Habits in 2025’ revealing alarming details around poor password hygiene –– including that the most common password used globally is ‘123456’, being used by millions of users. The Breach Landscape: Still Escalating The threat landscape continues to grow more complex. The 2025 Verizon Data Breach Investigations Report (DBIR) analyzed 12,195 confirmed data breaches. One 2025 leak alone exposed 16 billion stolen passwords, one of the largest compilations ever recorded. If you’ve received multiple breach notifications in the past year, you’re far from alone. Passwords Alone Aren’t Enough It is clear––passwords alone can’t carry the security burden. Attackers have become faster and more sophisticated. AI‑accelerated cracking tools and other password cracking techniques can break even “complex” passwords in hours or days. Verizon’s 2025 DBIR reports that use of stolen credentials was the initial access vector in 22% of breaches, though several other sources place the figure significantly higher. Regardless of the exact metric, compromised credentials remain the leading cause of security breaches, outpacing techniques such as phishing and vulnerability exploitation. What You Can Do Today It’s apparent that we must continue to evolve our protection strategies to stay ahead of attackers evolving techniques. The Common Guidance outlines practical steps to reduce your risk. One of the most important is adopting Multifactor Authentication (MFA). MFA adds a second layer of verification, such as a code, token, or biometric, making it dramatically harder for attackers to access your accounts. Even if your password is compromised, MFA can stop unauthorized access. The impact is undeniable––MFA makes accounts 99% less likely to be hacked. Yet adoption remains low. According to the Cyber Readiness Institute, as of 2024, 58% of small and medium‑sized businesses were unaware of MFA’s importance, and only 35% had implemented it. CTA member Sophos notes in ‘Strengthening authentication with passkeys: A CISO playbook’ that while MFA is stronger than passwords alone, threat actors have discovered ways to circumvent them, and passkeys can be used as a phishing-resistant solution. Recently the UK’s National Cyber Security Center (NCSC) has now officially endorsed passkeys as the default authentication standard, marking the first time they have told customers to move completely away from passwords. You can learn more about passkeys from CTA member McAfee’s article ‘What Is a Passkey and Is it Really Safe’, where they note passkeys offer a meaningful step towards a safer and more manageable digital life. CTA’s Recommendation The Cyber Threat Alliance strongly encourages individuals and businesses to move beyond passwords by enabling MFA wherever possible, adopt passkeys where supported, follow the Common Guidance on Passwords, and strengthen identity protection practices. These simple steps can dramatically reduce your risk and strengthen your overall security posture. Protect what matters – and since it’s World Password Day, take a moment today to refresh your passwords.