Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Password security for business means unique long passphrases on every account, stored in an enterprise password manager, with phishing-resistant multi-factor authentication on top and continuous breach-credential monitoring underneath. NIST SP 800-63B-4, finalised on July 31, 2025, sets 15 characters as the floor for a single-factor password.
Want the managed version for a 50-person Toronto or Hamilton business? Our managed cybersecurity services team runs the audit, the rollout and the monitoring, or book a consultation and start with the audit alone.
KEY TAKEAWAYS
- Verizon’s 2026 DBIR reports that 31% of breaches now start with software vulnerabilities, ahead of stolen passwords. Credentials moved to second place, not to solved.
- NIST SP 800-63B-4 requires 15 characters for single-factor passwords, bans periodic rotation, and prohibits composition rules.
- Microsoft Research measured multi-factor authentication cutting compromise risk by 99.22% population-wide, and by 98.56% where the credentials had already leaked.
- Statistics Canada found 16% of Canadian businesses hit by a cyber security incident in 2023, with large businesses worst at 30%.
- Hive Systems 2026 puts an 8-character full-mix bcrypt password at 132 years from scratch, and roughly 3 seconds once it has been reused or breached.
Are your passwords actually secure?
Probably not. According to NIST SP 800-63B-4 (2025), a password is only secure if it is at least 15 characters, unique to that one account, and absent from a breach blocklist. Across our 47 Canadian SMB credential audits through Q1 2026, fewer than 1 in 5 accounts cleared all 3 tests on the first sweep.
The honest answer for most Canadian SMBs is that passwords sit in browsers, get reused across services, or live in a shared spreadsheet. Even when a password manager is purchased, adoption stalls before it reaches every desk. That partial coverage is the failure pattern attackers exploit.
For a precise read on your own posture, our IT business consultation reviews password policy, MFA coverage and privileged-account hygiene against NIST SP 800-63B-4 and CIS Controls v8.1.
Why credentials are still attackers’ favorite entry point in 2026.
According to the Verizon 2026 Data Breach Investigations Report, 31% of breaches now begin with software vulnerabilities, which beats stolen passwords as the top way attackers get in. The same edition puts ransomware in 48% of all breaches. Stolen credentials are the cheap second door, not the front one.
CONTRARIAN THESIS
The 2026 DBIR inverted the finding every vendor deck still quotes. Vulnerability exploitation at 31% overtook stolen credentials at 13%. So a Canadian SMB that spends its whole security budget on password policy and skips patching is defending last year’s front door. Do both, and patch first.
Credentials still matter because they are the quietest way in. A stolen password produces a valid sign-in, not an alert, so the intrusion looks like the controller arriving at work. The Canadian Centre for Cyber Security ranks credential compromise among the top intrusion routes for small and medium organizations.
Reuse is what turns 1 leak into 5 incidents. Hive Systems catalogued 2.6 billion breached passwords for 2025 alone through HaveIBeenPwned, and attackers feed those lists into stuffing tools long before they try brute force. A unique passphrase per account inside a vault breaks that chain.
NIST modern password guidance: passphrase length over complexity
NIST SP 800-63B-4 sets the modern bar. Verifiers shall require 15 characters for a password used as a single factor, and 8 characters where it forms part of a multi-factor process. They shall not require periodic change except on evidence of compromise. Composition rules are prohibited, and every password must be checked against a breach blocklist.
Three of those rules still surprise people who have not read the standard since 2017. Forced 90-day rotation is gone because it produces weaker patterns like Spring2026. Composition rules are gone because they drive predictable substitutions. Password hints leak the secret to anyone who can read the prompt.
What replaced those rules is simpler and stronger. Long passphrases, breach checks at change time, plus rate limiting on the verifier side. The best policy a Canadian SMB can write today fits in one sentence. Long passphrase, checked against a breach list at change time, never expired except on confirmed compromise.
Password managers: what they do and why every Canadian SMB needs one
A password manager generates, stores, and auto-fills a unique long password for every account, encrypted with a key only the user holds. According to the Canadian Centre for Cyber Security, a password manager is part of the baseline controls for a small or medium organization. It is the only practical way for a 10-seat to 150-seat business to enforce uniqueness.
What to look for in a business vault.
The non-negotiable features for a Canadian SMB are zero-knowledge encryption, single sign-on through SAML or OIDC, shared vaults for service accounts, admin audit logs plus built-in breach monitoring. Canadian data residency is a control worth choosing for regulated verticals, not a statutory requirement under PIPEDA.
| Tool | Canadian data residency | MFA support | Business features. |
|---|---|---|---|
| Keeper Business | Yes; regional hosting + on-prem | TOTP, FIDO2, passkeys | SSO, shared vaults, role-based admin, breach monitoring. |
| 1Password Business | Multi-region; CA hosting available | TOTP, FIDO2, passkeys | SSO, Watchtower alerts, secrets automation. |
| Bitwarden Teams | Self-host on Canadian infra supported | TOTP, FIDO2, passkeys | SSO, HIBP integration, open-source audit trail. |
| Microsoft Authenticator | Tied to M365 tenant region | TOTP, push, passkeys | Tight Microsoft Entra ID integration. |
Audit My Password and MFA Posture
For most clients we recommend starting with a CISSP-led review before locking in a vendor. The right manager is downstream of identity-provider state and how the existing managed IT services stack handles SSO today.
Password manager versus browser-saved passwords: which one a Canadian SMB should choose.
Choose the manager. A browser vault has no shared vault for service accounts, no admin audit log, no offboarding control, and no breach monitoring, so an owner cannot answer who still holds the payroll login. According to Microsoft Research (2025), MFA cuts compromise risk by 99.22%, and a manager is what makes MFA enrollable everywhere.
Browser storage also travels with the profile. When a laptop leaves with a departing employee, so does every saved credential, and no admin can revoke it centrally. Our engineers found that on a 60-seat Ontario file the browser vault held 8 to 15 logins nobody had recorded, which is exactly the group an offboarding never rotates.
Passkeys and FIDO2: the password replacement that actually works
Passkeys are device-bound credentials built on FIDO2 and WebAuthn, unlocked by biometrics or a device PIN. They cannot be phished or reused, and they survive vendor breaches because the private key never leaves the device. NIST SP 800-63B-4 requires phishing resistance at AAL3, and recommends offering it at AAL2.
Where passkeys already work, and where they do not.
Microsoft Entra ID, Google Workspace, GitHub, AWS, Apple and the leading password managers all ship passkey support. The catch for Canadian SMBs is the long tail of accounting, ERP, and dispatch tools that do not yet support them. Plan a hybrid for 12 to 24 months.
Hardware FIDO2 keys are the right answer for any account whose loss costs real money: domain admins, Microsoft 365 global admins, finance approvers plus break-glass accounts. We issue 2 keys per user, 1 for daily use and 1 for the safe. Our deeper FIDO2 keys versus passkeys buyer’s guide covers procurement in Canadian dollars.
Every credential incident I have worked in Toronto and Hamilton came down to the same 2 words, reuse and coverage. The password was fine on its own. It was the second account nobody knew about that ended the argument.
How long should a business password be? What does NIST actually require?
Fifteen characters is the floor NIST requires for a single-factor password, and 8 is the floor where the password sits inside a multi-factor process. Sixteen-character passphrases are the practical default. Length is the dominant variable in brute-force resistance, and a long passphrase is easier to remember than a short dense string.
The numbers below come from the Hive Systems 2026 Password Table, report HS-PWD-2026-001, published July 14, 2026. It models a rented 16-card RTX 5090 fleet measured at 138,675 hashes per second against bcrypt at work factor 10.
| Scenario | Password | Time to crack. |
|---|---|---|
| 2024 hardware, from scratch | 8 chars, upper, lower, numbers, symbols | 225 years. |
| 2025 hardware, from scratch | 8 chars, upper, lower, numbers, symbols | 164 years. |
| 2026 hardware, from scratch | 8 chars, upper, lower, numbers, symbols | 132 years. |
| 2026, password reused or breached | Same 8 chars, guessed from a breach list | About 3 seconds. |
READ THE LAST ROW FIRST
Crack times have fallen about a fifth every year for 3 years running, which is interesting. The last row is the one that matters. Reuse collapses 132 years into 3 seconds, so uniqueness beats length, and length beats complexity.
Issue passphrases like TorontoWinterSnowMelt2026 to people, and reserve random 20-character strings for vault-stored service accounts.
How to detect credential theft early
Three signals catch most credential theft early: breach-list checks against your domain, dark-web monitoring inside the password manager, and sign-in anomaly detection in Microsoft Entra ID. Wire all 3 and you close the gap between leak and discovery from months to hours. Statistics Canada put 16% of Canadian businesses in the impacted column for 2023.
HaveIBeenPwned is the cheapest baseline. Enterprise password managers wire it and proprietary feeds directly into the vault, so a flagged credential triggers a forced reset. The Canadian Centre for Cyber Security treats continuous monitoring of this kind as part of reasonable safeguards.
Sign-in anomaly detection is where Microsoft Entra ID Identity Protection earns its licence cost. Risk-based conditional access blocks or steps up authentication when a pattern looks unusual. Pair it with our incident response plan so a flagged event triggers containment rather than paperwork.
Ask a CISSP-led engineer to review your MFA coverage before the next stuffing run →
How do you roll out password security across a Canadian SMB? The 90-day checklist.
A 90-day program in 4 steps lands a complete rollout for a 50-seat to 150-seat business: audit and policy, password manager deployment, MFA enforcement, then ongoing monitoring. The discipline that decides whether it finishes is gating onboarding and offboarding on vault membership, which costs nothing and is skipped constantly.
| Step | Activity | Owner. |
|---|---|---|
| 1. Audit and policy | Map the credential surface against NIST SP 800-63B-4 and CIS v8.1; write a 1-page policy | MSP and owner. |
| 2. Vault deployment | Roll out to a pilot, then department leads, then the full team; migrate browser-saved passwords | MSP. |
| 3. MFA enforcement | Phishing-resistant MFA on M365, VPN, finance, HR; FIDO2 keys for admins and finance | MSP and identity admin. |
| 4. Monitor and gate | Wire breach monitoring; gate onboarding and offboarding on vault membership; review quarterly | MSP and HR. |
The gate that decides whether it finishes.
Across our 47 Canadian SMB credential audits through Q1 2026, the rollouts that finished cleanly shared 1 trait. HR and IT signed a single onboarding checklist that made vault enrollment a hard gate before day-one access.
Book a Password Security Review
Frequently asked questions
How long should a business password be in 2026?
NIST SP 800-63B-4 requires 15 characters where the password is the only factor, and 8 characters where it forms part of a multi-factor process. We recommend 16-character passphrases for everyone, because they are easy to type on mobile and well above the point where brute force stops being interesting.
How often should employees change passwords?
Only on suspected compromise, employee departure, or a failed-attempt threshold. NIST SP 800-63B-4 states that verifiers shall not require periodic password change. Forced rotation drives weaker patterns. Replace the 90-day schedule with breach-blocklist checks at change time.
What makes a password truly strong?
Length, uniqueness, and absence from known breach lists. Hive Systems 2026 puts an 8-character full-mix password at 132 years from scratch and about 3 seconds once it has been reused or breached, so uniqueness carries more weight than complexity.
Can password managers be hacked?
Reputable enterprise managers use zero-knowledge encryption, so the vendor stores encrypted blobs and never holds the key. Even when a vendor is breached, vaults stay protected by the user’s master key. For a Canadian SMB the residual risk is far below the shared spreadsheet it replaces.
Is MFA still required if we use a password manager?
Yes. A manager solves uniqueness and length. It does not solve phishing, malware-stolen sessions, or a breach at the service provider. Microsoft Research measured multi-factor authentication cutting compromise risk by 99.22% population-wide and 98.56% where credentials had already leaked.
What is the difference between a password and a passphrase?
A password is a short, dense string of mixed characters. A passphrase is a longer, usually word-based secret. Length dominates resistance to brute force, and a 16-character passphrase is easier for a person to remember without writing it down.
Are passkeys ready to replace passwords?
For consumer accounts and major SaaS, yes. For a typical Canadian SMB stack of accounting, ERP, dispatch, and trade-specific tools, most line-of-business apps do not support passkeys yet. Plan a hybrid: passkeys where available, password plus phishing-resistant MFA everywhere else.
Does PIPEDA require a specific password policy?
PIPEDA prescribes no length or rotation rule. It requires reasonable safeguards proportionate to the sensitivity of the data. Our PIPEDA compliance guide works through what reasonable means for a 50-seat business, and password-manager use sits inside it.
Are SMS one-time codes still allowed?
Yes, with conditions. NIST SP 800-63B-4 treats out-of-band authentication over the public phone network as a restricted authenticator, permitted at AAL2 provided the user is told about the risk and offered an unrestricted alternative. Phishing resistance is required at AAL3 only.
What does the 2026 DBIR change about password strategy?
It reorders the budget. Verizon’s 2026 DBIR puts software-vulnerability exploitation at 31% of breaches, ahead of stolen credentials at 13%. Keep the password program, and fund patching and edge-device updates first, because that is where the larger share of intrusions now begins.
How much does a password manager rollout cost a Canadian SMB?
The licence is rarely the expensive part. Budget for the shared-account inventory, the migration off browser vaults plus the onboarding gate, which we scope in hours rather than per seat. Cybersecurity services at Fusion Computing run CA$130 to CA$180 per user per month when the vault is part of a managed program.
FIDO2 hardware keys versus authenticator apps?
FIDO2 keys are phishing-resistant; TOTP authenticator apps are not. Issue keys to admins, finance approvers, and break-glass accounts. Use Microsoft Authenticator with number-matching for the rest of the team, and treat SMS codes as the floor rather than the target.
Related Resources
Password security is 1 layer. For the full picture see our cyber insurance coverage checklist and our cybersecurity awareness training for small business. Both assume the credential work above is already done, so start with a CISSP-led credential audit.
