Make the safer choice
easier to use.

THE ORIGINAL STUDY / APRIL 2024

What the “20%” headline actually measured.

The IET release reports an online Opinion Matters survey of 2,000 UK respondents aged 16+, conducted on 18–22 April 2024. In a choice between letter/number substitution and three random words, the responses were:

This is not evidence that 80% used insecure passwords. The question tests a particular comparison, not every respondent’s real credentials.

Other results: 77.10% believed frequent changes improved security; 19.45% reported reusing one strong password across sites; 27.15% reported using a password manager. These are different questions and overlapping behaviours, not parts of one total.

The release’s top-line pet-name figure differs from its detailed table, so it is not used here. No single password-cracking time is treated as universal.

The practical lesson is to identify the misconception before choosing an intervention. A business account review can then test the actual sign-in experience, without assuming that a public survey diagnoses its workforce.

PASSWORD POLICY

Make uniqueness practical; avoid cosmetic complexity.

Reusing a secret means a disclosure at one service can create exposure elsewhere. A policy that demands difficult-to-remember variations without giving people a workable storage method can encourage predictable patterns.

For systems within its scope, NIST SP 800-63B-4 rejects arbitrary composition rules and routine periodic password changes. It calls for screening new passwords against commonly used or compromised values and requiring change when there is evidence of compromise. It also permits password managers, autofill, and paste.

That is an authoritative design reference, not a declaration that every UK business has the same legal password obligations. Review the requirements of your own services and contracts. Distinguish a necessary reset after compromise from changing everyone’s password merely because another month has passed.

Give staff an approved way to generate and keep unique credentials. Establish who supports the tool, how access is recovered, and how shared business access is handled when someone leaves. Avoid asking people to disclose their real passwords during a review.

STRONGER SIGN-IN

Protect the account behind the password.

The NCSC explains why passkeys resist phishing: the digital credential is tied to the genuine service instead of being a reusable password someone can type into an imitation page. Availability and account recovery still need checking.

For the highest-impact accounts, review what is actually enabled. Start with email, administration, and services used to authorise payments or reset other accounts. A stronger method that remains optional while a weak fallback stays available may leave the important route unchanged.

App-generated codes and SMS codes should not be described as phishing-resistant: a fraudulent sign-in page can ask the user to relay either. Select the strongest supported method appropriate to the account, and understand what happens if the usual device is lost.

Use a test account or a controlled walkthrough. The purpose is to find friction and unsafe exceptions, not to collect employees’ secrets or invent a new awareness score.

CONNECTED DEVICES

Buying the product is the start of its support life.

Password habits also matter beyond the laptop. Buying a connected camera, doorbell, or similar product creates an ongoing account and update responsibility.

The UK consumer-connectable-product regime began on 29 April 2024. Its defined minimum requirements concern passwords, a route for reporting security issues, and disclosure of the minimum security-update period. A legal baseline does not mean that a product is immune to attack or that every enterprise device falls within its scope.

Before buying, check the support commitment and who will manage the device account. During use, install supported updates, control shared access, and review ownership when staff or suppliers change. Plan how the device will be replaced or disconnected when support is no longer suitable.

READING THE STUDY TODAY

Use the findings to improve a service, not label people.

The survey dates from April 2024; the sign-in and device guidance was rechecked for this revision. No claim is made that its percentages describe the UK public in October 2026.

For management reporting, examine adoption of supported stronger sign-in, recovery difficulties, and unresolved access exceptions. A short account walkthrough may reveal a more useful improvement than repeating a general password quiz. Keep any workforce measurement proportionate and transparent.