In June 2026, a round 75 000 Fortinet firewalls, or around half of every Fortinet device facing the internet, had their admin passwords cracked. The company had fixed the underlying weakness over a year earlier. The passwords were initially stored using SHA-256, a fast-hashing algorithm. Any attacker with enough GPU power could easily run millions of guesses a second until one matched. The replacement algorithm, PBKDF2, slows that process down, but the upgrade wasn’t automatic. It only applied the next time an admin logged in and triggered it, and most never did.
The incident, which quickly became known as “FortiBleed”, is one of the largest credential exposures tied to a single vendor, and shows how length and complexity protect nothing once an attacker has the plaintext in hand. And in this particular scenario, 20-character strings were just as vulnerable as “password123”, a reminder that no password is strong enough to survive sitting unrotated, unchecked and forgotten. Fortinet did its part, but what it couldn’t do is force someone to log into their own firewall and trigger the fix.
To mark World Password Day in May, Kaspersky analysed 231mn leaked passwords from breaches over the last three years. Not only did they find that 68% could be cracked within a day, more than half of those compromised had already appeared in a previous breach.
It’s not that complexity is useless. It’s that rigid rules can produce predictable patterns at scale.
Tatyana Shishkova, Kaspersky
Tatyana Shishkova, lead security researcher and acting head of the company’s GReAT Americas and Europe research centre, says the cause isn’t carelessness but, rather, the sheer number of accounts people are expected to manage. According to Entrust, the average internet user now has over 100 accounts that require a password. Dashlane, a global security platform, estimates this number to be closer to 250. “Creating and remembering unique passwords for all of them becomes quite a task,” says Shishkova. “People tend to fall back on reuse or minor variations.”
The name for this in cyberpsychology research is security fatigue, or the point where the mental effort of staying secure exceeds what’s practical in daily life. “These behaviours are often an adaption to increasing cognitive demands, rather than being a lack of awareness,” says Caryn Gilmour, executive for fraud risk authentication at Absa Personal and Private Banking. “As the number of accounts increases, so too does the cognitive burden associated with remembering and managing unique login credentials.” One of the biggest problems is that the rules companies built to fix this have largely backfired.
Telling someone to add a capital letter, a number and a symbol doesn’t necessarily make a password harder to predict, it just gives people a new pattern to repeat across every account. “Initially, users might be more vigilant and attentive, but eventually desensitisation sets in,” says Patrick Munsami, security architecture and engineering manager at Datacentrix. “They move from being vigilant, to annoyed, then numb, and eventually reckless. The cost of this can be catastrophic because it potentially gives an attacker direct access to the system.”
In the same password research, Kaspersky discovered that 53% of the passwords it examined end with digits, 17% begin with them, and nearly 12% contain a number resembling a date. And when asked for a symbol, ‘@’ is the most common choice, followed by a full stop and then an exclamation mark. “It is not that complexity is useless,” says Shishkova. “It is that rigid rules can produce predictable patterns at scale.” She says a password can meet every complexity requirement on a signup form, an uppercase letter, a number, a symbol and still be weak, because those rules check format rather than entropy, the actual measure of how unpredictable a password is to a cracking algorithm, expressed in bits. Each additional random character roughly doubles the number of possible combinations an attacker has to work through, while a predictable pattern, a capital at the start, a number at the end, shrinks the search space, regardless of how long the password looks.
This is also why poor password hygiene isn’t simply a user, technology or policy failure. “It’s all three, but not equally in every environment,” says Shishkova. Individual responsibility, in her view, covers the basics, like unique passwords, avoiding reuse, two-factor authentication where it’s available. But that responsibility has a ceiling. “Organisational responsibility begins the moment a company asks people to trust it with access, data, or identity,” she says. From there, the obligation shifts to the business – proper authentication design, secure password storage and policies that don’t punish users for being human. “Security cannot depend on every person making perfect decisions every day,” adds Shishkova.
According to HYPR’s ‘State of Passwordless Identity Assurance 2026’ report, 76% of organisations still rely on legacy passwords, but 43% have already deployed some form of passwordless authentication, even if most have rolled it out to less than half their workforce so far. “Passkeys enable passwordless authentication through cryptographic credentials stored on a trusted device, while biometrics are used to verify that the person using that device is the legitimate user,” says Absa's Gilmour, adding that the transition to passwordless doesn’t mean replacing one credential with another.
It requires trusted devices, stronger verification mechanism and authentication controls that can support both security and seamless customer experience. Kaspersky believes the gap isn’t the technology. Recovery flows still default to a password reset the moment a device is lost or swapped, which reopens the exact vulnerability passkeys were meant to close. “Behaviourally, users must stop treating passwords as the default safety net,” says Shishkova. “The goal should not be to replace one fragile dependency with another, but to give users secure, recoverable and portable authentication options.”
WHAT’S PROTECTING YOU?
Not all authentication methods are built the same, but every method below relies on one of three things: something you know, something you have or something you are. The strongest setups combine more than one.
Passwords: A secret string only you know. Cheap to implement, easy to phish and only as strong as the hashing method behind it, which is exactly what failed in FortiBleed.
SMS one-time codes: A six-digit code sent by SMS, valid for a short window. Better than a password alone, but vulnerable to SIM swapping and interception, which is why banks and security researchers increasingly steer people away from it.
Authenticator app codes: A code generated locally on your phone, refreshing every 30 seconds, calculated from a shared secret rather than sent over a network. Harder to intercept than SMS, but still phishable if someone tricks you into typing it into a fake site.
Push notifications: A prompt sent to your phone asking you to approve or deny a login attempt. More resistant to phishing than a typed code, although attackers have learned to flood users with repeat requests hoping one gets approved out of frustration, known as an MFA fatigue attack.
Hardware security keys: A physical device, usually a USB key that signs a login challenge using a private key that never leaves the device. It’s considered the gold standard for phishing resistance, since there’s no code to steal and no way to replay it on a fake site.
Passkeys: Hardware key security built into the device you already own. Your phone or laptop generates a unique key pair for each site, the private half locked inside the device’s secure hardware. Unlocking it with a fingerprint or face scan signs you in, with nothing transmitted that an attacker could steal or guess.
Biometrics: Fingerprints, face scans or iris recognition, almost always used as a local gate to unlock a device or passkey rather than sent anywhere. You can change a password if it leaks, but you can’t change a fingerprint if a database storing it is ever breached.
* Article first published on www.itweb.co.za
Share
