The passwords that appear on annual worst-password lists barely change, sequences like 123456 and the word password itself have topped them for years, which tells you that the problem is not a lack of awareness but a lack of practical alternatives that people will actually use. For a small business, a single reused weak password on a business account is a genuine operational risk rather than an IT technicality.
Attackers do not usually guess passwords one at a time, they test enormous lists of known common passwords and previously leaked credentials against many accounts at once, which is why predictable passwords fail so reliably.
Reused passwords turn one breach into many
The most damaging habit is not weakness but reuse, since a password exposed in an unrelated service’s breach gets tried against business email, banking and supplier portals, which means one compromised account elsewhere can open several that matter.
A password manager solves the problem people actually have
Nobody can remember dozens of genuinely strong, unique passwords, which is precisely why people reuse them, and a password manager removes that constraint by generating and storing them, making strong unique credentials practical rather than aspirational.
Multi-factor authentication matters more than password strength
Even a strong password can be phished or leaked, and requiring a second factor means a stolen password alone is insufficient, which makes enabling multi-factor authentication on email, banking and cloud accounts the single highest-value security step a small business can take.
Business email deserves the strongest protection
Email is the recovery route for almost every other account, so an attacker controlling business email can reset passwords across banking, suppliers and platforms, which makes it the account to secure first rather than one among many.
The obligation to report a breach that exposes customer information is not optional in South Africa, and the reporting process is set out by the Information Regulator.
Frequently asked questions
Why do the same weak passwords appear on these lists year after year?
Because the problem is not awareness but practicality, people reuse simple passwords since remembering dozens of strong unique ones is genuinely impossible without a tool to manage them.
What is the most damaging password habit?
Reuse. A password exposed in an unrelated breach gets tested against business email, banking and supplier accounts, turning one external compromise into several that matter directly.
Are password managers safe to use?
Established password managers are considerably safer than the realistic alternative, which is reusing memorable passwords across multiple accounts, and they make strong unique credentials genuinely practical.
What is the single highest-value security step for a small business?
Enabling multi-factor authentication on email, banking and cloud accounts, since it means a stolen or phished password alone is not enough for an attacker to gain access.
Which account should be secured first?
Business email, because it is the password-recovery route for almost every other account, meaning an attacker who controls it can reset credentials across banking, suppliers and platforms.
Further reading
Originally published in December 2017. Updated September 2026 and expanded from the original list into practical credential security guidance for small businesses, since the underlying problem has not changed.
