In short: Password security training teaches staff to create long, unique passwords (the NCSC's three random words), store them in a password manager, switch on multi-factor authentication and never approve an unexpected sign-in prompt. It also covers MFA fatigue attacks, number matching and passkeys, which the NCSC now recommends wherever a service supports them.
Why passwords still matter
Most staff now sign in to dozens of services: Microsoft 365 or Google Workspace, finance and HR systems, supplier portals, social media for the company page and a handful of personal accounts on the same phone. Each one is a door, and attackers try the easy ones first.
The common ways passwords are lost are well understood:
- Reuse: one password used on several sites, so a breach of a shopping site unlocks the work mailbox
- Guessable choices: names, pets, football teams, birthdays and simple character swaps that criminals already know
- Phishing: a convincing fake sign-in page that captures the password, covered on our phishing awareness training page
- Sharing: passwords written down, sent in chat or shared between colleagues for a shared mailbox
- Old breaches: credentials exposed years ago still circulating on criminal forums
Training will not make people remember fifty strong passwords, and it should not try to. The goal is a handful of simple habits backed by the right tools.
Passphrases and password managers
The NCSC's advice for staff is to use three random words to make a password that is long and unusual enough to resist guessing but still memorable. It also warns that swapping letters for numbers adds very little strength, because attackers know those substitutions.
The habits we teach:
- Use a separate, strong password for your work email. It is the account that resets all the others.
- Never reuse a work password anywhere else.
- Let a password manager generate and remember the rest. The NCSC suggests password managers for exactly this reason.
- Do not share passwords in email, chat or on sticky notes. Ask IT for a proper shared-access arrangement instead.
- If you think a password has been exposed, change it straight away and tell IT. You will not be in trouble.
For organisations, the policy side matters as much as the training: avoid forced regular password changes for no reason, block common passwords where your directory supports it, and monitor for exposed company credentials. usecure uBreach and general dark web monitoring can alert you when staff credentials appear in a breach.
Multi-factor authentication, and how attackers get round it
Multi-factor authentication (MFA), which the NCSC calls 2-step verification (2SV), means a stolen password alone is not enough. Staff should understand that it is one of the most useful protections they can switch on, starting with email (the account that can reset all the others) and anything that handles money.
Not every second factor is equally strong, and staff meet several kinds:
| Method | What staff should know |
|---|---|
| Text message code | Better than nothing, but a code can be read out to a scammer or intercepted. Never share a code with anyone, including someone claiming to be IT |
| Authenticator app code | Stronger than a text, but a fake sign-in page can still ask for the code in real time |
| Push approval with number matching | You type the number shown on the sign-in screen into the app, so you cannot simply tap Approve on a request you did not start. Microsoft now applies number matching to all Microsoft Authenticator push notifications |
| Passkey or security key | Tied to the genuine website, so a fake sign-in page cannot capture it. Since April 2026 the NCSC has said it will recommend passkeys wherever a service supports them, with 2SV as the fallback where it does not |
MFA fatigue is the attack that training must cover by name. A criminal with a stolen password sends prompt after prompt, often late at night, hoping someone taps Approve to make it stop. Sometimes they follow up with a message or a Teams chat pretending to be IT support. The rule is simple: if you did not just try to sign in, deny the prompt and report it, because it means someone else has your password. See also help desk social engineering for the related trick of talking a service desk into resetting MFA.
What a good password and MFA module covers
A good module is short (ten minutes or less), practical and repeated with small reminders through the year. We look for content that covers:
- Building a three-random-words passphrase, with a live example
- Setting up and using the organisation's approved password manager
- Turning on MFA for work and personal accounts, and why email comes first
- What an MFA fatigue attack looks like and what to do
- Why you never read out or forward a one-time code
- What passkeys are and how to use them when a service offers one
- How to report a suspected compromise, without blame
Most of the platforms on our vendors page include password and MFA lessons in their libraries. We pick the one that fits your licences and size, then schedule this topic early in your security awareness training programme and include it in every security induction for new starters.
Training plus technology
Training works best when the technology makes the safe choice the easy one. Strong MFA with number matching or push verification, single sign-on so staff have fewer passwords, and conditional access that blocks risky sign-ins all reduce the number of decisions staff have to get right.
For the technology side, see Cisco Duo MFA and Cisco Duo Push, or our general Microsoft 365 security guidance.
Contact us and we will review your current password and MFA set-up and build the training around it.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the NCSC advice on passwords?
The NCSC recommends using three random words to create a long, memorable password, protecting your email with a strong and separate password, using a password manager, and turning on 2-step verification. In April 2026 it said it will recommend passkeys wherever a service supports them, with 2-step verification where it does not.
What is an MFA fatigue attack?
An attacker who already has someone's password sends repeated sign-in approval prompts, hoping the person approves one by mistake or to make them stop. Number matching makes this much harder. Staff should deny any prompt they did not start and report it, because it means their password has been stolen.
Should staff use a password manager at work?
Yes, if the organisation provides an approved one. A password manager lets people use a unique, strong password for every account without having to remember them, which removes the reuse problem. Staff should use the company's chosen tool rather than a personal one for work credentials.
Are passkeys better than passwords?
Yes. The NCSC says passkeys are at least as secure as, and generally more secure than, even the strongest password combined with 2-step verification, because they are tied to the genuine website and are highly resistant to phishing. Where a service does not support passkeys, the NCSC advises a strong password from a password manager plus 2SV.
How often should we run password training?
Cover it at induction, include a short module once a year, and use brief reminders when you introduce new tools such as a password manager or passkeys. Real events, such as a wave of MFA prompts, are a good moment for a quick refresher.