Here’s What Scanners Won’t Tell You About Your Passwords

The Human Weakness That Keeps Bypassing Your Best Tools

This post expands on one of the top risks we covered in our recent webinar, Beyond Vulnerability Scanners. If you think a clean vulnerability scan means you’re in the clear, think again.

Poor password hygiene, especially reuse, remains one of the biggest threats to enterprise security. Across hundreds of penetration tests, BreakPoint Labs has yet to find a network without major credential hygiene issues. In nearly every engagement, password reuse exposes systems to domain-wide compromise. Attackers know this. They don’t need sophisticated exploits when they can just log in.

Credential-Based Attacks: Still the Top Breach Vector

According to Verizon’s 2024 DBIR, 80% of breaches involve weak or reused passwords. Ponemon’s 2023 report links 50% of breaches to stolen credentials. We see it constantly: even well-patched networks with clean scanner reports are still using weak, recycled admin passwords — like “Winter2023!”

A False Sense of Security = Real Risk

Scanners are great for catching CVEs and configuration issues. But they don’t flag reused passwords, soft reset procedures, or untrained help desks. Security teams often chase critical vulnerabilities while ignoring easy entry points like weak credential policies. The result? A fully patched network that’s still vulnerable to an obvious attack.

Attackers Exploit Overlooked Weaknesses

Threat actors know password hygiene is often neglected — and time and again, breaches occur not through advanced exploits but through reused or weak credentials. Below are real-world examples that underscore just how common — and damaging — this attack path is:

• HealthEquity (2024)²
  Attackers used valid third-party credentials to access data from 4.3 million individuals — no exploits involved. One reused password unlocked social security numbers, addresses, prescriptions, and diagnoses. The breach forced a global password reset for the vendor.
• Snowflake (2024)³
  Attackers accessed at least 165 customer accounts using credential stuffing — reusing login pairs from earlier breaches and info-stealer malware dumps. In some cases, passwords hadn’t changed since 2020. MFA was missing, and scanners never flagged the risk.
• LinkedIn/Citrix (2012–2016)⁴
  Passwords leaked in LinkedIn’s 2012 breach were reused years later to compromise GoToMyPC accounts at Citrix in 2016. No sophisticated tools — just attackers trying known credentials that users had never changed.

In every case, attackers took the path of least resistance — reused passwords, missing MFA, and untested reset procedures. These are the exact weak points that BreakPoint Labs uncovers in engagements: legitimate credentials misused by threat actors without a single exploit needed.

Password Reset Loopholes: The Hidden Entry Point

Even with strong passwords, many organizations are still vulnerable — not because of weak credentials, but because they’re too easy to reset. According to IBM, human error contributes to over 95% of incidents.

Attackers exploit forgotten password flows and helpdesk processes. Most organizations don’t test these for social engineering, and adversaries know it.

BreakPoint Labs regularly tests this: attackers use LinkedIn data, social media, and breach info to impersonate staff and trick helpdesks into resetting credentials. “Hi, I’m Carol from HR, I lost my phone…” — if that works, your strongest controls don’t matter.

Practical Defenses: Fixing Password and Reset Gaps

The good news? These weaknesses are fixable. The solutions aren’t new — but they need consistent implementation. Here’s how to reduce the risk of password reuse and credential-based attacks:

1. Enforce Strong, Unique Password Policies: Make sure every account — from end users to admins and service accounts — uses a strong, unique password. No duplicates across systems. Enforce Password blacklists to block commonly used or previously breached passwords. 
   • Encourage long, complex passphrases that use a minimum of 12 characters (e.g., `Tr0ub4dor&3!`).
   • Include uppercase and lowercase letters, numbers, and special characters (e.g.,’@#$%^&*’).
   • Avoid passwords that meet complexity requirements but are still easily guessed: 
     • Keyboard walks (e.g., 1234, QWERTY, !QAZ2wsx#EDC4rfv)
     • Common phrases (e.g., Spring2025, Welcome123!, Changeme1!)
     • Company name or team name combos (e.g., Company2024, Orioles2023)
     • Personal info (e.g., birthdays, pet names)

2. Promote the Use of Password Managers: Password reuse is often about convenience. A manager solves that:
   • Securely stores and generates strong, unique passwords
   • Eliminates the need to memorize logins
   • Supports secure password sharing (in enterprise versions)

3. Secure Service Accounts with gMSAs
   Service accounts are often overlooked — and risky if static or reused. Group-managed service accounts (gMSAs) improve control by:
   • Rotating passwords automatically
   • Eliminating manual updates and hardcoding
   • Supporting secure authentication without exposure

Audit legacy service accounts and migrate to gMSAs where possible — it’s one of the best ways to secure non-human identities.

4. Require MFA Everywhere: MFA is non-negotiable. MFA drastically reduces breach impact. Even if credentials are compromised, a second factor (push, OTP, token) can block the attacker. Make MFA mandatory for remote access and sensitive systems. It’s not perfect — but it closes the door on many credential-based attacks.

5. Regularly Test and Harden Password Reset Procedures: Your password reset process is only secure if you test it. Just like a pentest, regularly assess:
   • “Forgot password” flows — do they lock out abuse or require strong verification?
   • Helpdesk procedures — are staff trained to detect social engineering?
   • Require callbacks or approval for high-risk resets.

Final Thoughts & Key Takeaways

Most attackers don’t exploit your tools. They exploit your people and your processes. At BreakPoint Labs, we emulate real adversaries to help uncover the blind spots scanners miss. Credential weaknesses are one of the most overlooked paths to compromise — but also the most preventable.

So, What Now?

✔️ Review your organization’s password policies and reset procedures.
✔️ Educate your teams on the real-world impact of credential-based threats.
✔️ Test your controls the way attackers would — before someone else does.

Let’s close the gaps your tools are missing.

References

1. Verizon. (2024). 2024 Data Breach Investigations Report. 

2. TechCrunch. (2024, July 30). HealthEquity Data Breach Affects 4.3 Million People. 

3. Dark Reading. (2024). Snowflake Account Attacks Driven by Exposed Legitimate Credentials. 

4. KrebsOnSecurity. (2016, June 19). Citing Attack, GoToMyPC Resets All Passwords. 

5. IBM Security. (2014). Cyber Security Intelligence Index.