TechOnPurpose Logo

#CYBERinsanity – Habit #1: Passwords!

by | Sep 15, 2025

Still Reusing Passwords? Great. You’re Every Hacker’s Favorite Target.

Reusing passwords might feel like a convenient solution that “has never been a problem”—but to a hacker, it’s a jackpot!

One leaked login opens the door to your entire digital life—and your company’s too.

7 Everyday Habits That Will Irrevocably Destroy Your Business!

#CYBERinsanity = doing the same thing, over and over… expecting the SAME results!

In this first series post, we’ll expose how password reuse became the most dangerous habit in the workplace, how AI-powered credential stuffing is outpacing human defenses, and what it takes to break the cycle before it breaks you.


The Illusion of Safety

Reusing the same password (or a slightly modified version) feels secure—because it’s familiar. But if your “strong” password is:

  • Used more than once
  • Slightly adjusted (like “Password2023!” becoming “Password2024!”)
  • Based on something personal or guessable (kids’ names, birthdays, seasons, pet names)

…then it’s already in a hacker’s dictionary – likely on the dark web, available for pennies.

If you can remember your passwords, they’re not secure enough!


Hackers Know You Better Than You Think

Most attacks don’t happen because of elite hackers targeting you specifically. They happen because your password was already leaked somewhere else—and you reused it.

  • Credential stuffing bots take known leaks and spray them across thousands of sites
  • AI tools now guess predictable password patterns in seconds!
  • Phishing emails, lookalike websites, and even fake login portals are evolving fast – 9,500 new malicious sites daily!

It’s not a question of if they’ll guess your password—it’s when.


What Good Looks Like in 2025

At a minimum, your password strategy must meet these non-negotiables:

  • A unique password for every account
  • A complex structure with a mix of characters
  • And ideally… not even a password at all. (More on that in our next post on MFA.)

But what if you actually could remember your passwords without compromising security?
Modern password security offers a better path—one that uses easy technology to help you stay secure without relying on your memory.

PRO TIP: Start Using Complex “Passphrases”

A great alternative to the traditional random-character mess is a complex passphrase. Try something like:

  • “RedFish_RunFast@Midnight3!”
  • “My3Dogs-Love@Tacos&Rain”

These passphrases are (much) more secure:

  • Easier to remember
  • Much harder to crack
  • Long enough to stop brute force tools in their tracks

Just don’t reuse them – ever!


HIGHLY Recommended Solution: Password Managers

If you have more than 10 accounts (spoiler: you probably have over 100), you can’t realistically do this alone.

That’s why every TC21 client receives access to enterprise-grade password management tools—with secure MFA vaults, shared credential control, and administrative oversight built in.

No more sticky notes. No more spreadsheets. No more excuses.

You don’t need to remember every password. You just need to protect the one that opens your password manager – your password manager will create, security store, and pre-fill all your passwords – on all your devices.


Next Steps: Assess Yourself (and your team!)

  • Do we share logins between users?
  • Are any executives or IT admins using recycled or “weak-but-memorable” passwords?
  • Do we audit password practices, or just trust people are doing the right thing?
  • Do we store credentials securely—or just hope no one finds that notebook?

You can’t fix what you don’t inspect!


Coming Up Next – Habit #2: You STILL Need MFA!

Even the strongest password isn’t enough anymore. In the next “STOP the #CYBERinsanity” post, we’ll discuss insane habit #2 (MFA/2FA), why Multi-Factor Authentication (MFA) is your second line of defense—and how skipping it might be the quickest way to get breached in 2025.


Ready to STOP the #CYBERInsanity?

The habits are real. The risks are rising. And doing nothing? That’s not a strategy. Take the #CYBERsane next step now – while you still have a choice.


About the Author:

Matt Tankersley, CISSP is a US Navy combat veteran and the Founder & CEO of TechOnPurpose. Matt is recognized as an innovator with over 35 years of experience in Information Technology specifically in the areas of collaboration, cloud, security, and managed services. Recognizing the complexity, risk and blindsides that business owners face led Matt to create the TOPCYBER21™ Framework, which simplifies how organizations operationalize cybersecurity. Matt’s dedication to customer experience and unwavering belief that “Technology is at the Heart of Business today,” cast the foundation for our culture and simple operating philosophy: “We love what we do, who we do it with, and who we do it for.”

About TechOnPurpose:

Based in Austin, Texas, TechOnPurpose (“TOP”) delivers comprehensive managed IT and cybersecurity solutions to select clients globally. TOP’s approach to managed IT and cybersecurity continues to deliver simplified conversations and comprehensive, affordable solutions for our global customer family of Small & Medium Businesses and Non-Profits.

Chrome Zero Day Patch: Update Now

Chrome Zero Day Patch: Update Now

Chrome zero day patch #4 of 2026 covers two actively exploited vulnerabilities. CISA deadline: April 15. Your timeline should match.

View Next

Diagram showing how Texas cybersecurity law applies to every business, with two outcome paths — documented before a breach leads to safe harbor, documented after leads to full legal exposure

Texas Cybersecurity Law: What Every Business Must Know

⏱ 6 min readKey Takeaways Texas cybersecurity law already requires every business, regardless of size, to protect sensitive personal information and report breaches within 60 days of discovery. SB 2610 offers a safe harbor from punitive damages — but only if you can...
CVE dashboard showing NIST's "Not Scheduled" status replacing CVSS scores — patch prioritization without a score

NIST Just Derailed Patch Prioritization — Here’s Your Fix

⏱ 3 min readKey Takeaways NIST stopped automatic CVSS scoring for most CVEs on April 15 — the patch prioritization signal most organizations relied on just changed permanently. Only CVEs on CISA's KEV list, federal software, and EO 14028 critical software receive...
AI-Enabled Device Code Phishing — TechOnPurpose Identity & Access Management MFA Bypass Prevention

AI-Enabled Device Code Phishing Is Bypassing MFA — What Your Microsoft 365 Users Are Up Against

⏱ 4 min readKey Takeaways Device code phishing abuses a legitimate Microsoft OAuth flow — no passwords stolen, no MFA prompt triggered, full M365 access granted. AI-generated lures are now role-specific and hyper-personalized — standard phishing training won't catch...
Chrome Zero-Day Patch — TechOnPurpose TC21-05 Endpoint Patch Management Urgency

Chrome Zero Day Patch: Update Now

⏱ 4 min readKey Takeaways This chrome zero day patch isn’t routine maintenance — it covers two vulnerabilities already being weaponized. CVE-2026-5289 scored a 9.6 CVSS — a full sandbox escape. If exploited, an attacker owns the endpoint. CISA added CVE-2026-5281 to...
Russian CTRL Toolkit remote desktop hijacking — TechOnPurpose TC21-15 secure remote access defense

Russian Malware CTRL: Remote Desktop Hijacking Undetected

⏱ 4 min readKey Takeaways Newly disclosed Russian remote access toolkit called CTRL is enabling remote desktop hijacking attacks that bypass all known threat intelligence platforms — including VirusTotal CTRL is a newly disclosed Russian-origin remote access toolkit...
Old vulnerabilities cyber risk — TechOnPurpose patch management defense-in-depth

#CYBERinsanity: The Vulnerabilities Attacking You Today Were Published a Decade Ago

⏱ 5 min readKey Takeaways 32% of the most active exploits are old vulnerabilities, more than ten years old — patches exist, they're just not being applied. Attackers start with the low-hanging fruit: automated scans for known, unpatched flaws before deploying anything...
Defense in depth strategy — TechOnPurpose TOPCYBER21 cybersecurity framework protects your organization from vulnerability exploits

Why Patching Alone Won’t Stop 40% of Cyberattacks

⏱ 4 min readKey Takeaways A defense in depth strategy is no longer optional — it's the only architecture that holds when patching alone fails. Nearly 40% of all intrusions in Q4 2025 were caused by exploited vulnerabilities — not phishing, not credential theft. Some...
2026 National Cyber Strategy Blog Post image

2026 National Cybersecurity Strategy: What It Means for You

⏱ 5 min readKey Takeaways The White House's 2026 national cybersecurity strategy introduces six strategic pillars — the clearest federal signal yet that passive cyber defense is no longer acceptable. All six pillars align directly to the TOPCYBER21™ framework — if...
TechOnPurpose achieves MSSP Alert's prestigious 2025 Top 250 Managed Security Service Providers (MSSPs) list, ranking #159 globally—a significant jump of 32 positions from last year's #191.

TechOnPurpose Named to MSSP Alert’s 2025 List of Top 250 MSSPs – Climbs 32 Spots Year-Over-Year

TechOnPurpose is proud to announce its inclusion in MSSP Alert's prestigious 2025 Top 250 Managed Security Service Providers (MSSPs) list, ranking #159 globally - a significant jump of 32 positions from last year's #191. This marks the second consecutive year...
#STOPtheCYBERinsanity image - Is Pen Testing a Dollars-Before-Defense Mistake

#CYBERinsanity: When Pen Testing Becomes a Dollars-Before-Defense Mistake

The Fallacy of Pen Testing as a Priority in Cybersecurity If you’ve been following our STOP the #CYBERinsanity series, you already know this uncomfortable truth: Most cybersecurity failures aren’t caused by brilliant hackers or exotic zero-day exploits. They’re caused...
en_US