Strong password policy does not equal strong passwords. Most organisations have configured a complexity rule — eight characters, mixed case, a number, a symbol — and never tested whether their users are actually choosing passwords that resist a real attack. They are not. Patterns like CompanyName2024! pass policy and fail every credential-stuffing attempt. Password security assurance closes the gap between policy compliance and operational resilience.
The short answer
Password security assurance tests the actual strength of every password in your Active Directory against realistic attack techniques, surfaces dormant and over-privileged accounts, identifies Kerberoastable service accounts, and produces user-level remediation evidence. The methodology aligns with NIST SP 800-63B and CIS Controls v8 Account Management.
Why password policy alone fails
Policy enforces character composition. It does not test whether the resulting password is strong against real-world attacks: dictionary lookups, common-pattern guessing (CompanyName2024 style), and credential reuse from public breach corpora. A password that passes policy can still be one of the top 100 patterns in any modern password-attack toolkit. The assurance question is empirical — what would a real attack find?
How testing actually works — without seeing your passwords
Credible password assurance extracts password hashes from Active Directory via an agent on the domain controllers. Hashes remain encrypted in transit; the practitioner never sees plain-text passwords. Hashes are tested against dictionary attacks, common patterns, and breach corpora. Where a weak password is identified, the report cites the user account and the weakness pattern — not the password itself. This is the only defensible operating model.
Identity hygiene beyond passwords
Password testing is the entry point. The deeper assessment covers user access rights, inactive and dormant accounts, administrative-account patterns, accounts vulnerable to Kerberos attacks (Kerberoastable service accounts, AS-REP roastable accounts with pre-authentication disabled), accounts with non-expiring or never-changed passwords, and stale administrative-group memberships. Most environments accumulate years of decisions no one remembers making.
User-level remediation versus blanket policy reminders
Most awareness campaigns broadcast generic password advice. The assurance approach is targeted: the user whose password failed testing receives specific feedback — what pattern was vulnerable, what to change, and why. Communication can be direct (from the security team to the user) or routed through line management. Either way, the remediation is directed at the actual users with the actual problem.
Continuous monitoring between assessments
Identity hygiene degrades quickly — new joiners, role changes, project accounts, service accounts created without lifecycle ownership. An interactive dashboard between assessments gives ongoing visibility into Active Directory posture: password health trends, account activity, and emerging risks. Many organisations run quarterly or semi-annual full assessments alongside continuous dashboard monitoring.
Key Takeaways
- Policy enforces character composition; testing reveals whether passwords actually resist attack.
- Hashes never leave encrypted transit — practitioners never see plain-text passwords.
- Identity hygiene covers passwords, dormant accounts, privileged-access creep, and Kerberos-vulnerable accounts.
- User-level remediation targets actual users with actual problems — generic awareness underperforms.
- Identity posture degrades quickly — continuous monitoring is now standard, not annual testing.
How Cyber Resilience Can Help
Cyber Resilience helps organisations improve identity hygiene, reduce credential exposure, and strengthen Active Directory security through structured password assurance and continuous monitoring programmes.
Speak with our team to arrange a discussion on password and identity assurance.