How to audit your business passwords and find the weak ones

You can write the best password policy in the world, but it only describes the passwords you want. A password audit tells you the ones you actually have. Those two things are almost never the same. Somewhere in your business right now there is a payroll login that has been reused on three other sites, an old service account nobody remembers setting up, a shared social media password that four people know and none of them can rotate, and at least one credential sitting in a public breach dump waiting to be tried against your email. A password audit is how you find those before an attacker does.

This article walks through what a business password audit actually covers, how a password manager does most of the heavy lifting for you, the free tools you can use to check for exposed credentials, how to prioritize what to fix first, and how often to repeat the exercise. It is written for the person who owns this at a 20-to-50 person business, which is usually the owner, the office manager, or the one technically-minded person on staff, not a dedicated security team. You do not need a penetration tester to run a first pass. You need a couple of focused hours and a list of where to look.

Short answer

A business password audit inventories every credential your company uses and flags the risky ones: passwords reused across accounts, weak or default passwords, credentials found in public breach dumps, accounts with no MFA, inactive accounts that still work, shared logins, and service accounts that have never been rotated. The fastest way to run one is to let your business password manager do it, because a business-grade manager includes a built-in security dashboard that scores every stored password and flags reuse, weakness, and known breaches automatically. For accounts not yet in the manager, check your domain against Have I Been Pwned to see which company email addresses appear in known breaches. Then prioritize by blast radius: fix exposed and reused credentials on email, finance, and admin accounts first, because those unlock everything else. Run a full audit quarterly, and let the manager’s dashboard catch problems continuously in between.

Password audit at a glance

Question	Short version
What does it check?	Reuse, weak passwords, breach exposure, missing MFA, inactive accounts, shared logins, stale service accounts.
Do I need special tools?	No. A business password manager’s security dashboard plus Have I Been Pwned covers most of it.
Where do I start?	The accounts that unlock everything else: email, finance, and admin logins.
What is the fastest win?	Rotating any password that appears in a known breach, starting with reused ones.
How do I check for exposure?	Have I Been Pwned domain search for your company domain; the password manager flags breached entries automatically.
What is easy to miss?	Service accounts, browser-saved passwords, and logins set up by someone who has since left.
How long does it take?	A few hours for a first pass at a small business, less once the manager is doing continuous monitoring.
How often should I run one?	A full pass quarterly, with continuous dashboard monitoring in between.
Who should own it?	One named person, so it actually happens on schedule rather than never.

What a password audit actually covers

A password audit is not one check. It is a short list of separate questions you ask about your credentials, each of which surfaces a different kind of risk. A thorough audit answers all of them.

Reused passwords. The single most dangerous pattern. When one password is used on five accounts and any one of those five is breached, all five are compromised. Attackers rely on this through credential stuffing: they take a username and password leaked from one site and try the pair automatically across hundreds of others. Reuse is what turns a breach at some unrelated service into a break-in at your business email.

Weak and default passwords. Short passwords, dictionary words, keyboard patterns, and anything a person chose because it was easy to type. Default credentials are the worst version of this: the admin/admin still sitting on a router, a firewall, a network printer, or an application that was deployed and never hardened.

Breached and exposed credentials. Passwords that already appear in a public breach dump. It does not matter how strong a password is if it is already circulating on a list attackers pull from. These need to be found and changed regardless of how complex they look.

Accounts missing MFA. A password audit is also an MFA audit, because the two are the same defensive layer viewed from two sides. Any important account without MFA on top of the password is one stolen password away from compromise. The audit should produce a list of every business account that supports MFA but does not have it enabled.

Inactive accounts that still have working credentials. The login of a former employee that was never disabled. A vendor account for a service you stopped using. A test account created during a project and forgotten. These are attractive because nobody is watching them, so a compromise goes unnoticed for a long time.

Shared credentials. Logins that more than one person uses. These are hard to audit precisely because no single person owns them, impossible to rotate cleanly without disrupting everyone, and a blind spot for accountability. The audit needs to catalog every shared login and note who has access. The full treatment of fixing these is in the problem with shared passwords and how to fix it.

Service accounts with no rotation. The non-human accounts that applications, backups, and automated processes use to authenticate. They tend to be set to never expire, shared across systems, and never rotated, because rotating them risks breaking something. They are frequently the most neglected credentials in the whole environment, which is why they deserve their own dedicated cleanup rather than being lumped in with everyday user logins.

If your audit only checks for weak passwords, you have done maybe a fifth of the job. The exposure, reuse, and forgotten-account checks are where the real risk usually hides.

How a business password manager does the heavy lifting

The reason a business password audit is achievable in an afternoon rather than a week is the security dashboard built into every business-grade password manager. This is one of the clearest arguments for using a business password manager in the first place: the audit tooling is included, and it runs continuously instead of only when you remember to look.

Most business password managers, under a name like Watchtower, Security Dashboard, Vault Health, or Security Audit depending on the product, will automatically report:

• Reused passwords, listing every credential used on more than one account.
• Weak passwords, scored against length and complexity so you can see the worst offenders.
• Breached passwords, cross-referenced against known breach databases and flagged the moment a stored password appears in one.
• Old passwords, so you can spot credentials that have not changed in years where that matters.
• Missing or inactive MFA, on managers that track two-factor status.
• Overall account health, usually as a single score that trends up as you fix things.

The value is that this is not a point-in-time snapshot. Once a credential is in the manager, the dashboard re-checks it against new breach data continuously. A password that is clean today gets flagged automatically the week a service it belongs to is breached. That continuous monitoring is what makes the manual quarterly audit a much smaller job: you are reviewing a dashboard that has been watching all along, not starting from zero.

The obvious limitation is that the dashboard can only see what is stored in it. Anything living in a browser, a spreadsheet, a sticky note, or someone’s head is invisible to it. So the first move in any real audit is coverage: getting credentials into the manager so the dashboard can see them. Every business password outside the manager is a blind spot in the audit, which is the practical reason deploying the manager across the whole business matters as much as choosing a good one.

Free tools for checking credential exposure

Not everything is in your manager yet, and some checks are worth running independently. A few free tools cover the gap.

Have I Been Pwned, domain search. The most useful free tool for a business. The standard Have I Been Pwned search checks a single email address, but the free Domain Search feature lets you verify ownership of your company domain and then see every address on it that has appeared in a known breach, along with which breach and when. For a small business this is the single highest-value check you can run: it tells you which of your employees’ work addresses are already circulating in breach dumps, which is exactly the list credential-stuffing attackers work from. Verifying the domain takes a DNS record or an inbox confirmation, and the results are free.

Have I Been Pwned, Pwned Passwords. A companion service that lets you check whether a specific password has appeared in a breach without ever sending the password itself, using a privacy-preserving method called k-anonymity that only transmits the first few characters of its hash. Most password managers already use this database behind the scenes, so you rarely need to query it by hand, but it is there.

Your identity provider’s reports. If you run Microsoft 365 or Google Workspace, the admin console already flags risky sign-ins, leaked credentials, and accounts without MFA. Microsoft Entra ID surfaces leaked-credential and risky-user reports; the Google Admin console shows security health and two-step verification enrollment. These overlap with what your password manager reports but cover the identity layer specifically, and they are already included in your subscription.

Your browser’s built-in check. Chrome and Edge include a password checkup that flags reused and breached passwords saved in the browser. This is worth running once, not because browser storage is where business passwords should live (it is not, and part of the audit is getting them out of there), but because it surfaces what is currently sitting in browsers so you can migrate and then disable it.

A note on caution: only ever check passwords through services that use a privacy-preserving method like the hash-prefix approach Have I Been Pwned uses, or through your own password manager. Never paste a live business password into a random “is my password strong” website. Some of those exist to harvest exactly what you type.

How to prioritize what to fix

An audit of a real small business will surface more issues than you can fix in one sitting. The mistake is to work top-to-bottom through the list. Prioritize by blast radius instead: how much an attacker gains if that specific credential falls.

Fix first: exposed or reused credentials on the accounts that unlock everything else. Your email is the master key, because password resets for almost every other service go through it. Right behind it are financial systems, your domain registrar and DNS, and any administrative account for your identity provider, password manager, or core business applications. A breached or reused password on any of these is a five-alarm problem. Start here, change the password to a strong unique one, and confirm MFA is on.

Fix next: every remaining breached or reused password, in rough order of the account’s importance. Once the crown-jewel accounts are clean, work through the rest of the dashboard’s breached and reused lists. Reuse is the priority signal here, because a single reused password can be the thread that unravels several accounts at once.

Then: missing MFA on anything that supports it. Enable it everywhere the audit flagged it absent, prioritizing accounts that hold money, data, or admin rights.

Then: inactive and orphaned accounts. Disable or delete former-employee logins, unused vendor accounts, and forgotten test accounts. If an account belonged to someone who has left, this connects directly to your leavers process; what happens to your passwords when an employee leaves covers why these linger and how to close them out properly.

Ongoing: shared and service-account cleanup. These are the slowest to fix because they touch multiple people or risk breaking automation, so they are usually a project rather than a quick change. Move shared logins into a shared vault, and put service accounts on a real rotation plan. Neither is an emergency in the way an exposed admin password is, but both are long-standing weaknesses that a mature environment closes out.

The point of prioritizing this way is that security is not evenly distributed. Ten weak passwords on low-value accounts matter less than one reused password on your email. Fix the load-bearing credentials first, and the audit produces real risk reduction on day one instead of after you have worked through the whole list.

Turning findings into a written record

A password audit that lives only in your head evaporates. Capture the results in a simple document, even a spreadsheet, that records each finding, its severity, who owns the fix, and whether it is resolved. This does three things: it lets you actually track the cleanup to completion instead of losing momentum halfway; it gives you a before-and-after you can show a cyber insurer or a client security questionnaire, both of which increasingly ask whether you audit credentials; and it becomes the baseline you compare against at the next audit, so you can see whether things are improving or drifting.

The written record is also where a password audit stops being a one-time cleanup and becomes a recurring control. The first audit is the biggest, because it clears years of accumulated debt. Every audit after that is a comparison against the last one.

How often to run a password audit

There are two cadences, and you want both.

Continuous, through the manager. The password manager’s security dashboard is monitoring constantly, so the moment a stored credential turns up in a new breach, it is flagged. Treat this as an always-on smoke detector. Assign one person to glance at the dashboard weekly and act on any new breach alerts immediately, because those are time-sensitive.

Full manual pass, quarterly. Every three months, run the complete audit: review the dashboard end to end, re-run the Have I Been Pwned domain search, check your identity provider’s risk reports, and specifically hunt for the things the dashboard cannot see, which are the credentials still outside the manager, the shared logins, the service accounts, and any accounts belonging to people who have left since last time. Quarterly is the right rhythm for most small businesses. Monthly is overkill unless you are in a high-risk or regulated industry; annually lets too much accumulate between passes.

Event-driven, always. Some events should trigger an immediate targeted audit regardless of the calendar: an employee departure, a known breach at a vendor you use, a phishing incident where someone may have entered a password, or a compliance or insurance deadline. These are not the full quarterly sweep, just a focused check of the affected credentials.

Tie the quarterly audit to something you already do, like a recurring calendar block owned by a named person, so it happens on schedule rather than the moment after an incident forces it.

Common password audit mistakes

1. Only checking password strength. Strength is one of seven things an audit covers. A very strong password that has already been breached, or reused across five accounts, is still a serious risk.
2. Ignoring service accounts. They are the least visible and least rotated credentials in most environments, and skipping them leaves the quietest door open.
3. Auditing only what is in the manager. The dashboard cannot see browser-saved passwords, spreadsheets, or credentials in someone’s head. Coverage comes first, or the audit has blind spots.
4. Fixing the long list instead of the important short one. Working top-to-bottom wastes the first hours on low-value accounts. Prioritize by blast radius: email, finance, and admin first.
5. Pasting live passwords into unknown checker sites. Use only privacy-preserving tools like Have I Been Pwned or your own manager. Some checker sites exist to harvest what you type.
6. Treating it as a one-time project. Credentials drift the day after you finish. Without a recurring cadence, the environment is right back where it started within a year.
7. Not writing anything down. An audit with no record cannot be tracked to completion, shown to an insurer, or compared against next quarter.
8. Skipping the MFA check. An audit that finds weak passwords but never lists the accounts missing MFA has ignored the layer that saves you when a password does fall.
9. Forgetting former employees. Accounts that still work after someone leaves are prime targets precisely because nobody is watching them.
10. Auditing but never rotating the shared credentials. Cataloging a shared login and leaving it shared insecurely changes nothing. The finding has to lead to a fix.

How this fits the rest of your credential security

A password audit is the reality check that sits underneath the rest of your credential program. Your password policy sets the standard; the audit measures how far your actual environment is from it. Your password manager is both the tool you audit and the tool that does most of the auditing. The findings feed straight into your offboarding process, your shared-credential cleanup, and your MFA coverage. Run in isolation it is a snapshot. Run as a recurring control that closes the gap between the policy and reality, it is one of the highest-leverage security habits a small business can build.

How Sequentur can help

If you want a thorough first-pass audit of your business credentials, or a managed setup where the monitoring runs continuously and the quarterly review is handled for you, schedule a call.